Cloudflare Adds Ongoing Checks for Verified Bot Behavior

Cloudflare says its new system will assess whether Verified bots follow site instructions and respond to traffic feedback over time. The company is using it internally and plans to give customers control over trust thresholds.
Hexa Cloud Services
Oct 17, 2026 · 4:53 PM
4 min read
share
$ stat article
Published
Oct 17, 2026 · 4:53 PM
4 hours ago
Updated
Oct 17, 2026
Read time
4 min read
Category
CloudFlare
Cloudflare Adds Ongoing Checks for Verified Bot Behavior
A decorative world map on a wall inside Cloudflare offices in Lisbon.

Cloudflare says its continuous accountability effort evaluates whether Verified bots follow website preferences, adding behavioral evidence to the identity checks used to recognize automated traffic. Its new system tracks patterns over time so website owners can see whether a bot respects instructions and responds when a site pushes back.

The company says verified identity alone cannot establish trustworthy behavior. A bot may identify its operator accurately yet ignore a site’s rules, send too many requests, or evade controls. Cloudflare’s approach to Continuous accountability is intended to show whether conduct remains responsible after a bot has been verified.

The system is already in use internally, Cloudflare said. The company plans to make it available to all customers, who would be able to choose a trust threshold for deciding how Verified bot traffic is handled.

Continuous Accountability Tracks Repeated Behavior

Cloudflare describes risk as the chance that a particular request or action may cause harm at a specific moment. Trust, by contrast, develops through behavior repeated over time. The company says its assessment will therefore focus on sustained patterns rather than isolated incidents.

The initial evaluation considers whether a bot follows published instructions and responds to direct feedback. Cloudflare says the resulting trust band will explain how consistently a bot honors site preferences and which observed behaviors informed the assessment. The band is intended as an evolving view, not a permanent judgment about the bot or its operator.

The distinction follows Cloudflare’s removal of Perplexity’s bot from its Verified bot list in 2025. The company said the bot sought access to resources on sites that had opted out of scraping, then attempted to circumvent controls after those requests were blocked.

Cloudflare says bots use Web Bot Auth to sign requests establishing their identity, while BotBase catalogs that information in an open format. The new evaluation addresses a separate question: whether a known bot behaves in ways that respect the sites it visits.

Site Rules and Traffic Responses Inform Trust

A site’s robots.txt file communicates which areas a crawler may access. Cloudflare says it looks for repeated disregard of those preferences, rather than treating every isolated violation as significant. Its stated expectation is that responsible bots consult and honor published rules in line with RFC 9309.

The company also cautions that robots.txt defines minimum restrictions, not blanket permission for everything left unstated. A site can communicate that continued access is unwelcome through other signals, and Cloudflare says bots should respond to those signals too.

Traffic volume is another part of the assessment. An HTTP 429 response, labeled “Too Many Requests,” tells a visitor to reduce its request rate and may include a suggested wait. Cloudflare says it evaluates whether a bot slows down or pauses after receiving that response.

Consistently reducing activity can raise a bot’s trust band, while repeatedly maintaining the same pace can lower it, according to Cloudflare. The company says the system looks at how a bot adapts over time, not only whether a request initially fell within an allowed path.

Cloudflare Plans Customer Trust Thresholds

Cloudflare says it will initially build a history of observed behavior and refine how those observations become useful guidance. It plans to share scores publicly on Radar in the future and expand the signals it measures.

The planned customer release would let each customer select a trust threshold for handling Verified bot traffic. Cloudflare links the effort to Bot Preference Sync, which helps sites publish preferences, and Bot Management, which lets customers decide how automated traffic is handled.

It also gives bot operators a way to demonstrate sustained compliance, the company says. Cloudflare’s continuous accountability system for Verified bots remains in its initial internal phase as the company builds the history behind its assessments.

Related Cloudflare coverage has examined how robots.txt preferences affect AI crawlers, how cache rules shape site responses, and how Cloudflare routed traffic during a blog migration.

News outlet verified by MuckRack editorial team (learn more)
Hexa Cloud Services
// about the journalist
Hexa Cloud Services is the editorial desk of Hexa Cloud, a managed hosting and cloud infrastructure provider. The team covers cloud platforms, web performance, security and developer tooling, with practical analysis for engineers and businesses…
◇// related articles
#CloudFlare · 4 posts

Continue reading