Quick Facts
- Cloudflare’s Precursor monitors mouse movement, scroll rhythm, typing cadence, and other behavioral signals across entire web sessions to detect bots.
- Automated traffic now accounts for 57.4% of requests to Cloudflare-hosted sites, surpassing human traffic 18 months ahead of CEO Matthew Prince’s own forecast.
- Precursor requires no code changes and is enabled with a single click, automatically injecting a lightweight script through Cloudflare’s network.
Cloudflare on July 13 announced the general availability of Precursor, a behavioral validation engine that tracks user sessions from start to finish to identify bot activity. The product moves bot detection away from one-time checks and toward continuous monitoring across the full lifecycle of a visit.
The launch comes as bot traffic has crossed a historic threshold. Cloudflare now reports that 57.4% of requests to its hosted sites come from automated sources. On June 3, CEO Matthew Prince wrote that bots had surpassed human traffic online for the first time in internet history, arriving roughly 18 months ahead of his own prediction.
Agentic AI traffic grew approximately 7,851% year over year, according to HUMAN Security’s 2026 State of AI Traffic report. OpenAI’s GPTBot alone grew 305% in a single year. Cloudflare data from May 2026 shows that 51.8% of AI crawler requests are for training purposes, with only 9.3% tied to search.
What Precursor Does
Traditional bot defenses evaluate a visitor at a single moment, usually at login or checkout. Sophisticated bots clear those checkpoints using residential proxies, headless browsers that execute JavaScript correctly, and TLS fingerprints that mimic legitimate browsers. The space between those checkpoints has been largely unmonitored.
Precursor fills that gap. The engine evaluates mouse movement, scrolling rhythm, typing cadence, clipboard activity, and page visibility duration throughout an entire session. Cloudflare’s servers receive telemetry from the browser in real time and cross-reference whether pointer activity aligns with page visibility and whether text fields are focused during typing events.
Dane Knecht, CTO of Cloudflare, described the approach: “Traditional security checks look at a single moment in time, but modern bots have gotten smart enough to fake their way through the front door. Instead of just checking an ID at the gate, we are looking at behavior over the entire visit. This makes life seamless for real users, while making it incredibly difficult and expensive for bad actors to fake human behavior.”
Knecht added that existing Cloudflare detection protected users at critical moments like login and checkout, but that “the space between those moments was a black box. With Precursor, we’re now eliminating that blindspot.”
Privacy and Deployment
Precursor logs aggregate behavioral patterns rather than recording specific user inputs. Keyboard activity is captured only as timing rhythm and cadence. Actual keystrokes are never recorded.
Setup requires no modifications to underlying application code. Cloudflare injects a compact, dynamic script automatically once the feature is switched on. The company serves 42% of the Fortune 500 as paying customers and blocks 234 billion cyber threats per day across 335-plus cities in 125-plus countries.
A Broader Push Against Bots
Precursor is one part of a wider Cloudflare initiative against automated traffic. On June 22, the company announced a joint effort with Mozilla Firefox, Google Chrome, and Microsoft Edge to develop a protocol called Private Access Control Tokens, or PACT. The protocol is designed to replace CAPTCHAs with anonymous tokens that verify whether a visitor is human or an authorized bot. Shopify co-developed the technology, and the group plans to submit it for formal standardization.
Chrome, Firefox, and Edge together hold roughly 77% of browser market share, according to StatCounter, which means PACT could reach the majority of internet users if adopted.
Prince said the current situation demands urgency. “Now that the majority of traffic on the Internet is non-human, we must go further and act faster so that a sustainable ecosystem can emerge.”
Read more: Cloudflare launches Precursor to catch bots by watching entire sessions