# Cloudflare starts scoring how its listed bots behave

Cloudflare says it rates Verified bots internally on robots.txt and HTTP 429s. It stopped our signed agent at 33 of 33 products where it met it.

Source: https://agentdrives.com/notes/2026-10-19-cloudflare-starts-scoring-how-verified-bots?via=md · Published 2026-10-19 · 140 products, driven 2026-10-01 to 2026-10-18

## What happened

Cloudflare described a system that scores how its Verified bots behave over time, in a blog post fetched 19 Oct 2026 (the post carries no date). Cloudflare says the system checks whether a bot follows robots.txt and slows down after an HTTP 429, and turns that into a trust band per bot. “We are already using this system internally to evaluate how consistently Verified bots honor website preferences.” ([source](https://blog.cloudflare.com/verified-bots-accountability/)) Cloudflare says it plans to offer the system to all its customers, who would pick the trust threshold, and to publish the scores on Radar ([the post](https://blog.cloudflare.com/verified-bots-accountability/)).

## What our drives saw

As of 18 October 2026, our agent met Cloudflare on its way in at 33 of 140 products we drove. Our agent signs every request with Web Bot Auth. Signed, not verified: during these drives no bot-check provider listed our agent as a verified bot, so a check could see the signature but had no verified identity to trust.

Of those products, Cloudflare stopped it at 33 of 33, and a visible challenge came up in 32 of 33 stops. The stops by provider are in [which bot checks stop AI agents](/research/which-bot-checks-stop-ai-agents), and every count is on [our facts page](/data/facts).

Since 1 July 2026 ([source](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/index.md)), Cloudflare folds signed agents into its Verified bots ([source](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/index.md)): the group the new score is for.

## What it means

For owners behind Cloudflare: our stops came from Cloudflare's bot checks meeting a signed agent it hadn't verified, not from this score. For signed agents, Cloudflare gives owners a rule field, cf.bot_management.signed_agent ([source](https://developers.cloudflare.com/bots/reference/bot-management-variables/index.md)).
For builders: the score is for Verified bots, and Cloudflare lists the route for a signed agent as Bot Submission Form, Verification Method: Request Signature ([source](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/index.md)). Cloudflare says that consistently slowing down or pausing after a 429 raises a bot's trust band and that ignoring it again and again lowers it. An agent that follows robots.txt and backs off on a 429 shows the behaviour Cloudflare describes as earning trust.

## What we don't know

The post gives no date for when customers get the threshold or when the scores appear on Radar. It doesn't say whether an agent acting for one person is scored on the same signals as other Verified bots, or what happens to a Verified bot below the threshold. What we have doesn't say whether the rule field matches a signed agent that Cloudflare hasn't verified. We haven't yet counted whether any product behind Cloudflare answered our agent with a 429, or had a robots.txt rule covering the page it was on, before it stopped it.

## What we'll do

This week we count, from the attempts our drives already recorded at the products behind Cloudflare, whether a 429 or a robots.txt rule came before each stop, and add the result to this note as a dated update. If Cloudflare offers the threshold to its customers, we write that up next to these counts. See [how we drive](/method) for what a stop means.