Cloudflare Launches Precursor: Session‑Based Bot Detection for Enterprise Applications
Enable Precursor on high‑value endpoints to collect session‑based behavioral signals and improve bot detection precision.
Enable Precursor on high‑value endpoints to collect session‑based behavioral signals and improve bot detection precision.
Summary
Cloudflare has introduced Precursor, a client‑side, session‑based verification system that injects a lightweight script into every HTML response to continuously collect behavioral signals.
Precursor captures pointer movement, keyboard activity, focus changes, and visibility events, serializes them, and sends them to the edge for real‑time evaluation. Evaluators cross‑reference data to generate signals that feed into Cloudflare’s bot score, challenge decisions, and security rules.
The session‑scoped data prevents bots from resetting their signature by refreshing the page, and the system is designed with privacy in mind, only exposing aggregate patterns rather than individual actions.
Precursor complements Turnstile and extends bot protection across the entire application, improving detection precision while reducing friction for legitimate users.
Key changes
- Precursor injects a lightweight script automatically into all HTML responses
- Collects pointer, keyboard, focus, and visibility events
- Serializes and buffers data, sending it to the edge for evaluation
- Evaluators cross‑reference data to generate detection signals
- Session‑scoped data prevents bot reset by page refresh
- Feeds signals into bot score, challenge decisions, and security rules
- Designed with privacy by collecting only aggregate patterns
- Extends bot protection beyond Turnstile to the entire application