Cloudflare Precursor: A New Defense Against Bots
Cloudflare is taking a proactive approach to the overwhelming presence of bots on the web with its latest innovation, Cloudflare Precursor. As the internet shifts towards an era dominated by AI agents, Precursor aims to strengthen defenses by observing entire visitor sessions rather than relying solely on single-point checks.
Bots now generate roughly 57% of all web requests, surpassing human activity. This significant milestone prompted Cloudflare to develop a tool that goes beyond traditional security measures. Cloudflare Precursor is designed to catch sophisticated bots by analyzing behavioral patterns throughout a visitor’s session.
A New Approach to Security
Unlike conventional defenses that act like gatekeepers checking IDs at the entrance, Precursor monitors activities within the browser. It tracks mouse movements, scrolling rhythms, typing cadence, clipboard usage, and page visibility duration. While it’s relatively easy for bots to mimic a single click, faking an entire human session presents a much greater challenge.
"Traditional security checks look at a single moment in time, but modern bots have gotten smart enough to fake their way through the front door," stated Dane Knecht, Cloudflare’s Chief Technology Officer. Precursor aims to fill the previously unexplored gap between login and checkout.
Privacy-Focused and Powerful
Cloudflare emphasizes that Precursor is privacy-focused, logging behavioral patterns rather than content. It captures rhythm and cadence, never actual keystrokes. Activation requires just one click, and no code changes are necessary.
The tool is part of a broader strategy to differentiate between beneficial AI traffic and malicious bots. Cloudflare now categorizes AI traffic into three types:
- Search Bots: Index pages for later questioning.
- Agent Bots: Act in real-time on behalf of a human.
- Training Bots: Absorb content for model training.
Starting September 15, new sites on Cloudflare will block Training and Agent bots by default on ad-bearing pages while allowing Search bots to proceed. This approach prioritizes revenue generation since Search bots tend to send readers back to the site, unlike other types.
Cloudflare is also introducing a BotBase database that catalogs every known crawler. Additionally, they are enabling websites to set preferences for bot content reuse: store nothing, index and link back, or summarize and reproduce. This effort builds upon Cloudflare’s previous push for a privacy-first anti-bot standard with major browsers.
As the web evolves with AI agents, Cloudflare Precursor stands as a testament to the company’s commitment to maintaining a secure and private online environment.