Something Inc.Schedule a free consultation
TECHNICAL SEO

Block AI crawlers the right way before Cloudflare's deadline

The Financial Times, Condé Nast, and The Atlantic have all confirmed they're opting into Cloudflare's crawler block. September 15 stopped being a policy announcement and became a real deadline. Here's the audit to run before it hits.

TTTyler TruffiManaging Partner · AUG 9, 2026 · 10 MIN READ
SEP 15, 2026
date Cloudflare's crawler block flips from default-off to default-on for opted-in sites
5 WEEKS
runway remaining from today, Aug 9, to the deadline
3
named publishers confirmed opting in: Financial Times, Condé Nast, The Atlantic
KEY TAKEAWAYThis was theoretical two weeks ago. It isn't anymore. Adweek confirmed on August 5 that major publishers are actually opting into Cloudflare's crawler block, and the policy doesn't cleanly separate a bot that indexes you for search from a bot that trains a model on you. If you haven't run a machine access audit on your own crawler and CDN settings, you have five weeks before that ambiguity becomes your problem instead of a publisher's.

Adweek reported on August 5 that publishers are pulling back from Google's AI search while creators push further in. Buried in that story is the detail that actually matters for every enterprise site, not just media companies: Cloudflare's crawler-blocking software, already running at the Financial Times, Condé Nast, and The Atlantic, starts blocking crawlers used for both search indexing and AI training on September 15. Not crawlers used for one or the other. Crawlers used for both, at the same time, with no clean way to keep one function and drop the other. If you want to block AI crawlers without also blocking the search bots your rankings depend on, the work starts now, not on September 15.

Why the deadline to block AI crawlers just got real

We've covered pieces of this story before it had a face. Our July 24 piece on Cloudflare's pay-per-citation shift tracked the economics: AI training crawls were already 50.6% of Cloudflare's network traffic against 10.7% for legitimate search bots. Our August 4 piece on the default-block mechanism walked through exactly how the September 15 flip works: sites that block Training-category crawlers get Googlebot blocked as a side effect too, because Google runs one crawler for both search indexing and Gemini training, and Cloudflare applies the most restrictive rule to any bot that serves more than one purpose.

Both of those pieces described a policy. This is the week it stopped being one. Adweek's report names three publishers who have moved from "eligible for this default" to "actually running it": the Financial Times, Condé Nast, and The Atlantic. That's not a hypothetical CDN setting anymore. It's a live production decision at three organizations with enough legal and technical resources to weigh the tradeoff carefully, and they weighed it in favor of blocking. Adweek frames the story as a crack forming between Google's search crawler and major publishers, because Cloudflare's policy won't let a publisher say "index me, don't train on me" for any crawler that does both. You either accept both or block both.

Here's why that matters if you're not a publisher. The FT, Condé Nast, and The Atlantic have technical teams whose entire job is protecting content value and search visibility at once. If they're opting in anyway, it tells you the tradeoff has already cleared a real risk bar for organizations that can't afford to get it wrong. Most enterprise marketing and IT teams do not have a standing crawler review process. September 15 is five weeks out from today. That's enough time to run a proper machine access audit if you start now, and not enough time if you wait for a traffic drop to tell you something changed.

The deadline didn't change. What changed is who's actually pulling the trigger on it.

Search-indexing, AI-training, and hybrid crawlers, explained

The reason this deadline is confusing is that most robots.txt files and CDN rule sets were written for a world with two categories of bot: the ones you want (search) and the ones you don't (spam, scrapers). AI crawlers broke that binary into three categories, and the third one is where nearly every accidental block or accidental miss happens. Before you touch a single rule, get clear on which bucket each crawler hitting your site actually belongs in.

CRAWLER TYPEEXAMPLE USER AGENTSWHAT IT DOESDEFAULT RULE MOST TEAMS SHOULD SET
Search-indexingGooglebot (search function), BingbotCrawls to build a search index that can send you ranked, referral-generating trafficAllow
AI-trainingGPTBot, CCBot, Google-Extended, BytespiderCrawls to feed a model's training set, with near-zero referral traffic backBlock or meter, per your policy
Hybrid / multi-purposeGooglebot (AI grounding), ClaudeBot, PerplexityBotSame crawler serves both search-adjacent citation and model access, no separate user agent to isolate the twoDecide deliberately, don't default

That table is a practical reference for how to think about the split, not a data claim, but the category boundaries are the real ones Cloudflare's policy is built around. The first row is easy: nobody serious argues for blocking the crawler that puts you in front of buyers. The second row is where most of the actual dollar savings sit, since training crawlers historically return next to nothing in referral traffic for the crawl budget they consume. It's the third row that decides whether September 15 costs you anything. ClaudeBot and PerplexityBot increasingly function as retrieval crawlers for live citations, not just training scrapers, which means blocking them the way you'd block a pure-training bot can cut you out of an AI Overview or a Perplexity answer, not just a training set. Our piece on the difference between blocking AI crawlers by accident found 30% of sites had already locked out GPTBot through stale rules nobody had reviewed in years. Hybrid crawlers turn that same carelessness into a search-visibility problem, not just a training-exposure one.

THE VERDICTBlock AI-training crawlers by default if you're not enrolled in a compensation model like Cloudflare's Pay Per Crawl. Allow search-indexing crawlers, full stop. For hybrid crawlers, don't default at all — decide per crawler, based on whether it's currently sending you cited traffic or referral value worth protecting. A blanket rule in either direction is the mistake, not blocking or not blocking specifically.

