Personal agents control: Cloudflare adds visibility and per-agent rules

According to the Cloudflare Blog, Cloudflare is launching new analytics and more granular access policies so site owners can see which personal agents visit their sites and control those agents individually. The update adds a Personal Assistants category in Security Analytics and a Personal Assistants widget that lists which agents are sending requests, along with per-agent policy choices in Security Settings.

personal agents control: what changed and where to look

Cloudflare added a new category for personal agents inside Security Analytics. The Bot Analysis chart now shows "Personal Assistants" alongside Verified Bot, Likely Human, Likely Automated, and Automated, so you can view agent traffic over time. In Top statistics, a Personal Assistants widget lists which agents are visiting your site and how many requests each one makes. Filtering on one agent updates the rest of the analytics to show the paths it requests, status codes it receives, and originating networks.

For teams using Account Abuse Protection, Cloudflare reports that site owners can now see which user an agent represents. A population overview shows which personal agents are active across users and how many accounts use each agent. Login and sign-up events will indicate whether a personal agent made the request, and fraud teams can filter accounts by AI assistant events or by how many assistants are associated with an account.

At the account level, each user's overview shows agents acting for that account. That lets a fraud analyst tell whether an agent used in a suspicious login is one the customer has relied on for weeks or whether it appeared for the first time. If an agent appears tied to an attacker, teams can mitigate that account directly using a WAF rule on its Hashed User ID, rather than blocking the agent for every user who relies on it.

policy options and where to set them

Cloudflare expanded its existing agent controls and renamed the setting to AI Crawler and Agent access policies. You can set an overall Agents policy and then choose a different policy for each supported personal agent. The per-agent options are to allow the agent, to block it on pages with ads, or to block it entirely. For example, you could set the default to block agents on ad pages but allow one supported agent you want to welcome across your site.

When you add a new zone, Cloudflare will ask whether you monetize pages with ads and recommend policies based on your answer, and you can always change those choices later in Security Settings. Cloudflare says existing Search and Training policies remain unchanged.

practical steps for site owners

• Check Security Analytics, then open the Bot Analysis chart and select the "Personal Assistants" category to see agent traffic trends.
• Use the Personal Assistants widget in Top statistics to identify which agents visit, how many requests they send, and which paths they request.
• If you have Account Abuse Protection early access, review the population overview and per-account agent listings to link agents to user activity.
• Set your Agents policy in Security Settings → AI Crawler and Agent access policies, choosing per-agent options that fit your business, for example allowing helpful agents and blocking others on ad pages.
• When you see a suspicious login tied to an agent, consider mitigating just that account with a WAF rule on its Hashed User ID instead of blocking the agent globally.
• Revisit your settings after onboarding recommendations or traffic changes, since Cloudflare tailors suggestions during zone setup based on whether you run ads.

what Cloudflare says comes next

Cloudflare frames this work as a first step toward preserving user context when personal agents act as intermediaries. They say the next goals are to find privacy-aware ways to carry user context through an agent, help sites assess agent reputation, and establish accountability when something goes wrong. Cloudflare also says it will continue working with agent operators and others in the ecosystem and share updates so site owners can decide how much access to grant.

Make the choice for your site by reviewing how personal agents are accessing it, then visit Security Settings → AI Crawler and Agent access policies to set terms that fit your business. If you need hands-on help tuning policies for WordPress or Formidable Forms, Running WordPress or Formidable Forms? Get help from a Formidable Masterminds developer.

For the full technical details and screenshots, see the Cloudflare Blog post linked above.