CLOUDFLARE has unveiled a system to deepen accountability around its Verified Bot programme, aiming to ensure that bots “trust remains yes” over time rather than just relying on an operator’s identity. The core idea is to evaluate whether a bot is who it says it is, and whether it does what it is supposed to do without causing harm. The article sets out three criteria for a Cloudflare Verified Bot: identification that is accurate and secure, action that matches stated intent, and a ban on abusive behaviour.
Bots sign requests with Web Bot Auth and are catalogued by BotBase in an open format, after which risk and trust are assessed to expose how consistently a bot respects site preferences rather than making a blanket judgment based on identity alone.
A new framework measures and reports deviations from the trust standard, creating an explainable trust band that reflects ongoing behaviour. Initial signals include whether the bot follows site instructions and responds to direct feedback, with repeated non-compliance reducing trust. The system also monitors adherence to robots[.]txt and tolerance of site preferences, including responses to HTTP 429 signals when sites push back.
Cloudflare notes it has already used this approach in-house, de-listing Perplexity in 2025 for attempting to access opt-out resources and then sidestepping controls. Looking ahead, the company plans to publish trust scores on Radar and extend the framework to all customers, enabling operators to choose trust thresholds for handling Verified bot traffic, while continuing to build a transparent accountability loop with Bot Preference Sync and Bot Management.