Verified bot status is no longer a one-time check. AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition → and crawler operators who ignore site preferences or overload origins can lose Verified status on Cloudflare, which changes what access they can rely on.
Key takeaways · AI-distilled
Cloudflare frames Verified status around two questions, identity and trust. Identity comes from Web Bot Auth request signatures catalogued in BotBase; trust is judged separately from observed behavior over time.
The first two behaviors scored are whether a bot's traffic stays consistent with a site's robots.txt (per RFC 9309) and whether it slows down or pauses after HTTP 429 responses. Isolated violations count for little; repeated patterns drive the result.
Results become an explainable trust band showing which observed behaviors informed it, not a permanent verdict. Cloudflare says it plans to publish these scores on Radar and let customers choose the trust threshold applied to Verified bot traffic.
Cloudflare argues robots.txt sets a floor, not a permission list: anything it does not forbid is not implicitly allowed. It cites delisting Perplexity's bot in 2025 after it sought opted-out content and tried to circumvent blocks.
Terms in this piece · Glossary
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
