Half of the web is now bots: Cloudflare detects them from the tremor of the human hand
Monday
Cloudflare introduced Precursor, a bot detection system that stops checking the identity of visitors at entry and starts observing how they behave once inside. Instead of asking for proof of humanity at a single moment, it evaluates the entire browsing session.
The company frames this move around a data point that has just surpassed a symbolic threshold: according to its count, automated traffic now generates about 57% of all web requests, more than that produced by humans.
The classic defensive model works like a bouncer checking a document at the entrance: the CAPTCHA asks once to prove one is human, then lets one pass. The problem is that modern bots easily bypass that single step. They execute JavaScript, operate within real browsers, and solve CAPTCHAs without raising suspicion.
"Traditional security checks observe a single moment in time, but modern bots have become skilled enough to trick their way past the front door," said Dane Knecht, Cloudflare's chief technology officer. He added that the space between login and payment was a black box; Precursor was born to open it.
The Physics of Being Human
Precursor monitors the entire visit: pointer movements, typing rhythm, scrolling, clipboard usage, and how long a page remains visible. Faking a click is easy, but faking an entire human visit is a tangible engineering problem.
The most interesting point is how bots betray themselves. When a developer tries to mimic human mouse movement, they add random noise or variable delays. But a real hand is not just irregular; it's bound by physics. The wrist rotates, and the movement tends to trace an arc; there is a measurable delay between the moment the eye sees a box and when the hand clicks it; even the steadiest hand shakes at a physiological tremor frequency.
In contrast, bots are exposed precisely because of their perfection: they move along perfectly straight lines or mathematically ideal Bézier curves and click with a precision that no human hand could match. Individual interactions may seem plausible, but over the course of a session, patterns diverge in ways that are hard to imitate.
A Signature That Doesn’t Reset
On a technical level, when Precursor is active, Cloudflare automatically injects a lightweight and obfuscated script into the HTML responses of the site as they pass through its network, without configuration or additional connections. The script collects interaction signals and sends them at regular intervals to edge servers, where a battery of evaluators cross-checks them: for instance, it verifies that pointer activity corresponds to the time the page is visible, or that keyboard events only trigger when a text field is focused.
The data is tied to the session, and that’s the detail that matters: a bot cannot reset its behavioral signature by reloading the page or starting from a new verification. The signal accumulates over time, and it’s the consistency of human behavior across the entire duration that proves difficult to replicate.
On the privacy front, the company is proactive. Keyboard activity, it says, is recorded as timing and rhythm, not as the actual keys pressed; signals are evaluated as aggregated patterns and not linked to accounts, login identities, or persistent profiles. However, the fact remains that software capable of observing how a person moves the mouse and types throughout a visit raises more than one question, a topic that has accompanied the announcement.
Bot Traffic Sorted by Intent
Precursor is a piece of a broader redesign. Cloudflare has begun to distinguish automated traffic based on intent: search bots that index a page to respond later, agents that act in real time on behalf of a person, and training bots that absorb content into a model. Starting September 15, on new sites behind Cloudflare, the latter two categories will be blocked by default on pages hosting ads, while search bots will continue to pass. The logic is economic: those who bring readers back to the site are welcome, those who merely extract content less so.
Precursor is now being deployed, activatable from the dashboard without site modifications, offering a choice between a low-friction mode that observes in the background and one that requires a verified session. It will be free until the expected general release by the end of the year, after which it will be permanently paired with Turnstile in enterprise Bot Management: the check that Cloudflare claims to carry out nearly 3 billion times a day at the most sensitive points, from login to registration to payment.