Cloudflare already runs an internal system that tracks how consistently Verified bots respect site preferences such as robots.txt and HTTP 429 responses. You cannot turn it on today. Cloudflare plans to offer it to all customers, who would choose a trust threshold, but gives no date.
The short answer
- The announcement: on 16 October 2026 Cloudflare said that verifying a bot’s identity is not enough to judge its behavior.
- Today: the system is used internally in an “initial phase” to build history and refine it.
- Planned: availability to all Cloudflare customers, who choose the trust threshold, and scores published on Radar “in the future.”
- What is measured: whether the bot respects instructions and whether it responded to direct feedback.
- What it means for you: do not wait for a switch. Your robots.txt and current category rules are the rules bots are measured against.
Why is identity not enough?
Cloudflare says “identity alone doesn’t guarantee a bot will behave responsibly.” A known bot can ignore preferences, overwhelm origins or evade controls. That is “not always malicious” and is often a misconfiguration or bug.
The output is an “explainable trust band.” It shows how consistently a bot respects preferences and which behaviors informed it, “rather than a permanent judgment.”
How does a bot become Verified in the first place?
Cloudflare lists three expectations: identify yourself accurately and securely, “do only what you say you will do,” and do not engage in abusive behavior.
Its documentation (last updated 8 October 2026) says verification rests on a Web Bot Auth signature, a published IP list with a stable user-agent, or reverse DNS. It also requires non-abusive behavior: obeying robots.txt and crawl directives, reasonable request rates and not evading owner preferences.
Bots are categorized (from BotBase) as Search, Agent, Training, Transact, Data Collection, Security Testing, SEO, Ads Verification, Social/Link Preview, Feed Fetching and Monitoring, with a Direct or Intermediary label. On 1 July 2026 the distinction between verified bots and signed agents moved into BotBase metadata.
What is the difference between risk and trust?
The post separates risk, the point-in-time likelihood that a request is harmful, from trust, which is “built over time through repeated and consistent behavior.” The initial signals it names:
- robots.txt: whether observed traffic is consistent with the published rules over time (RFC 9309). An isolated violation may not matter, but a repeated pattern does. robots.txt sets minimum rules and does not imply that anything not stated is allowed.
- HTTP 429: slowing or pausing after a 429 “increases trust,” and repeatedly ignoring it lowers it.
- More signals: more measurement methods “in future.”
Cloudflare calls these signals “common sense” rules and says bands are not permanent. The post does not say how the bands are calculated or whether thresholds will appear in WAF rules or Bot Management.
What is live now and what is only planned?
| Status | Item |
|---|---|
| Available now | The Verified bots program and its categories, WAF rules for the legacy categories, managed presets for Search, Agent and Training, Bot Management, and Bot Preference Sync for publishing preferences |
| Internal only | Cloudflare’s own scoring of bot behavior (robots.txt and 429 signals) |
| Planned, no date | Customer-selectable trust thresholds for all customers, public scores on Radar, additional signals |
The post gives one example of enforcement: Cloudflare delisted Perplexity’s bot in 2025 for accessing sites that had opted out and trying to circumvent blocks. So a Verified label has been withdrawn before.
What should a site owner do?
- Do not look for a switch. Everything announced for this system is planned.
- If you use Cloudflare, review your robots.txt, Bot Preference Sync and current category rules. Those are what bots’ compliance is measured against.
- Do not rely on the “Verified” label alone. We suggest treating it as proof of identity only, since the post itself says identity does not guarantee good behavior.
Questions and answers
Is the behavioral trust system available to Cloudflare customers?
No. It is used internally. Customer availability is a plan with no date.
What does it measure?
How consistently a bot respects site preferences such as robots.txt and responds to HTTP 429, over time.
Can a Verified bot lose its status?
Yes. Cloudflare delisted Perplexity’s bot in 2025 for accessing sites that had opted out and trying to circumvent blocks.
Is one robots.txt violation enough to lower a bot’s trust?
Not by itself, according to the post. An isolated violation may not matter, but a repeated pattern does.
What happens when a bot gets an HTTP 429?
If it slows or pauses, the post says that increases trust. Repeatedly ignoring the response lowers it.
Terms in plain language
- Verified bot: a bot whose identity Cloudflare has confirmed.
- robots.txt: a file where a site lists what bots may and may not fetch.
- HTTP 429: a response that tells a client to slow down.
- Origin: the server that hosts a site.
- WAF: a firewall that filters web requests by rules.
Sources
- Cloudflare: Continuous accountability for Verified bots, 16 October 2026
- Cloudflare docs: Verified bots
Facts last checked against the linked pages on 18 October 2026. Future plans are Cloudflare’s statements, not commitments to a date.
