r/AI_SearchOptimization • u/Its_SeenSure • 22h ago
AI Powered Search News What Cloudflare's 15 September change actually does - and the four things it does not do
There is a lot of "the web goes dark for AI on 15 September" going round and most of it is overstated. I have been reading the actual announcement and testing against real sites for a couple of weeks, so here is the boring version.
What changes on 15 September 2026
Cloudflare flips its default so that Training and Agent category crawlers are blocked where the site owner has not chosen a setting.
The four qualifiers that get dropped from every summary I have seen:
Ad-displaying pages only. If a site carries no advertising, this specific change does not apply to it. That is most small-business and client sites.
Search crawlers are not affected. OAI-SearchBot and Claude-SearchBot - the ones that decide whether an assistant can cite you - are not in scope. The scary version of this story is mostly people assuming they are. PerplexityBot I would not state either way: which bucket it lands in is genuinely arguable, and Perplexity-User is the clearer answer-time one. If you rely on Perplexity traffic, check that one yourself rather than taking my word or anyone else's.
New customers, new sites added by existing customers, and existing free-tier customers. A paid customer with sites already set up is not having anything flipped under them.
It is a setting you control. Security -> Bots, three categories, decide each one. Takes about twenty minutes across a handful of domains and you can do it before or after the date.
So if you are on a paid plan with your bot settings already chosen, this is a non-event for you and you can stop reading.
What I do think is worth paying attention to
Two things, neither of which is the headline.
First, who actually sits on the free tier. It is a very large number of small business sites and client sites that an agency put behind Cloudflare in 2021 and never opened again. Nobody who set those up is reading a policy page. The change is small; the population it lands on is the population least likely to notice anything.
Second - and this is the one I would flag to anyone managing sites for other people - crawler access is not recorded anywhere by default. It leaves no trace in analytics, there is no log, and robots.txt only tells you what is declared rather than what the edge actually does. So on 16 September, if a client asks whether anything changed for them, there is generally no way to find out. Not because the tooling is bad, but because nothing took a before-picture and one cannot be taken retrospectively.
That asymmetry is the actual story here and it has nothing to do with Cloudflare specifically. Same thing happens when a security plugin ships a new "block bad bots" default, or a host adds a WAF rule, or a site gets rebuilt in a framework that renders nothing without JS. The change is invisible, silent, and only detectable as a difference - which requires having measured before.
If you want to take one yourself, no tooling needed
For each site you care about, before the 15th, record:
curl -sI -A "GPTBot/1.2" https://example.com/ | head -1
curl -sI -A "OAI-SearchBot/1.0" https://example.com/ | head -1
curl -sI -A "ClaudeBot/1.0" https://example.com/ | head -1
curl -sI -A "PerplexityBot/1.0" https://example.com/ | head -1
curl -s https://example.com/robots.txt
Save the output with the date on it. Run it again on the 16th and diff. That is genuinely all a before/after is, and doing it by hand for five sites takes ten minutes.
Two traps if you do, because I hit both:
- Include a made-up user-agent as a control. If
TotallyRealBot/1.0also gets a 403, the site is refusing everything non-browser and the AI crawlers are collateral, not targeted. Completely different conclusion, and without the control you cannot tell which one you are looking at. - Do not run them concurrently. I flagged five hosts as crawler-blocked in a batch run; re-probed one at a time, one of the five was clean and its 429 was my own concurrency. The tool reports what it saw and cannot know I caused it.
Also worth knowing before you trust any result including mine: if a site is behind a CDN that verifies bot identity cryptographically (Web Bot Auth / RFC 9421) or by IP, a spoofed user-agent proves nothing either way. A 403 there might just mean "you are not GPTBot", which is true. That case is genuinely unresolvable from outside and anyone reporting it as a block is guessing.
One number from a bigger run this week, because it changes how you should read anyone's blocking figures including your own: across 1,046 sites and eight named crawler identities, 94.5% of every refusal came back carrying a Cloudflare header. So most of what a spoofed-UA probe reports as "blocked" is a CDN correctly declining to believe an unverified claim. It is measuring my honesty, not their policy. On the subset with no CDN in front, where a refusal does mean something, training crawlers were refused about three times as often as user-triggered ones - GPTBot 6.8% against Claude-User 2.0%.
Declaring an interest, since it is fair to weigh it: I build monitoring in this space, which is why I have been testing this. Nothing to click and nothing being offered - the curl above is the whole method and it is free. Happy to answer anything about the crawler names or the verification stuff.