How Cloudflare Watches All Site Visits to Stop Bots

For the first time in internet history, bots now generate more than half of all web traffic. Cloudflare’s new tool, Precursor, shifts the security paradigm from checking IDs at the door to watching how visitors behave once they are inside the site.

The web crossed a strange milestone recently. According to Cloudflare, automated traffic now accounts for roughly 57 percent of all web requests. That reality underpins the product the company launched on Monday, which fundamentally changes how the internet distinguishes between humans and machines.

Watching the entire visit, not just the doorway

Traditional defenses work like a bouncer checking one ID at the gate. A CAPTCHA asks you to prove you are human once, then lets you pass. But modern bots have become skilled at faking that single moment.

Precursor takes a different approach. It runs inside the browser and monitors an entire session. That includes mouse movement, scrolling rhythm, typing cadence, clipboard use, and how long a page stays visible. Faking one click is easy. Faking a complete human visit is a real engineering challenge.

“Traditional security checks look at a single moment in time, but modern bots have gotten smart enough to fake their way through the front door,” said Dane Knecht, Cloudflare’s chief technology officer. The space between login and checkout, he explained, was a black box. Precursor is designed to close it.

Cloudflare says the tool is privacy-led. It logs behavioral patterns rather than content, recording typing as rhythm and cadence but never the actual keystrokes. It activates with one click and requires no code changes.

Sorting the machines by what they want

Precursor is one half of a larger rethink. The other half concerns the good bots.

Not all automation is hostile. Cloudflare now sorts AI traffic into three categories. Search bots index a page to answer questions later. Agent bots act in real time for a person. Training bots absorb your content into a model.

Starting September 15, new sites on Cloudflare will block Training and Agent bots by default on pages that carry ads, while allowing Search through. The logic is financial. Search sends readers back to your site; the others often do not. This is the next turn in a fight where Cloudflare has already told AI crawlers to pay publishers or get blocked.

The company is also adding a way for sites to set how bots may reuse their content: store nothing, index and link back, or summarize and reproduce. A new database called BotBase names every known crawler. It all builds on Cloudflare’s earlier push for a privacy-first anti-bot standard with the major browsers.

Trust you can carry, and lose

The trickiest part is that the bot at your door is often not operated by the company that built it. Cloudflare wants operators to declare themselves using an existing web header, so a site can allow “OpenAI” and have that choice hold even through layers of middlemen.

Losing that trusted status across the more than 20 percent of web domains behind Cloudflare, the company argues, is a deterrent with teeth. It is a softer cousin of ideas like Estonia’s plan to give every AI agent an ID number. The stakes rise as agents start to shop and pay for us. It also echoes the push to let publishers opt out of AI without vanishing from search.

The plumbing is changing too

The rewiring runs deeper than one vendor. On the same day, the Internet Engineering Task Force published a new HTTP method called QUERY, as the Register reported. It gives complex searches their own verb, safe and cacheable, instead of forcing them to masquerade as data-changing requests.

Cloudflare and Akamai engineers co-wrote the standard. That is the theme running through all of it. The web’s basic machinery was built for human clicks. It is now being quietly rebuilt for a place where most of the visitors are machines.