Cloudflare Adds Controls to Manage Personal Agent Traffic

Cloudflare has introduced new analytics and finer-grained access controls to help site owners see and manage personal agents that visit their sites. Personal agents bridge human requests and automated web interactions, enabling tasks such as product comparisons, support article searches, or purchases.

The company notes that such interactions appear as automated traffic to site owners, so visibility into which agents are visiting and what they are doing is essential to separate meaningful customer activity from risk. The update adds Personal Assistants as a distinct category in Security Analytics’ Bot Analysis chart, alongside Verified Bot, Likely Human, Likely Automated and Automated, enabling teams to filter to only personal agent traffic over time.

A new Top statistics widget lists visiting agents and their request counts, with the ability to drill down by a single agent to see paths, status codes and source networks.

Cloudflare also expands policy controls for personal agents. The AI Crawler and Agent access policies section has been renamed and broadened to “AI Crawler and Agent access policies” with per-agent options to Allow (do not block), Block on pages with ads, or Block. These controls can be set globally when configuring an overall Agents policy, and then customised for each supported personal agent. The onboarding flow for new zones asks whether pages are monetised with ads, enabling tailored recommendations.

The updates are designed so site owners can welcome certain agents on their own terms while preserving business context, with a view to applying appropriate protections through features such as a WAF rule tied to a Hashed User ID for flagged accounts.