Cloudflare Web Scanner
Run by Cloudflare
How to detect Cloudflare Web Scanner
Cloudflare Web Scanner signs its requests, so you detect it by verifying the cryptographic signature on each request. A valid signature proves the request came from Cloudflare; a copied user agent without the signature does not.
- Detection method
- SignedThe agent signs its requests, so its identity is verified cryptographically.
- Signals that identify it
- CryptographicA signed request verified cryptographically
- BehavioralHow the session clicks, types, moves and navigates, checked after the signature is verified
Every signal Verisoul checks for Cloudflare Web Scanner
Cloudflare Web Scanner signs its requests, so we verify who it is cryptographically, then check the rest of the session.
- Used
Cryptographic
A signed request verified cryptographically
- Not used
Network
Not needed to identify it
- Not used
Device
Not needed to identify it
- Used
Behavioral
How the session clicks, types, moves and navigates, checked after the signature is verified
How often you'll see it
Very uncommon
Rare, brand new, or not seen on Verisoul traffic yet
More from Cloudflare
- Cloudflare Browser RunHeadless browsers hosted on Cloudflare's network, used for automation, rendering, scraping and AI agents.SignedHow common: Uncommon
- AI SearchAn AI crawler run by Cloudflare that signs its requests.SignedHow common: Very uncommon
- AI Search ExternalAn AI crawler run by Cloudflare that signs its requests.SignedHow common: Very uncommon
- Cloudflare CrawlerAn AI crawler run by Cloudflare that signs its requests.SignedHow common: Very uncommon
- Cloudflare CustomerSLO ProberAn automated service from Cloudflare that signs its requests.SignedHow common: Very uncommon
- Cloudflare CustomerSLO Prober (Staging)An automated service from Cloudflare that signs its requests.SignedHow common: Very uncommon
Questions about Cloudflare Web Scanner
How do you detect Cloudflare Web Scanner?
Cloudflare Web Scanner signs its requests, so you detect it by verifying the cryptographic signature on each request. A valid signature proves the request came from Cloudflare; a copied user agent without the signature does not.
What is Cloudflare Web Scanner?
Cloudflare Web Scanner is a crawler run by Cloudflare that signs its requests.
Does Cloudflare Web Scanner identify itself?
Yes. Cloudflare Web Scanner signs its requests cryptographically, which is the strongest way an agent can identify itself.
Can a bot pretend to be Cloudflare Web Scanner?
Not convincingly. A bot can copy Cloudflare Web Scanner's user agent, but without Cloudflare signing keys its requests fail verification and it is not labeled Cloudflare Web Scanner.
How common is Cloudflare Web Scanner?
Very uncommon. Rare, brand new, or not seen on Verisoul traffic yet.
What does the Verisoul API return for Cloudflare Web Scanner?
Every session Verisoul identifies as Cloudflare Web Scanner carries an agent block with id "cloudflare_web_scanner", name, provider, type "crawler", detection_method "signed" and the detection_signals used (cryptographic, behavioral). Build rules on the id, type and detection method.