Cloudflare's new bot detector, Precursor, now watches your entire session!

Hey there, it's me, Shiichan! Today I found something fun in the world of bot protection, so let me walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On Cloudflare's Changelog, a session-based bot detection feature called "Precursor" was announced. It started rolling out to all customers on July 13, 2026. Precursor is client-side JavaScript that keeps watching a visitor's behavior for as long as they're on the page, and uses that to judge whether they're a bot.

You can turn it on straight from the Cloudflare dashboard, and it works alongside existing protections like Security Rules. The background and deeper technical details live in the Precursor documentation and the announcement blog post.

The story so far

Cloudflare's flagship solution, Turnstile, only checks users at specific moments — logging in, signing up, checking out. That meant that once a bot got past one of those checkpoints, it could roam freely afterward while still looking human. There wasn't a way to keep watching behavior across an entire session.

What changes

With Precursor, protection extends across the whole session instead of just checkpoints.

• Continuously evaluates behavioral signals across a session
• Re-validates challenge clearance as behavior changes
• Updates bot scores using session context
• Provides client-side visibility that wasn't there before

In short, it's harder for a bot to pass one challenge and then keep up the act afterward. Sites already using Bot Management or Turnstile can extend that protection across the entire session.

Dive Deep

Precursor's design breaks down into roughly four layers.

• Injection & collection layer: lightweight JavaScript is automatically injected into HTML responses passing through Cloudflare's network. It buffers events like pointer movement, keyboard activity, and focus changes in memory in a compact serialized form, then sends them to the server periodically
• Evaluation layer: at the edge, the payload is deserialized and multiple evaluators cross-check it — for example, confirming that pointer activity correlates with how long the page has been visible, or that keyboard events line up with focus on a text field
• Session aggregation: data accumulates at the session scope, so a page refresh doesn't reset the evaluation
• Privacy design: keyboard activity is captured as timing and rhythm, not actual keys pressed. Signals are evaluated as aggregate patterns and aren't exposed on the customer dashboard

Human movement has quirks — wrist rotation is constrained to an arm's range of motion, there's a measurable delay between recognizing a checkbox and actually clicking it, and hand tremor adds tiny physiological jitter. Bots, by contrast, tend to move in straight lines or perfect Bezier curves and click with pixel-perfect precision, which is exactly the kind of pattern that gives them away.

The scale here is huge: Turnstile runs almost 3 billion times a day, and Cloudflare as a whole analyzes over 1 trillion requests a day. Precursor is free to use before it reaches general availability, and you can choose between a low-friction background-monitoring mode or a mode that enforces verified sessions.

Wrap-up

• Precursor is a session-based bot detection feature that keeps watching for as long as a session lasts
• Turnstile used to check only specific moments like login or checkout; Precursor keeps evaluating behavior in between too
• It tells humans from bots using behavioral quirks like mouse movement and keyboard rhythm
• You can turn it on directly from the dashboard, and it's free before GA
• If you're already using Bot Management or Turnstile and have been annoyed by bots that "stick around" after passing a challenge, this one's for you!