# Cloudflare launches Precursor for session-level bot signals > Precursor injects a first-party script to evaluate behavior across a web session, complementing Turnstile’s checks at sensitive moments. Canonical URL: https://www.devobs.io/news/news-cloudflare-precursor-session-bot-signals/ By: Arjun Shah Published: 2026-09-06T11:58:54.640Z Updated: 2026-09-06T11:58:54.640Z Event date: 2026-07-13 Section: Security Cloudflare launched Precursor on July 13 as a client-side, session-based signal system for bot detection. The [announcement](https://blog.cloudflare.com/introducing-precursor/) says Cloudflare dynamically injects a lightweight script into proxied HTML responses, then uses interaction patterns across a visit to supplement its network and Turnstile signals. ## The unit of observation becomes a session A single challenge captures a moment. Precursor instead builds a session-level view from behavioral signals such as the timing and shape of interactions. Cloudflare argues that modern automation can execute JavaScript and appear plausible briefly, while sustained behavior can reveal repeated or mechanically consistent patterns. The feature is an optional complement within Enterprise Bot Management. At launch it was rolling out and free until a planned general-availability release later in 2026. Customers could observe sessions with lower friction or require stronger verification when a session was not already established. Those availability details matter: the post announces an active rollout, not completed GA. ## Behavioral data needs a clear operating policy Before enabling collection broadly, teams should identify which pages need session-level analysis, document retention and access, and confirm how privacy notices apply. They should measure detection outcomes for keyboard-only users, assistive technology, mobile input, and automated clients that are legitimate. A bot score should feed a proportionate action. Observation, rate limiting, step-up verification, and blocking have different costs when a signal is wrong. Operators need an appeal or recovery path for important users and should correlate session decisions with application fraud outcomes rather than count challenges alone. Precursor adds continuity between isolated checkpoints, which can help distinguish automation that behaves convincingly for one request. Its usefulness depends on validation against each site’s real users and on restraint in how probabilistic behavior signals are enforced. ## Source references -