Topic
Products and techniques for identifying automated traffic, classifying its purpose and allowing or blocking it at the network edge.
Cloudflare has introduced a system that scores Verified bots on robots.txt compliance and on whether they slow down after an HTTP 429. It reports the result as a trust band, and Cloudflare says it will share scores on Radar later.
Reality
DataDome says 8.9% of requests in its Meta Muse sample reached form, login, payment, account-creation or cart endpoints. Researcher Jérôme Segura told Let's Data Science it counts exposure, so blocking rules built on request counts alone act on incomplete evidence.
Reality
Huskeys, an edge security startup that has raised $35 million, put Profiling into beta to map the web endpoints a business depends on. It says results show up within hours, but the promise of fewer blocked customers is so far its own argument.
Reality
Cloudflare returned a 403 from ChatGPT's front page to a VPS address listed on zero of eight spam blocklists, a dev.to author's test found. The author argues no blocklist query predicts that block, so automation sent to ChatGPT from a cloud host needs a test run from the address itself.
Reality
Cloudflare says AI-agent requests on its network grew more than 1,700% in a year as non-human traffic passed half the total. It now wants sites to identify and price agents as customers, after advising last year that new domains block AI training crawlers.
Reality
The argument for Cloudflare's new bot engine is economic: attackers iterate in days while defenses ship in discrete managed releases, so the plan is to give automated probes nothing stable to learn from.
Perspective Coverage
3 publishersReality
Fewer than 1% of Cloudflare sites block search crawlers while 17% block training. A single mixed-use crawler used to collapse those two into one decision, and the new setting splits it for three named operators.
Reality
DataDome measured malicious bot activity up 124% in the year to June 2026 against 13.2% growth for humans, and its own detection test found most popular sites challenged none of ten simulated bots.
Reality
AWS WAF's Bot Control can now answer an AI agent with an HTTP 402 and payment instructions. The action runs only on CloudFront distributions, and AWS says the classification behind it is probabilistic and should be tested first.
Reality
A GET asks a site for a page and a POST tells it to act, so the change Akamai measured over 30 days puts verified AI bots on the request type behind store logins, carts and checkouts. Akamai did not break those requests down by action; retailers have that in their own logs.
Reality
Cloudflare's Disallow AI Training control lets Googlebot and Applebot keep indexing a site while a directive Cloudflare writes into robots.txt tells them not to train on it. Bingbot is expected to honor it in early 2027.
Reality
A paid API on three Cloudflare zones had been returning 403 and no price to any caller that never set a User-Agent, and the origin logged none of it. The toggle that blocks them is on by default.
Reality
NessFlow's write-up of a failed 30,000-page audit on a Carrefour regional storefront puts the blocker at adaptive rate limiting and WAF edge rules against a single desktop IP, and hands the reliable fix to the retailer's edge team.
Reality