# Cloudflare's new bot detector, Precursor, now watches your entire session!

Hey there, it's me, Shiichan! Today I found something fun in the world of bot protection, so let me walk you through it.

## What was announced?

On Cloudflare's Changelog, a session-based bot detection feature called "Precursor" was announced. It started rolling out to all customers on July 13, 2026. Precursor is client-side JavaScript that keeps watching a visitor's behavior for as long as they're on the page, and uses that to judge whether they're a bot.

You can turn it on straight from the Cloudflare dashboard, and it works alongside existing protections like Security Rules. The background and deeper technical details live in the [Precursor documentation](https://developers.cloudflare.com/cloudflare-challenges/precursor/) and the [announcement blog post](https://blog.cloudflare.com/introducing-precursor).

## The story so far

Cloudflare's flagship solution, Turnstile, only checks users at specific moments — logging in, signing up, checking out. That meant that once a bot got past one of those checkpoints, it could roam freely afterward while still looking human. There wasn't a way to keep watching behavior across an entire session.

## What changes

With Precursor, protection extends across the whole session instead of just checkpoints.

- Continuously evaluates behavioral signals across a session
- Re-validates challenge clearance as behavior changes
- Updates bot scores using session context
- Provides client-side visibility that wasn't there before

In short, it's harder for a bot to pass one challenge and then keep up the act afterward. Sites already using Bot Management or Turnstile can extend that protection across the entire session.

## Dive Deep

Precursor's design breaks down into roughly four layers.

- **Injection & collection layer**: lightweight JavaScript is automatically injected into HTML responses passing through Cloudflare's network. It buffers events like pointer movement, keyboard activity, and focus changes in memory in a compact serialized form, then sends them to the server periodically
- **Evaluation layer**: at the edge, the payload is deserialized and multiple evaluators cross-check it — for example, confirming that pointer activity correlates with how long the page has been visible, or that keyboard events line up with focus on a text field
- **Session aggregation**: data accumulates at the session scope, so a page refresh doesn't reset the evaluation
- **Privacy design**: keyboard activity is captured as timing and rhythm, not actual keys pressed. Signals are evaluated as aggregate patterns and aren't exposed on the customer dashboard

Human movement has quirks — wrist rotation is constrained to an arm's range of motion, there's a measurable delay between recognizing a checkbox and actually clicking it, and hand tremor adds tiny physiological jitter. Bots, by contrast, tend to move in straight lines or perfect Bezier curves and click with pixel-perfect precision, which is exactly the kind of pattern that gives them away.

The scale here is huge: Turnstile runs almost 3 billion times a day, and Cloudflare as a whole analyzes over 1 trillion requests a day. Precursor is free to use before it reaches general availability, and you can choose between a low-friction background-monitoring mode or a mode that enforces verified sessions.

## Wrap-up

- Precursor is a session-based bot detection feature that keeps watching for as long as a session lasts
- Turnstile used to check only specific moments like login or checkout; Precursor keeps evaluating behavior in between too
- It tells humans from bots using behavioral quirks like mouse movement and keyboard rhythm
- You can turn it on directly from the dashboard, and it's free before GA
- If you're already using Bot Management or Turnstile and have been annoyed by bots that "stick around" after passing a challenge, this one's for you!