Five plays to block AI crawlers before September 15

This is the same sequence we run for clients doing a technical SEO audit under a hard deadline. Five plays, run in order, each with a clear stopping point so you know when you're actually done instead of just tired of looking at logs.

1THIS WEEKPull your real crawl logs, not your robots.txt assumptions
THE MOVES
Export server or CDN logs for the last 30 days and filter to bot user agents
Rank crawlers by request volume so you're prioritizing the ones that actually matter, not the obscure ones
Cross-check against your CDN's own bot classification (Cloudflare, Fastly, Akamai all expose this) instead of trusting a hand-maintained user-agent list
DONE WHENYou have a ranked list of every crawler that touched your site in the last 30 days, sourced from logs, not memory.
2THIS WEEKClassify each crawler as search-indexing, AI-training, or hybrid
THE MOVES
Map every crawler on your list to one of the three categories in the table above
For anything ambiguous, check the crawler operator's own published documentation for what the bot is currently used for, since these definitions shift as companies expand a bot's purpose
Flag hybrid crawlers separately; they're the ones that need a deliberate decision, not a default
DONE WHENEvery crawler on your list has a category assigned, with hybrid crawlers flagged for individual review.
3WEEK 2Set your policy per category, not one blanket switch
THE MOVES
Decide search-indexing: allow, no exceptions
Decide AI-training: block by default, unless you're already in a paid-access arrangement worth keeping
Decide each hybrid crawler individually, weighing current citation or referral value against training exposure, using your own [GEO visibility numbers](/services/generative-engine-optimization) as the input, not a guess
DONE WHENYou have a written policy, one line per crawler category, that someone outside the technical team could read and understand.
4WEEK 3Implement via robots.txt and CDN rules together
THE MOVES
Update robots.txt with explicit Allow/Disallow lines per crawler, not a single catch-all block
Mirror the same policy at the CDN or WAF layer, since a robots.txt rule is a request, not an enforcement mechanism, and a determined crawler can ignore it
If you're on Cloudflare specifically, check your ad-monetization and Training/Agent/Search bucket settings directly rather than assuming robots.txt alone covers you
DONE WHENRobots.txt and CDN-level rules agree with each other and match the written policy from play 3.
5WEEK 4, THEN ONGOING PAST SEP 15Verify before the flip, then monitor after it
THE MOVES
Fetch your key pages as each major crawler's user agent to confirm the rule behaves as intended before September 15 arrives
Re-pull crawl logs the week of September 15 and compare against your pre-deadline baseline for any unexpected drop in search-indexing crawler activity
Put crawler-policy review on the same recurring calendar as your content and backlink reviews, since this list changes every few months, not once a year
DONE WHENYou've confirmed the rule works pre-deadline, confirmed nothing broke post-deadline, and crawler policy is now a standing item, not a one-time fire drill.

What happens if you do nothing

Nothing happens to sites that were never going to touch their crawler defaults anyway. Everything happens to sites that get swept into a policy flip they never reviewed. That's the pattern in every version of this story we've covered this year: not a deliberate decision going wrong, but a default nobody looked at doing the deciding instead. We found the same failure mode in JavaScript-rendering blind spots, where sites looked fine to a human and returned an empty shell to a non-hydrating crawler, and nobody noticed until a citation number dropped and someone finally went looking for why.

The specific risk here is narrower but sharper. If your site sits behind Cloudflare or a comparable CDN and someone, at any point, enabled a blanket "block AI crawlers" toggle to stop training scrapers, that toggle may already be catching hybrid crawlers you'd actually want reaching you, the ones increasingly responsible for live citations in ChatGPT, Perplexity, and AI Overviews, not just training sets. September 15 raises the stakes on that existing exposure because it's the date the industry's most cautious, best-resourced publishers confirmed they're comfortable accepting the tradeoff. Their calculus, protect content value even at some search-visibility cost, is not automatically your calculus. Most enterprise sites make more money from being findable than they lose from being trained on. That argues for the opposite default: allow search and cited-retrieval traffic, block pure training, and stop treating block AI crawlers as one undifferentiated switch.

Adweek's report on the September 15 deadline is worth reading in full if you want the publisher-side context on why FT, Condé Nast, and The Atlantic made the call they did. But their decision doesn't answer the question for you. Yours is a different site, a different traffic mix, and very possibly a different AI-crawler bot list than a media publisher's. The only way to know your own answer is to run the audit, not borrow theirs.

DO THIS NEXTPull your crawl logs this week. Classify every crawler as search-indexing, AI-training, or hybrid using the table above. Write one policy line per category, and implement it at both the robots.txt and CDN level before September 15, not after. If you want a second set of eyes on the classification calls, especially the hybrid crawlers, that's exactly what our audits team runs for clients on a deadline like this one — and it's worth doing now, before ClaudeBot's crawl share makes the hybrid-crawler decision even bigger than it already is.

See where you are cited today

A free snapshot audit of your rankings and AI citations before we ever talk.

TT
Tyler TruffiMANAGING PARTNER, SOMETHING INC.

Tyler leads work at the intersection of SEO and generative engines at Something Inc., helping B2B brands get ranked and cited across every major AI engine.

Free consultation

Let us be the last SEO agency you ever work with

A 30 minute call and a free audit of your SEO and GEO position. You keep the findings either way.