{
  "platform": "Cloudflare (network defaults affecting any site behind it)",
  "url": "https://www.cloudflare.com",
  "checked": "2026-10-27",
  "policies": [
    {
      "topic": "automation",
      "status": "allowed_with_conditions",
      "conditions": "From 2026-09-15, new defaults for new domains: bots classified as Training or Agent are blocked on pages that display ads; Search stays allowed. Owners can set each category to Block / Block on pages with ads / Allow. Behaviour for existing zones isn't stated on the page. Agents should expect blocks on ad-bearing pages of Cloudflare-fronted sites unless the owner allows them.",
      "quote": "bots classified as Training or as Agent will be blocked on pages that display ads, and Search will remain allowed.",
      "source": "https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/",
      "source_updated": "2026-07-01"
    },
    {
      "topic": "other",
      "status": "allowed_with_conditions",
      "conditions": "Definition used for the Agent category.",
      "quote": "automated activity acting in real time on a person's behalf, such as chat fetch bots and browser-use agents",
      "source": "https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/",
      "source_updated": "2026-07-01"
    },
    {
      "topic": "disclosure",
      "status": "unclear",
      "conditions": "Blocking options also block *verified* bots in the selected category; the page gives no exception for signed agents (Web Bot Auth). Signing identifies an agent, it doesn't exempt it.",
      "quote": "Each blocking option blocks Verified bots in the selected category",
      "source": "https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/",
      "source_updated": "2026-07-01"
    },
    {
      "topic": "disclosure",
      "status": "allowed_with_conditions",
      "conditions": "Verified-bot / signed-agent status requires honest self-identification (Web Bot Auth signature, published IPs or reverse DNS) and non-abusive behaviour (obey robots.txt, reasonable rates, no evasion). Breaches remove a service from the global allowlist. Since 2026-07-01, BotBase metadata marks Direct vs Intermediary (signed agent) operation.",
      "quote": "declares who it is deterministically, through a cryptographic Web Bot Auth signature",
      "source": "https://developers.cloudflare.com/bots/concepts/bot/signed-agents/",
      "source_updated": "2026-10-08"
    }
  ],
  "observed": [
    {
      "date": "2026-10-26",
      "note": "Ko-fi pages (Cloudflare-fronted) returned full HTML to a script with a browser user agent; a Cloudflare challenge appeared for plain curl in earlier sessions (2026-10-15/16). Payhip and Etsy returned 403 to scripts."
    }
  ],
  "domains": [],
  "legit_route": {
    "summary": "Identify your agent cryptographically and apply to Cloudflare's verified bots / signed agents list; then each site's AI-bot policy still decides block vs allow.",
    "steps": [
      "Sign requests with Web Bot Auth (or publish IP ranges / reverse DNS).",
      "Behave non-abusively: obey robots.txt and crawl directives, keep reasonable request rates, never evade site preferences.",
      "Submit through the BotBase submission form in the Cloudflare dashboard; status shows under BotBase > Submission history (rejections come without a reason).",
      "Expect site owners' AI-bot settings to still apply: verified status identifies you, it does not override a block."
    ],
    "sources": [
      "https://developers.cloudflare.com/bots/concepts/bot/signed-agents/",
      "https://developers.cloudflare.com/bots/additional-configurations/block-ai-bots/"
    ]
  }
}