Cloudflare adds continuous accountability checks for Verified bots

Cloudflare says identity verification alone does not show whether a bot will behave responsibly, so it is adding a way to track behavior over time. The company separates risk, which can change from one request to the next, from trust, which builds through repeated and consistent conduct. It cites its 2025 removal of Perplexity's bot from the Verified bot list after the bot reportedly accessed sites that opted out of scraping and tried to get around blocks.

Initial signals include whether a bot respects robots.txt and other instructions, and whether it responds to direct feedback. The system also checks whether a bot slows down or pauses after receiving an HTTP 429 response, with consistent slowing raising a bot's trust band and repeatedly ignoring the signal lowering it. Isolated violations are not treated as significant, and the company looks for repeated patterns instead.

Cloudflare says it is using the system internally and will publish scores on Radar later. It plans to make the system available to all customers, who will be able to choose the trust threshold that determines how Verified bot traffic is handled. The system works alongside Bot Preference Sync and Bot Management.

Agent developers running crawlers may see their bots assessed on how often they honor robots.txt and back off after 429 responses, not only on their identity. Honoring site preferences and slowing down under load can help keep a bot's trust band intact. Once customers can set their own thresholds, a drop in trust could change how a site handles a bot's traffic.