Cloudflare Launches BotBase for Operators to Streamline Bot Submissions and Verification

Cloudflare Launches BotBase for Operators to Streamline Bot Submissions and Verification Cloudflare has introduced BotBase for Operators, updating its bot submission system to give operators visibility into their submission statuses, tools to manage and edit entries, and a modernized intake and review process. Bot operators can now track submission statuses, view rejection reasons, edit existing entries, and cancel pending requests directly in the dashboard under Protect & Connect. A revised intake form categorizes bots across three dimensions: specific behaviors, content-usage level aligned with the Content Signals model, and operational role (direct vs. intermediary). To handle a sevenfold increase in bot submissions since 2023, Cloudflare introduced automated technical checks for duplicate entries, user-agent formatting, IP lists, reverse DNS, and Web Bot Auth signatures. Transparency and Lifecycle Management Previously, submitting a bot to Cloudflare required navigating account settings, with operators receiving no status updates or reasons for rejections. The new dashboard location under Application Security provides a Submission History tab detailing current review statuses, specific rejection causes, and any reclassifications made by Cloudflare. Operators can also update existing technical details—such as shifting from IP allowlists to Web Bot Auth—or cancel pending submissions without filing entirely new forms. Expanded Classification Model The updated intake form replaces singular bot labels with a granular framework based on three criteria. Operators must declare their bot's activities, such as search indexing, model training, or acting on a user's behalf. Second, they specify content usage utilizing the Content Signals model, allowing site owners to match policies against crawling practices. Finally, submissions distinguish whether an entity operates its infrastructure directly or functions as an intermediary carrying requests generated by third-party applications. Automated Review Infrastructure Faced with roughly seven times more bot submissions annually since 2023, Cloudflare rebuilt its evaluation process to move away from fully manual assessments. Automated systems now perform initial evaluations by verifying claimed authentication mechanisms, including IP listings, reverse DNS records, and Web Bot Auth signatures. Submissions that pass these technical criteria are tracked immediately, while flagged edge cases or ambiguities are forwarded with context to internal reviewers for manual evaluation.

Cloudflare推出BotBase for Operators：提升Bot提交透明度与审核效率 Cloudflare面向Bot运营者上线BotBase for Operators工具，旨在消除过去提交过程像“黑盒”的问题，提供清晰的状态追踪、资料更新机制以及自动化的快速审核流程。 在控制台中集中提供BotBase入口，并新增“提交历史”以追踪审核进度、驳回原因或分类修改。 支持直接编辑已有提交记录或取消待审核申请，无需重新填写完整表单。 采用新的三维度申报模型，分别明确Bot的具体行为、内容使用方式及运营主体类型。 将人工审核改造为自动化校验以应对自2023年以来激增约7倍的提交量，加快审核速度。 透明化提交追踪与条目更新 此前Bot运营者提交信息后无法得知后续进展，常需联系支持团队询问。现在，BotBase提交入口整合至安全工具板块，并在“提交历史”标签中显示每个Bot的实时状态。如果被拒绝，系统会展示具体原因；如果分类被调整，也会列出变更细节。此外，运营者可以随时修改已提交的资料（如更新IP端点或切换至Web Bot Auth验证）或取消待审申请，保持数据最新以协助获取或保留Verified状态。 细化Bot行为与内容使用分类 新的录入表单不再采用单一标签，而是要求运营者从三个方面进行申报：首先是Bot执行的操作（如搜索索引、代客操作、模型训练等，支持多选）；其次是对抓取内容的使用方式，该标准与网站所有者使用的Content Signals模型保持一致，用于匹配站点的权限偏好；最后是区分运营主体是直接运营基础设施，还是作为处理第三方请求的中间平台。 引入自动化校验以应对量级增长 自2023年以来，每年新提交的Bot数量增长了约7倍，原有的人工逐一审核模式难以维系扩展。Cloudflare将此流程重构为自动化校验，系统可自动查重、检验User-Agent专一性，并自动抓取IP列表、验证反向DNS或校验Web Bot Auth签名。核对无误的提交可直接被收录跟踪，若存在异常则会标注具体原因后转交人工团队复核，从而大幅缩短审核耗时。

