Cloudflare introduces continuous trust score for Verified Bots

Cloudflare has announced a system that evaluates over time whether verified bots actually respect the rules of the sites they traverse, not merely whether they correctly declare their identity. For anyone running a site behind Cloudflare using Bot Management, it's the difference between knowing "who" a crawler is and knowing "whether you can trust" letting it through.

Previously, a bot entered the Verified Bot list by signing requests with Web Bot Auth and being catalogued in BotBase: a one-off identity check. Cloudflare is introducing a continuous accountability system for Verified Bots, moving beyond one-time identity verification towards continuous behavioural monitoring. The system evaluates whether bots respect site preferences, such as robots.txt directives, and whether they respond appropriately to HTTP 429 rate-limiting signals, translating observations into an explainable "trust band" rather than a permanent judgement.

The two initial signals concern compliance with published instructions and direct response to site feedback. On the robots.txt front, the technical reference remains RFC 9309 standard: Cloudflare does not consider an occasional overstep in isolation, but rather flags repeated patterns of behaviour that ignore published preferences. On the rate-limiting front, the system observes whether, after an HTTP 429, the bot slows down or continues sending requests at the same rate: those that slow down gain trust, those that ignore the signal lose it.

The precedent case cited is Perplexity: Cloudflare delisted Perplexity's bot in 2025 after it attempted to access resources on sites that had disabled scraping, and subsequently tried to circumvent the controls once those requests had been blocked. The delisting occurred on 4 August 2025, following reports of crawling with spoofed user agents and undeclared IP addresses across multiple ASNs.

The new score sits alongside Bot Preference Sync, the feature through which Cloudflare automatically writes site preferences set via dashboard into robots.txt for search traffic, AI agents and training, announced on 21 August 2026. Trust scores will be published on Cloudflare Radar; for now the company uses them internally to build a historical record, but plans to make them available to all customers, who will be able to set a threshold beyond which a Verified Bot is treated with greater suspicion.