Cloudflare will score verified bots over time

A band, not a badge for life

Chris Tsoukaladelis's October 16, 2026 post says a verified bot has to identify itself accurately and securely, do only what it says it will do, and refrain from abuse. The new system measures whether crawlers respect site preferences over time and reports an explainable trust band. The post says the band is not a permanent judgment. Two signals it names are whether the bot respects instructions and whether it responds to direct feedback. A discovery pilot on the same network is a different Cloudflare documentthe OpenAI discovery pilot.

What the docs already required

Cloudflare's verified-bot documentation says verification is honest self-identification plus non-abusive behavior: obeying robots.txt and crawl directives, keeping a reasonable rate, and not evading a site owner's preferences. Identification can be a Web Bot Auth signature, a published address list with a stable user-agent, or reverse DNS. The October 16 post adds the idea that those promises are re-checked, and that the result can fall. The docs are the definition. The post is the accountability layer. The distributed-cloud desk isDistributed Cloud.

Direct and intermediary

The docs distinguish a bot operated by one narrow operator from an intermediary that many end users can drive. An intermediary introduces a gap between the operator you might trust and the end user who sent the request. The docs say Cloudflare is experimenting with forwarding information about that end user so a site can apply its preference to the party that actually asked. That experiment is not the October 16 score. It is the identity problem sitting next to it. The privacy desk isPrivacy.

Instructions, and a slow-down

The post says robots.txt, the exclusion file described in RFC 9309, is the minimum, not a grant of every use the file leaves unstated. It also says that when a site answers with HTTP 429, the system watches whether the bot slows or pauses. Those are descriptions of signals Cloudflare says it uses. This page does not turn them into a configuration guide. A site owner who wants the preference itself still writes the preference. The security desk isSecurity.

What is internal, and what is promised

The post says the system is in internal use now. It says scores are planned for later publication on Radar, and that customers will be able to pick a trust threshold. A plan to show a number is not a number a customer can filter on today. BotBase, described in an earlier Cloudflare post, is the catalogue of identity the new check sits on. The paper is Asked directly, Is the score on a public dashboard today? The post says the system is used internally now. Scores are planned later on Radar, and customers are to be able to choose a trust threshold. Planned is not shipped.Futureweb.

A delisting is an example, not a how-to

The October 16 post points at a 2025 decision to remove Perplexity from the verified list after Cloudflare concluded it ignored an opt-out and worked around blocks. That episode is Cloudflare's illustration that verification can be taken back. This brief does not describe the workaround. The fact used here is the consequence: a verified label can be removed. The software desk is Asked directly, Is robots.txt a permission to fetch everything else? Cloudflare says no. The post treats the robots exclusion file as the minimum instruction, not a grant of every use the file does not mention.Software.

Who is in scope

Bot operators who want the verified label, and site owners on Cloudflare who may later set a threshold. The docs say verification has historically been allowed through by default on customer plans, and that customers now have more room to choose. The October 16 change is about whether the label keeps meaning what it meant on the day it was granted. Networking is Asked directly, What does a 429 response tell the system? The post says the system watches whether the bot slows or pauses after the site asks it to. That is a behavioral signal, not a rule this page is turning into a setting.Networking.

What this page will not collapse

A cryptographic signature proves a key signed a request. A trust band, as the post describes it, is a judgment about later behavior. A site that treats the signature as a permanent allow has skipped the half of the policy the new post is about. The open-source desk is Asked directly, What are the three conditions in the October 16 post? Identify accurately and securely, do only what you say you do, and do not behave abusively. A band reflects whether those hold over time.Open Source.

The line to keep

Identify, match the claim, and do not abuse the access. The result is a band that can move. The public score is planned, not a control this page can point to in a dashboard today. The short answer this page will stand on is this: It described a running check on whether a verified bot keeps its word: accurate identification, behavior that matches the claim, and no abuse. The result is an explainable trust band that can move, not a permanent pass. The company says it uses the system internally now and plans to show scores later.