Article
How to check a Cloudflare AI-bot block actually works
By Brightiny9Published
A block you set in AI Crawl Control is a WAF rule, so check it in Security events and keep it above your other rules (Cloudflare docs, checked 2026-10-27).
When you block an AI crawler in Cloudflare's AI Crawl Control, Cloudflare creates a WAF custom rule. So the check is two steps: find that rule, then look for "Block" events from that bot in Security events. Cloudflare's docs give no single "test" button (checked 2026-10-27).
| Check | Where | What you want to see |
|---|---|---|
| The rule exists | Security > Security rules, rule named "AI Crawl Control" | The rule is there and sits at the top |
| It is first in order | Same list | No earlier rule allows or skips the bot |
| It fires | Security events, filter by action Block and the bot's user agent | Block entries with that user agent |
| The reply code is what you chose | AI Crawl Control, block response settings | 403 (you do not want access) or 402 (the crawler must pay) |
How does a block work in Cloudflare?
Cloudflare says it creates a WAF rule for you. In its words: "When you block a crawler in AI Crawl Control, the system creates or updates a WAF custom rule on your zone to enforce that block." (Manage AI crawlers, page updated 2026-07-28, checked 2026-10-27)
The same page lets you choose the reply code. 403 tells the crawler you do not want it to access your content. 402 tells it that it must pay.
Why might a blocked bot still get through?
Order matters. Cloudflare's WAF docs say: "Custom rules are evaluated in order, and some actions like Block will stop the evaluation of other rules." (Custom rules, updated 2026-10-16, checked 2026-10-27)
That cuts both ways. If an earlier rule of yours allows or skips a bot, the AI Crawl Control rule may never run for it. Cloudflare's guide for this case says to move the AI Crawl Control rule to the top of your WAF custom rules so it runs before the others (AI Crawl Control with WAF, updated 2026-08-03, checked 2026-10-27).
Two more points from that page:
- The rule is named "AI Crawl Control" and lives under Security > Security rules.
- Edits you make directly in the WAF rule are not shown back in the AI Crawl Control dashboard.
How do I see that the block fired?
Open Security events. Cloudflare's docs say you can filter by action with Filter or Exclude on the Events summary legend, and the Sampled logs show the action taken and the Cloudflare security feature that applied it (Security events, updated 2026-10-02, checked 2026-10-27). In Top events by source you can scope to a user agent the same way.
Keep the time window in mind. Cloudflare says all plans keep Security events data for up to 31 days, and the query window is at most 30 days on Free, Pro and Business (same page, checked 2026-10-27).
Check here, not in your own server logs. A block happens at Cloudflare's edge, so the request may never reach your origin. One third-party guide says the same (MaxAEO, checked 2026-10-27; not confirmed in Cloudflare's docs).
Can I test it myself with curl?
A common tip, seen in third-party guides such as MaxAEO (checked 2026-10-27), is to send a request with a bot's name as the user agent and look for a 403. For example: curl -I https://your-site.example/ -A "GPTBot". Run the same request with a normal browser user agent and compare the two. We have not run this, and Cloudflare's docs do not describe it.
Treat the result with care:
- A 403 is a good sign, but only the Security events entry tells you which rule produced it.
- A 200 does not prove the block is broken. Cloudflare's docs do not say whether a request that only claims a bot's name is matched the same way as the real bot. This is not confirmed.
- A real crawler may also come from a different path than your test, so check Security events again after the real bot visits.
What is not confirmed
| Claim | Source | Checked | What the official page says |
|---|---|---|---|
| curl with a bot user agent reproduces the real bot's result | Third-party tips in search results | 2026-10-27 | Not confirmed in Cloudflare's docs |
| AI Crawl Control has its own "test block" button | Manage AI crawlers | 2026-10-27 | The page has no verify step |
| Security events show AI Crawl Control blocks by name | Security events | 2026-10-27 | Shows the action and the security feature; AI Crawl Control is not named on that page |
A managed robots.txt only asks bots to stay out, while a WAF block enforces it. For that difference, see our earlier piece on managed robots.txt vs Block AI bots.
How we researched this
Researched from Cloudflare's public documentation on 2026-10-27. We did not set up a Cloudflare zone or run a block test. The pages were read through a summarising tool, so quotes were taken from its output and the page dates come from the same output.
Changelog
- 2026-10-27: First published.