The AgentDrives Lab.
Controlled tests of how websites treat AI agents, one question each. A new test every week.
Does a signed agent get past a Cloudflare challenge rule?
24 Oct 2026. Our signed agent got through 2 of 3 challenge rules on our own site. Unsigned, it got through none.
How we tested
- On agentdrives.com (Free plan), 24 Oct 2026, 19:26–19:28 UTC: 3 challenge rules, each on its own page.
- 4 kinds of visitor, each sent once to each rule, and one control: 13 requests in all.
- Bot Fight Mode and the AI bot policies were off, so only these rules acted.
| Rule | Challenged when | Our agent, signed | Unsigned, our user agent | Unsigned, a Chrome user agent | Cloudflare Browser Rendering |
|---|---|---|---|---|---|
| Challenge everyone | Every request | Challenged | Challenged | Challenged | Challenged |
| Challenge all but known bots and agents | not cf.client.bot | Through | Challenged | Challenged | Through |
| Challenge all but AI assistants | cf.verified_bot_category ne "AI Assistant" | Through | Challenged | Challenged | Through |
What we found
- “Challenge everyone” challenged our signed agent like every other visitor. Being known to Cloudflare doesn't open a rule with no exception in it.
- “Challenge all but known bots and agents” and “Challenge all but AI assistants” let it through. Each has the exception written into the rule.
- An unsigned request from the same IPv4 address as our signed ones was challenged at “Challenge all but known bots and agents”. The signature got our agent through, not its address or its user agent.
- Cloudflare logged every signed request as “AI Assistant”, the challenged one too.
- An exception lets in every agent of its kind: Cloudflare Browser Rendering met the same answer as our agent at every rule.
- Wrike's sign-up answered like the first rule on 24 Oct 2026: the same challenge, signed and unsigned.
For site owners
- A challenge rule stops signed agents too. To let them in, write the exception into the rule.
- To let in every bot and agent Cloudflare knows, add
and not cf.client.botto the rule. developers.cloudflare.com - To let in only the agents a person drives, add
and cf.verified_bot_category ne "AI Assistant". Cloudflare docs - A custom rule can't skip Bot Fight Mode. Cloudflare docs
- Super Bot Fight Mode lets verified bots in when they're set to Allow. Cloudflare docs
- An AI bot policy blocks the verified bots of the kind you pick: Search, Agent or Training. Cloudflare docs
For agent builders
- Sign every request with Web Bot Auth and register the agent with Cloudflare. Rules with an exception for known agents then let it in. Cloudflare docs
- A rule with no exception challenges a signed agent like anyone else. Hand that step to a person, or stop there.
- Each site sets its own rules, so check the pages your agent needs, signed and unsigned.
Limits
- Each visitor sent one request per rule, from one server.
- No visitor tried to solve a challenge.
- Bot Fight Mode, Super Bot Fight Mode and the AI bot policies were not tested.
See what an agent meets on your sign-up page.
Free: the check in front of your sign-up page, and how many things to fix.