Cloudflare adds ongoing checks for verified bots, with public trust scores still to come

Cloudflare introduced a system on October 16, 2026, to evaluate when verified bots stop behaving consistently with website preferences. Its central distinction is useful for publishers: knowing who operates a crawler does not establish that every request it makes is appropriate.

In its announcement, Cloudflare says the initial assessment examines whether bots respect instructions and respond to direct feedback. It plans to express observed behavior through an explainable trust band. The company says public sharing of scores on Radar will come in the future; the post does not establish that publishers can already use a public score for every crawler.

Identification and permission answer different questions

A verified identity can help distinguish an established crawler from an impersonator. It does not decide which parts of a publication that crawler should be permitted to retrieve, or how much load the origin can tolerate.

For a site owner, that means the verified label should be read alongside the site's own access preferences. An article archive, a private staging area and a costly search endpoint can require different treatment even when the same identified bot requests all three.

Cloudflare describes sustained observations rather than isolated events as the basis for evaluating trust. That is the company's assessment approach, not an independent finding that a named crawler has violated a particular publisher's rules.

The immediate task is to make preferences inspectable

Before changing access controls, record the site's intended policy. Identify which public sections should be discoverable and which endpoints require restrictions. Keep the policy specific enough that a technical maintainer can compare it with actual requests, response codes and origin behavior.

If a suspected crawler is causing problems, retain a small, relevant evidence set: timestamps, requested paths, response status and the rule involved. Avoid treating a user-agent string alone as conclusive identity. Cloudflare's verified-bot documentation supplies the product context for that classification.

Do not turn a trust label into a traffic promise

The new announcement concerns bot behavior and accountability. It does not promise additional search referrals, AI citations or a payment for crawling. A bot's technical access and a reader's eventual visit remain different events.

Review this alongside Cloudflare's AI discovery pilot, which addresses a separate initiative. If a rules change coincides with a visibility decline, use the traffic-drop investigation to examine the sequence before assigning a cause. The useful output is a policy that matches the publication's intentions and evidence that shows whether requests follow it.