Cloudflare has laid out its strategy for handling a web where the line between human visitors and automated agents is increasingly blurry. In a post from its Web Integrity & Trust team, the company describes a shift away from static, point-in-time bot checks toward continuous behavioral analysis, a change driven by the rise of what it calls “hybrid” traffic: sessions that start with a human browsing a site and end with an automated agent completing a task, such as checkout.
The core of the approach is a distinction between Risk and Trust. Cloudflare treats these as separate but related values rather than opposite ends of one scale. Risk reflects how likely a given request or action is to be harmful and tends to be short-lived. Trust, by contrast, builds up over time based on a visitor’s or bot’s track record and reputation. Cloudflare argues that decisions based purely on risk, like blocking any traffic that trips a single rule, miss the context that trust-based evaluation provides.
BotBase and Verified Status
Central to the good-behavior side of this framework is BotBase, Cloudflare’s directory of known bots and agents. Unlike the older Bots Directory, which only listed known-good bots, BotBase also tracks bots and agents that don’t meet expectations. Cloudflare’s updated definition of “Verified” status now comes down to two conditions: a bot must honestly declare who it is, and it must not abuse the trust it has been given. That transparency is meant to let site owners set rules for specific bot behaviors and data uses, while giving well-behaved bot operators an easier path to being allowed onto sites.
Precursor for Continuous Detection
On the bad-behavior side, Cloudflare points to Precursor, a client-side detection system announced a few weeks prior. Precursor runs as CDN-injected JavaScript and evaluates user behavior continuously throughout a session, rather than relying on a single check at the start. Cloudflare contrasts this with CAPTCHAs and other one-time hurdles, which it characterizes as risk-based and lacking session context. Precursor’s behavioral, trust-based approach is designed to catch bot traffic that manages to pass an initial client or browser check but reveals itself through inhuman patterns later in a session, raising the cost for bot developers trying to mimic human behavior across multiple pages.
For WordPress site owners and hosting providers, the takeaway is that bot management is moving away from simple allow or block lists toward ongoing behavioral scoring, a shift worth watching for anyone using Cloudflare’s bot management tools or evaluating similar services.