Cloudflare Precursor: Continuous Client-Side Bot Detection

Cloudflare has launched Precursor, a client-side, session-based bot detection system that continuously collects behavioral signals as visitors interact with a web application. It's designed to close the visibility gap between isolated challenge points (like login or checkout) and the rest of the user journey.

Why this matters

Modern automation can execute JavaScript, use real browser environments, and pass individual CAPTCHAs without raising suspicion. What remains hard to fake is consistent human behavior over time. Precursor captures that layer of interaction, turning behavior itself into a signal for detecting fraud and abuse.

By evaluating behavior across an entire session, Precursor adds significantly more signal to each decision, improving detection precision and reducing unnecessary interruptions for legitimate users.

How it works

Precursor injects a lightweight, obfuscated JavaScript bundle into HTML responses as they pass through Cloudflare's network. The script attaches event listeners for pointer movement, keyboard activity, focus changes, and visibility. These events are serialized, buffered, and sent back to Cloudflare's edge for analysis.

On the edge, a dispatcher runs evaluators that cross-reference data—for example, confirming that pointer activity correlates with page visibility duration, or that keyboard events only fire when a text field is focused. The system is session-scoped, meaning a bot cannot reset its behavioral signature by refreshing the page.

Privacy by design

Keyboard activity is captured as timing and rhythm, not actual keystrokes. Behavioral signals are evaluated as aggregate patterns and consumed internally—they are not exposed to customer dashboards or tied to user accounts or persistent profiles.

Session analytics

Cloudflare is also introducing session-based views in Security Analytics, shifting perspective from individual requests to full visitor journeys. This allows operators to answer questions like: What does a typical session look like? Where do sessions diverge from expected behavior? Which sessions show signs of automation over time?

Availability

Precursor is rolling out now and is free to use until GA later this year. It can be enabled from the Cloudflare dashboard and works alongside existing Bot Management and Turnstile protections. No application changes are required.