Cloudflare BotBase update adds submission tracking, editable entries and automated bot verification

A dedicated home for bot submissions

Cloudflare has introduced BotBase for Operators, a set of dashboard features aimed at the other side of the bot ecosystem: the companies and individuals who run crawlers and AI agents. According to the Cloudflare blog, the launch builds on BotBase, a directory of known bots searchable from the Cloudflare dashboard, and Business Insights, which helps site owners see how crawlers engage with their pages. Both were announced last month at Cloudflare's second Content Independence Day.

Until now, an operator's involvement largely ended at the submission form. After pressing submit there was no straightforward way to check status, learn why an entry was rejected, or update information already on file — questions that previously had to go through support email. Cloudflare says the new release targets that gap, starting with transparency.

The submission tools have also moved. The form used to sit under Manage Account → Configurations; it now lives at Protect & Connect → Application Security → BotBase and is open to all customers. The section is split by use case into three parts: a bots directory mirroring the catalogue on Cloudflare Radar, a form for submitting new bots, and a submission history view.

Status, rejection reasons and edits

The history tab lists every bot submitted from an account with one of three states: waiting for review, accepted, or rejected. Rejections come with an explanation and actionable steps for fixing and resubmitting, and accepted entries show any classification changes Cloudflare made. Records are visible from launch day onward, and a "My bots" filter in the directory isolates everything submitted under the logged-in account.

Operators can now edit an existing submission rather than filling in the whole form again — useful when a bot's IP list moves to a new endpoint, or when the operator switches to signing traffic with Web Bot Auth. Submissions still waiting for review can be cancelled. Cloudflare stresses that accurate details are central to how a bot earns and keeps Verified status, which increasingly shapes whether sites across its network can allow it easily, though the final decision on traffic always rests with the individual site owner.

A three-part intake form

The new form follows the behavior and content-use taxonomy Cloudflare introduced on July 1. Instead of forcing a bot into a single label, operators describe three things: what the bot does, how it uses what it reads, and who actually runs it.

Behaviors such as search indexing, acting on a user's behalf, collecting data, training models or supporting SEO tools can all be selected where they apply. Content use is declared under the Content Signals model that website owners already use to set their own rules — Cloudflare cites a robots.txt line reading Content-Signal: search=yes, ai-train=no, use=reference as the kind of preference a bot's declaration is checked against. The third axis distinguishes direct operators, running bots from their own infrastructure, from intermediaries: for example, a general-purpose AI assistant fetching a page because a different company's product, built on the assistant's API, decided to send the request.

Automated review replaces the manual queue

Reviews are being rebuilt as well. The number of new bots submitted each year has grown roughly sevenfold since 2023, and Cloudflare says a fully manual process, where a team member checks each entry against an internal rubric, does not scale at that pace.

Submissions now run through automated checks: whether the bot duplicates one already tracked, whether the user-agent pattern is specific enough to identify the bot without overlapping an existing registration, and whether the claimed verification method actually holds up — fetching the IP list, confirming reverse DNS, or validating a Web Bot Auth signature. Bots that pass can be tracked immediately, while anything needing closer inspection is routed to Cloudflare's team with the specific reason already flagged. The company expects most submissions to move faster as a result.

Why it matters

Automated traffic is diversifying quickly, from conventional search crawlers to AI agents acting on a user's behalf, and most site owners cannot track that ecosystem by hand. Cloudflare is positioning BotBase as shared plumbing for the problem: operators get a standard way to identify themselves and prove it, and site owners get structured, comparable declarations — behavior, content use, and operator type — on which to base allow and block decisions. Automated verification is what keeps that directory trustworthy as submission volume climbs.

There are caveats. The system depends on operators opting in and keeping entries current, and Cloudflare's Verified status is quietly becoming a gatekeeping signal across a large slice of the web. For anyone who runs a public site, or runs a bot that needs to reach one, this pipeline is now worth watching closely.