# Cloudflare details internal trust evaluations for Verified bots > Cloudflare is assessing whether Verified bots respect robots.txt preferences and rate-limit feedback. Customer trust thresholds and public scores remain planned. Canonical URL: https://www.devobs.io/news/news-event-927a89a5096a57427a47b692/ By: Lena Fischer Published: 2026-10-16T14:35:51.734Z Updated: 2026-10-16T14:35:51.734Z Event date: 2026-10-16 Section: Security Cloudflare says it is already using an internal system to evaluate whether Verified bots continue to respect website preferences after their identities have been established. The initiative separates knowing who operates a bot from trusting its ongoing behavior, according to [Cloudflare’s announcement](https://blog.cloudflare.com/verified-bots-accountability/). ## What the system measures Cloudflare describes two initial signals: whether observed crawling follows published robots.txt preferences, and whether traffic adapts after HTTP 429 “Too Many Requests” responses. The company says it evaluates sustained patterns rather than treating isolated violations as decisive. Those observations are intended to produce an explainable “trust band”: a range describing how consistently a bot respects site preferences and which behaviors informed that assessment. Cloudflare describes the band as an assessment over time, not a permanent judgment about a bot or its operator. For rate-limit feedback, the distinction is whether a bot changes its behavior. Consistently slowing down or pausing after a 429 increases trust; repeatedly maintaining the same request pace lowers it under Cloudflare’s approach. Cloudflare also cautions against treating robots.txt as blanket permission. A crawler can remain within permitted paths while still placing substantial load on a site, and other signals can communicate that continued access is unwelcome. These signals and their interpretation are described in the [announcement](https://blog.cloudflare.com/verified-bots-accountability/). ## Availability: internal evaluation, planned customer controls Cloudflare says it is using the internal phase to build behavioral history and refine how observations become useful guidance. Customer access remains **planned**: the company intends to make the system available to all Cloudflare customers, with selectable trust thresholds used to decide how Verified bot traffic is handled. Publishing scores on Radar is also **planned**. The [announcement](https://blog.cloudflare.com/verified-bots-accountability/) does not specify a rollout date for customer access or public scores. These forthcoming capabilities are distinct from Bot Management and Bot Preference Sync, which Cloudflare says customers can already use. ## Engineering implications For site operators, the practical takeaway is to treat verified identity and acceptable traffic behavior as separate decisions. Verification alone should not be the reason for an unconditional exemption from traffic controls. For crawler developers, policy checks and rate-limit handling should influence actual request scheduling. Under Cloudflare’s described assessment, staying within paths permitted by robots.txt is not enough if the crawler repeatedly ignores requests to slow down. The engineering target is sustained responsiveness to site preferences—not merely successful identification. ## Source references -