Session-Long Bot Detection, Not Just Spot Checks
Bot mitigation has long been a game of cat and mouse fought at isolated checkpoints: a login form, a signup page, a checkout flow. At Cloudflare, network-level analysis of over 1 trillion daily requests provides broad reputational context, while Cloudflare Turnstile has evolved from a CAPTCHA replacement into a risk-based managed challenge that adapts friction dynamically. Turnstile now runs nearly 3 billion times per day on critical customer endpoints.
That leaves a visibility gap: everything a visitor does between those protected moments. Modern automation is increasingly good at appearing legitimate in short bursts—executing JavaScript, driving real browser environments, and passing individual challenges. What remains genuinely hard to fake is consistent human behavior over an entire session. Today Cloudflare is closing that gap with Precursor, a client-side, session-based verification system designed for Enterprise Bot Management customers.
Why Session Behavior Matters
When bot developers try to imitate human input, they typically add Gaussian noise or uniform random delays to scripted actions. But human movement is not merely noisy—it is physically constrained. A real mouse movement is an arc shaped by wrist pivot and forearm rotation. There is measurable cognitive delay between seeing a checkbox and clicking it. Even a steady hand exhibits physiological tremor. Bots, by contrast, tend toward linear interpolations or mathematically perfect Bézier curves, clicking with an inhuman precision.
Individually, such small tells might pass inspection. But aggregated over minutes of interaction, they diverge sharply from genuine human rhythms in ways that are expensive and unreliable to replicate at scale. By evaluating behavior across an entire session, Precursor adds significantly more signal to every bot-score decision. For legitimate users this translates to fewer unnecessary challenges; for bot operators, it raises the cost of automation from passing isolated checks to simulating a full, convincing session.
How Precursor Collects and Evaluates Signals
Precursor works in several layers.
Injection and Collection
Once enabled, Cloudflare automatically injects a compact, obfuscated JavaScript bundle into HTML responses as they pass through the network. No additional configuration or third-party embedding is required, and the script is designed not to interfere with existing page logic. The bundle attaches lightweight event listeners for pointer movement, keyboard activity, focus changes, and page visibility. Events are serialized into a compact format, buffered in memory, and sent at intervals to the evaluation layer.
Edge-Side Evaluation
On the edge server, incoming payloads are deserialized into behavioral inputs and passed through a roster of evaluators. Each evaluator reads its relevant streams and raises signals into a shared detection registry. The evaluators cross-reference data—for example, confirming that pointer activity correlates with page visibility duration, or that keyboard events fire only when a text field is focused. Those observations are consolidated into signals used to weight detections.
Session-Scoped Accumulation
Precursor data is scoped to the full session, meaning a bot cannot reset its behavioral signature by refreshing the page or restarting a challenge. Session metadata feeds into downstream detection layers for shadow-mode heuristics and session analysis—predicted versus actual completion, and session delinquency heuristics—to adjust the session's bot score.
Privacy By Design
The event listeners capture only the minimum information useful for automation detection. Keyboard activity is recorded as timing and rhythm, not as actual keystrokes. Behavioral signals are evaluated as aggregate patterns, never tied to user accounts, login identities, or persistent profiles, and are not exposed to customer dashboards.
Session-Based Analytics
To support the new detection layer, Cloudflare is introducing session-based views in Security Analytics, shifting perspective from individual requests to complete visitor journeys. That makes it possible to answer new questions about what a typical session looks like, where sessions diverge from expected behavior, and which sessions show signs of automation over time.
Because Precursor feeds directly into existing systems like bot score and challenge decisions, the added session context improves protection in place—including for customers already using Bot Management or Turnstile, extending those defenses across the rest of the session.
Availability and Rollout
Precursor is now rolling out and can be enabled directly from the Cloudflare dashboard. It will be free to use until general availability later this year. Administrators can choose a low-friction mode that observes behavior in the background, or require fully verified sessions by enforcing challenges when no session exists. Once enabled, Precursor begins enhancing existing bot defenses immediately, with no application changes required. As automation grows more sophisticated, the detection frontier is moving beyond isolated checkpoints and into the full flow of user activity.
