Michael JohnsonOn October 16, 2026, Cloudflare introduced a continuous rating system for Verified Bots. It takes into account whether observed traffic complies with robots.txt rules and whether bots reduce their request rate after an HTTP 429 response. The company describes this approach as a behavioral check that complements bot identity verification.
In its announcement, Cloudflare says repeated failures to respect a site's preferences can lower a bot's trust level, while consistent compliance can raise it. The system considers isolated violations in context: Cloudflare says it evaluates sustained behavioral patterns, not individual incidents.
How site rules are taken into account
The robots.txt file is one signal of a site owner's preferences: the system compares observed bot traffic against it. HTTP 429 (“Too Many Requests”) tells a client to reduce its request rate; Cloudflare considers whether a bot slows down, pauses requests, or continues at the same rate.
A practical step for site operators is to keep robots.txt up to date, set appropriate rate limits, and check logs for client behavior after HTTP 429 responses. These measures help control traffic regardless of whether the site uses Cloudflare tools.
What is available now
Cloudflare says it is already using the system internally to assess whether Verified Bots respect site preferences. The next step is to make it available to customers, who will then be able to choose a trust threshold used to decide how Verified Bot traffic is handled. The company also plans to publish ratings in Cloudflare Radar and expand the set of signals it considers.
Thus, the announcement describes a new layer of control, not a setting already available to all customers. For site operators, the important change is the evaluation principle: verified bot identity is supplemented by observing how a bot follows published rules and responds to request limits.