Cloudflare launches Precursor, scoring behavior across a full session to flag bots

Cloudflare's new Precursor injects JavaScript that scores behavioral signals — mouse arcs, keyboard rhythm, focus changes — across an entire session, not a single checkpoint, catching bots that pass individual CAPTCHAs but can't fake consistent human physics over time. It plugs into Enterprise Bot Management alongside Turnstile with no code changes, and because scoring is session-scoped, a bot can't reset its signature by refreshing the page — raising the cost of running automation that looks human only in short bursts.

Source: blog.cloudflare.com ↗

What remains difficult to replicate is consistent human behavior over time.

Cloudflare

Why this matters

→ Bots can't fake consistent human behavior across full sessions, raising automation costs significantly.
→ Catches sophisticated bots that pass individual CAPTCHAs by analyzing physics-constrained patterns like wrist
→ Reduces friction for legitimate users through session-level behavioral scoring instead of checkpoint-based cha

Behavior over time