Cloudflare Lets Sites Block AI Training While Keeping Search Visibility

Control over how their work is used, not just whether it's found
Website owners can now refuse AI training access while remaining visible in search results through Cloudflare's new setting.
Mark

So the core problem was that you couldn't block AI training without also blocking search engines?

Mimi

Exactly. Most crawlers do both jobs at once—they index for search and collect training data. You had no way to separate them.

Luke

But some crawlers already operate separately for search and training, right? So the problem wasn't universal.

Mimi

True. But the big ones—Google, Microsoft, Apple—bundled them together. That's where the real friction was.

Mark

And Cloudflare's solution lets you say no to AI training but yes to search?

Mimi

If the crawler respects the instruction. If it doesn't, Cloudflare blocks it entirely.

Luke

So it's not a technical solution. It's a trust-based one. It depends on crawlers actually honoring the setting.

Mimi

Right. Which is why the commitments from Apple, Google, and Microsoft matter so much. They're the ones most site owners care about.

Mark

How many site owners actually know this exists?

Mimi

That's the open question. Cloudflare has built the tool. Now adoption has to follow.

Luke

And if a crawler ignores the setting, what recourse does a site owner have?

Mimi

Cloudflare blocks that crawler entirely. But you're right—it only works if site owners know to use it and if crawlers actually comply.

  • Website owners have long been trapped in a binary: block AI training crawlers and disappear from search, or stay visible and surrender their content to machine learning pipelines without consent.
  • Cloudflare's new Disallow AI Training setting breaks that trap by distinguishing crawlers that respect opt-out instructions from those that don't — rewarding compliance and blocking defiance.
  • The stakes are amplified by a broader bot crisis: nearly nine in ten organizations now report struggling to manage automated traffic, making granular crawler control an urgent operational need.
  • Apple, Google, and Microsoft have committed to honoring the standard, giving the setting genuine force across a large share of the crawler ecosystem.
  • The framework is live, but its reach depends on adoption — site owners must discover and use it, and the industry conversation that began in July must continue to pull other operators into alignment.

For years, the web's creators faced a silent ultimatum: surrender their work to AI training systems or vanish from search results entirely. Cloudflare has now drawn a line between those two fates, offering site owners a way to refuse one without forfeiting the other. With Apple, Google, and Microsoft lending their weight to the framework, the move signals a broader industry acknowledgment that openness and consent need not be enemies — that the architecture of the internet can be made to honor both.

For years, website owners faced an impossible choice: allow AI training crawlers to harvest their content, or block them entirely and disappear from search results. The two functions — search indexing and AI data collection — often traveled together in the same crawler, bundled as a single package. Block one, and you blocked both.

Cloudflare has moved to dissolve that trap with a new setting called Disallow AI Training. The mechanism is precise: crawlers that honor a site owner's opt-out request are allowed through to the site; those that ignore it are blocked entirely. The distinction is made meaningful by the fact that Apple, Google, and Microsoft — collectively controlling a large share of the crawler ecosystem — have either aligned their behavior with the standard or publicly committed to do so.

Bryan Becker, who leads product work on security and trust at Cloudflare, noted that the company has been in conversation with crawler operators since July. The reception has been largely cooperative, with nearly every operator acknowledging that site owners deserve real control over how their content is used. Several companies already run separate crawlers for search and training, making the technical separation straightforward for those cases.

Co-founder and CEO Matthew Prince framed the move as an effort to preserve the internet's openness while restoring genuine agency to creators. The tension he named is real: search engines depend on open access to function, yet that same openness has become a pipeline for AI systems to absorb vast material without explicit permission. Cloudflare's solution tries to honor both imperatives at once.

The setting arrives amid a wider reckoning with automated web traffic. A recent PYMNTS Intelligence report found that nearly nine in ten organizations now struggle with bot management. As AI agents grow more sophisticated, distinguishing legitimate automated access from harmful scraping has become sharper and more consequential. Whether Cloudflare's framework becomes an industry standard or remains a niche tool will depend on how broadly site owners adopt it — and whether the industry pressure on remaining crawler operators continues to build.