Last month, on our second Content Independence Day, we announced [a couple of features](https://blog.cloudflare.com/content-independence-day-ai-options/) designed to give website owners more visibility and control over automated traffic: [BotBase](https://developers.cloudflare.com/bots/botbase/) added a searchable directory of known bots to the Cloudflare dashboard, while [Business Insights](https://blog.cloudflare.com/attribution-business-insights/) helped owners understand how crawlers interact with their content. We know that the ecosystem of bots is vast, making it all the more important for site owners to be able to manage bot traffic sustainably. But this ecosystem goes both ways. While website owners need to decide which automated traffic they allow, bot operators need a clear way to identify themselves, explain what their bots do, and keep that information current. BotBase works best when both sides can participate. When we launched BotBase, we said we would build tools to bring bot operators into this ecosystem. Until now, their experience largely ended at submission. After pressing submit, an operator had no easy way to check the submission's status, understand why it was rejected, or update an existing entry. Today, we start to change that with the launch of BotBase for Operators, tackling what bot operators need first: transparency. Imagine you’re a bot operator looking to submit your bot to [BotBase](https://radar.cloudflare.com/bots/directory). Where on the [dashboard](https://dash.cloudflare.com/) would you look for such a submission form? Previously, the form lived under **Manage Account → Configurations**, which tied the bot clearly to your account, but didn’t acknowledge its connection to the bots ecosystem. Starting today, the bot submission experience has a home next to the rest of your bot and trust tools: **Protect & Connect → Application Security → BotBase** *(new!)*. All customers can access this today directly from the [Cloudflare dashboard](https://dash.cloudflare.com/?to=/:account/application-security/botbase). Here, we’ve split BotBase for Operators by use case: Finding BotBase solves the "where" problem. The "what happens next" problem is the one that we’ve heard is deeply important to bot operators, so we’ll cover that in the rest of this post. We spoke to many bot operators, and the resounding feedback was this: *submitting a bot feels like a black box*. You fill in the form, press submit, and wait, with no way to tell whether anything happened next. Now, the **Submission history** tab shows every bot submitted from your account, each with a clear status: Open any submission to see its full details. If it was rejected, you will see the reason why. If it was accepted, but we adjusted how your bot is classified, you will see what we changed. Previously, operators would need to email support just to ask whether their bot got reviewed or to check on their submission's progress. That's exactly the gap we’re closing with this new tab. Today, the submission form is no longer a black box. Every operator can now view the record of every bot they've submitted starting from today’s launch, with a status you can check anytime. We also provide a way to filter “My bots,” from the Bots directory screen, so you can see all bots that have been submitted under the account with which you’re currently logged in. A bot's identification details can change over time. You might redesign your website and end up hosting your IP list at a new endpoint. Or you might move from an IP allowlist to signing your traffic with [Web Bot Auth](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/), and need your entry to match. Before today, the only way to reflect either change was to fill out the whole form again and submit a brand-new entry. Now, you can edit a submission you have already made. You can also cancel a submission that is still waiting for review. We encourage every operator to keep their bot's information current. Accurate details are a key component of how a bot earns and keeps [Verified](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/) status, which increasingly determines whether sites across Cloudflare's network can easily allow it based on its behavior. Of course, it is ultimately up to the individual site owner to decide what traffic is allowed and what is not. Picture a bot. Maybe it only crawls pages to build a search index. Maybe it also acts on a user's behalf, or pulls in data for something else entirely. How it uses what it reads matters just as much as what it does. The new intake form asks you to describe your bot the way it actually behaves. It follows the same [behavior and content use model we introduced on July 1](https://blog.cloudflare.com/content-independence-day-ai-options), so instead of squeezing your bot into a single label, you now tell us three things. First, what your bot does. Maybe it only does one thing, like indexing pages for search. Maybe it's an agent acting on a user's behalf, or it collects data, trains models, or supports SEO tools. You can select every behavior that applies, not just the closest match. Second, how it uses what it reads. A crawler that skims a page for a search snippet is not the same as one that stores that page to train a model. You tell us the level of content use your bot needs, using the same [Content Signals](https://contentsignals.org) model website owners already use to set their own rules. For example, a site's robots.txt might read Content-Signal: search=yes, ai-train=no, use=reference, telling every crawler it's fine to index the page for search and keep a reference, but not to train a model on it. Your bot's content-use declaration is what gets checked against exactly that kind of preference. Third, who's actually running it. If you operate your bot yourself, straight from your own infrastructure, like a search engine crawling the web to build its own index, that's direct. If you run a platform other companies build on, carrying their traffic without being the one who decided to send it, that's an intermediary. Picture a general-purpose AI assistant fetching a page because someone typed a question into a different company's app built on that assistant's API: the assistant operator runs the infrastructure, but it was someone else's product that decided to send the request. (You can read more about these classifications [here](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/#classification).) That's the full picture: what your bot does, how it treats what it reads, and who's behind it, described as it actually is instead of squeezed into one label. The clearer that picture, the more accurately website owners can decide how to treat your bot. Operators also asked for faster reviews. We hear you on this, too. The number of new bots submitted each year has grown sharply — increasing about 7 times in volume since 2023 — and reviewing every one of them by hand doesn't scale at that pace. Until now, every submission followed the same fully manual path: someone on our team checks it against an internal rubric and makes a judgment call. That kind of review is thorough, but it doesn't scale. We rebuilt that process to run automatically. Your bot runs through a series of checks — is it a duplicate of one we already track, is your user-agent pattern specific enough to identify your bot without overlapping one that's already registered, and, most importantly, does your claimed verification method actually hold up? We fetch your IP list, confirm your reverse DNS, or validate your [Web Bot Auth](https://developers.cloudflare.com/bots/reference/bot-verification/web-bot-auth/) signature automatically, instead of a person doing it by hand. If everything checks out, your bot can be tracked right away. If something needs a closer look, it's routed to our team with the specific reason already flagged, instead of landing as a blank entry in a queue. For operators, that means most submissions move faster than before. To join hundreds of bots in BotBase who declare their behavior and content use, and be part of an ecosystem where website owners and bot operators can coexist: This launch is about visibility; there's more coming. Here are our guiding goals: Our vision is to keep expanding BotBase so operators can understand exactly how their bot is treated and get guidance on how to crawl the web more politely, turning a one-way submission into an ongoing relationship. BotBase started as a directory for website owners. It is becoming a place where bot operators take part in the ecosystem, understand where they stand, and keep their information accurate. If you run a bot, [submit it and tell us what you need next](https://dash.cloudflare.com/?to=/:account/application-security/botbase/directory). We are building the operator side alongside the operators who use it.