Cloudflare Inc. today opened general availability for Precursor, a bot detection system that tracks how a visitor behaves across an entire browsing session instead of testing them once on arrival.

Precursor runs inside the browser. It streams interaction signals back to Cloudflare’s edge, where servers score them in real time for evidence of automation. The target is the CAPTCHA. A challenge page tests the visitor once, at the door. Everything the visitor does after that is assumed good.

Cloudflare puts bot traffic at roughly 57% of web requests. By its count, automation now outweighs people on the internet. Cloudflare’s argument is that a point-in-time check is easy to fake. A bot can fake a single action. Faking an entire session, with the timing irregularities of a real person, costs real engineering effort.

“Instead of just checking an ID at the gate, we are looking at behavior over the entire visit,” said Chief Technology Officer Dane Knecht.

Customers turn Precursor on with a single click and no code changes. Cloudflare injects a small script into pages already passing through its network and the script logs mouse movement, scrolling rhythm, typing cadence, clipboard activity and how long a page stays visible in the browser tab.

What happens next is a coherence check. Cloudflare’s analysis engine unpacks the telemetry and looks for internal contradictions, such as pointer activity recorded while the page was hidden or typing events fired at a moment when no text field held focus. Suspicious sessions accumulate context rather than resetting, feeding a running Bot Score that follows the visitor through a site or single-page application.

That closes off a standard evasion. Under per-request challenges, an automated agent can wipe its behavioral signature by reloading the page. Precursor keeps scoring.

Cloudflare said the script records aggregate patterns and not the inputs themselves. Keyboard activity is stored as timing rhythm and cadence. The characters typed are never captured, according to the company.

The launch extends a long run of bot and crawler products out of Cloudflare. The company began blocking artificial intelligence scrapers by default for new customers last year, built the Pay Per Crawl marketplace so publishers can charge AI firms for access and shipped AI Crawl Control for per-crawler allow and block decisions. Bot management is also a wholesale business. WP Engine Inc. built the bot controls in its Global Edge Security service on top of Cloudflare’s network.

Knecht said Cloudflare already protects users billions of times a day at login and checkout and described the stretch between those moments as “a black box” the company is now filling in.

Precursor is generally available now. Cloudflare did not disclose pricing.

Image: SiliconANGLE/Ideogram