Cloudflare is adding ongoing behavior checks to its Verified Bots program, shifting verification from a one-time identity claim toward a continuing assessment of how automated services interact with websites.
In a Cloudflare announcement published October 16, the company said its system measures whether crawlers follow robots.txt instructions and whether they adapt after receiving HTTP 429 responses that signal too many requests. Repeatedly honoring those signals can raise a bot’s trust band, while consistently ignoring them can lower it.
Cloudflare says the assessment will produce an explainable trust band based on observed behavior rather than a permanent judgment about a bot or its operator. The initial checks ask whether a bot respects published instructions and responds to direct feedback. Cloudflare plans to publish scores through Radar and expand the signals used in the evaluation.
The company is already using the system internally and says it is assessing sustained patterns rather than isolated incidents. It plans to make the feature available to all Cloudflare customers, who will be able to select the trust threshold used to decide how Verified Bot traffic is handled. The announcement does not specify a customer rollout date or provide performance data from the internal evaluation.
The system builds on Cloudflare’s identity mechanism for automated traffic. Its Web Bot Auth documentation says verified bots authenticate requests with cryptographic signatures, using Ed25519 keys, a hosted key directory and HTTP message signatures. That establishes who sent a request, but the new system is intended to evaluate whether the identified bot continues to behave acceptably.
Cloudflare cited its 2025 decision to remove Perplexity’s bot from the Verified Bot list after alleging that it accessed sites that had opted out of scraping and attempted to circumvent controls. The new scoring approach is presented as a way to make such accountability continuous, although the evidence supplied here is limited to Cloudflare’s own announcement and documentation.