Cloudflare gives bot operators a workspace in BotBase
Cloudflare now gives bot operators their own BotBase workspace. You can submit a crawler or agent, follow the review, and edit the record later. It launched on August 28, 2026.
Find it in the dashboard under Protect & Connect → Application Security → BotBase. Every Cloudflare customer has access.
What changed for operators
Submissions used to disappear into a black box. Now you see the decision and the reason behind it.
The workspace has three parts:
- Bots directory — browse, search, and filter bots Cloudflare already tracks.
- Submission form — register a new bot.
- Submission history — follow bots sent from your account.
Each entry reads Waiting for review, Accepted, or Rejected. A rejection lists the reason and the fix. An acceptance shows any classification Cloudflare changed.
One limit matters: history only holds records created after launch day. Older submissions will not appear.
You can now edit a bot when its identity changes, such as after moving an IP list or adopting Web Bot Auth. You can also cancel a pending submission.
The form asks for three things
Cloudflare dropped the single-label approach. The form describes a bot in three dimensions:
| Field | What you declare |
|---|---|
| Behavior | Search indexing, acting for a user, data collection, model training, SEO tooling |
| Content use | Search, AI training, or reference — matching the Content Signals model |
| Operator relationship | Direct operator, or intermediary supplying infrastructure |
Prepare these answers before you open the form. Your public docs, your user-agent string, and your identity method must describe the same bot.
Verification is now partly automatic
New bot submissions grew about sevenfold since 2023. Cloudflare added automated checks to shrink the manual queue.
Those checks look for:
- a duplicate of a bot already listed;
- a user-agent pattern precise enough not to match another bot;
- proof that your declared verification method works.
Cloudflare may fetch your IP list, confirm reverse DNS, or validate a Web Bot Auth signature. Clean identity data now speeds you up, and stale data fails faster.
Checklist before you submit
- Pick a user-agent pattern that matches nothing else.
- Publish and test your identity method first.
- List every behavior, including work done for third parties.
- Map content use honestly.
- Say whether you are a direct operator or an intermediary.
- Submit from the account that should keep the record.
- Fix a rejection instead of filing a duplicate.
- Update the entry when endpoints or behavior change.
Acceptance does not force any website to let you in. Site owners still decide. Verified identity only makes their decision easier.
What is still missing
This release covers submission visibility and editing. Cloudflare says ownership claims, control of the live directory entry, and insight into how sites treat your bot come later. Direct operator-to-site messaging is a longer-term goal.
So treat your submitted record as a record, not as control of the public entry.