Cloudflare introduces continuous trust scoring for Verified bots

Cloudflare has introduced a system to evaluate and report when Verified bot behavior deviates from established rules, ensuring that trust is maintained through continuous verification rather than one-time identity checks. While verification confirms who operates a bot, this new mechanism addresses whether the bot acts responsibly over time, distinguishing between transient risk and long-term trust.

Measuring Respect for Site Preferences

The system generates an explainable trust band based on how consistently a bot honors website preferences. Initial signals include:

• Robots.txt compliance: Checking if traffic aligns with published crawl rules per RFC 9309.
• Response to feedback: Monitoring whether bots slow down or pause after receiving HTTP 429 ("Too Many Requests") signals.

Isolated violations are not penalized; instead, the system looks for repeated patterns of disregarding site preferences. A bot that consistently adapts to rate-limiting signals increases its trust score, while ignoring them lowers it.

Integration and Future Availability

This accountability loop works alongside Bot Preference Sync and Bot Management to help site owners manage automated traffic. Currently, Cloudflare is using the system internally to build historical data and refine assessment methods. The company plans to make the system available to all customers, allowing them to set specific trust thresholds for handling Verified bot traffic. Scores will eventually be shared publicly on Radar.