For years, website owners faced an impossible choice: let AI training crawlers access their content, or block them entirely and disappear from search results. The two functions—indexing for search engines and harvesting material to train artificial intelligence systems—often traveled together in the same crawler, bundled as a package deal. Block one, and you blocked both. That binary trap is what Cloudflare set out to solve.

The company has rolled out a new setting called Disallow AI Training that lets site owners refuse access to AI training operations while remaining fully visible to search engines. The mechanism works by distinguishing between crawlers that respect the choice and those that don't. If a crawler honors the instruction to stay out of AI training, it gets through to the site. If it ignores the request, Cloudflare blocks it entirely. The distinction matters because some of the largest technology companies—Apple, Google, and Microsoft—have either already aligned their crawler behavior with this standard or committed to do so in the near term.

The problem Cloudflare identified was real and widespread. Many modern crawlers serve dual purposes: they feed search indexes while simultaneously collecting training data for machine learning models. A website owner who wanted to prevent their work from being used to train AI had no surgical option. They could only slam the door on the entire crawler, which meant their site would vanish from search results. That all-or-nothing dynamic left many site owners trapped between two undesirable outcomes, neither of which served their interests.

Cloudflare's approach sidesteps that trap by creating a middle ground. The company has been in conversation with crawler operators since July about the issue, according to Bryan Becker, who directs product work on security and trust solutions at Cloudflare. The response from the industry has been largely receptive. Nearly every operator Cloudflare spoke with acknowledged that site owners should have meaningful control over how their content gets used and that those choices should be respected and enforced.

The support from major players matters. Apple, Google, and Microsoft collectively control a significant portion of the crawler ecosystem. Their willingness to meet Cloudflare's criteria—or their public commitment to do so—gives the new setting real teeth. Several other companies already operate separate crawlers for search and training, which means Cloudflare can block their training crawlers without touching the search ones. That existing separation makes the technical problem easier to solve for those operators.

Matthew Prince, Cloudflare's co-founder and chief executive, framed the move as a way to preserve the internet's openness while giving creators and businesses genuine agency. The language reflects a broader tension in the current moment: search engines depend on open access to content to function, but that same openness has created a pathway for AI systems to absorb vast amounts of material without explicit permission or compensation. Cloudflare's solution tries to honor both needs—keeping search alive while letting creators opt out of AI training.

The timing connects to a wider industry reckoning with bot activity and automated access. A recent PYMNTS Intelligence report found that nearly nine in ten organizations now struggle with managing bot traffic on their platforms. As AI agents become more sophisticated and more prevalent, the challenge of distinguishing between legitimate automated access and harmful scraping has grown sharper. Weak or outdated controls allow malicious bots to operate while legitimate users get blocked by mistake. Cloudflare's new setting is one piece of that larger puzzle—a way to give site owners more granular control over who accesses their work and for what purpose.

What happens next depends partly on adoption. Site owners need to know the setting exists and understand how to use it. Crawler operators need to continue respecting the choices that site owners make. The industry conversation that began in July will likely continue, with other crawler operators potentially facing pressure to align their behavior with what Apple, Google, and Microsoft are doing. For now, the framework is in place. Whether it becomes the standard or remains a niche tool depends on how broadly it gets implemented and whether site owners actually use it.

Site owners should have control and transparency into how their content is used, and reassurance that their choices will be respected
— Bryan Becker, director of product, appsec integrity and trust solutions at Cloudflare
Preserving the openness that makes search valuable while giving the people and businesses behind the web meaningful control over how their work is used
— Matthew Prince, Cloudflare co-founder and CEO
Envie de l'histoire complète ? Lire l'original sur PYMNTS.com ↗
Nous contacter FAQ