Sites behind Cloudflare
Every Cloudflare setting that can turn a paying AI agent away before naulon sees it, what naulon checks, and how to fix each one.
On this page
Cloudflare decides who reaches your site before naulon does. Its security settings run first, so an AI agent they turn away never reaches the crawler route's Worker, the WordPress plugin or the SDK. Nothing inside your site can see that it happened: the agent simply never arrives, and your site page shows no AI reads.
This page lists every Cloudflare setting that can do that, what naulon checks, and how to change each one yourself.
The settings that can turn an agent away
| Setting | Where it is in Cloudflare | What it stops |
|---|---|---|
| AI crawler and agent policies (Search, Agents, Training) | Security > Settings, filter by Bot traffic | Each behaviour can be Block, Block on pages with ads, or Allow. Agents and Search are the reads naulon charges for. |
| Block AI bots (the older single switch) | Security > Settings, filter by Bot traffic | Every AI crawler Cloudflare recognises, everywhere or only on pages with ads. |
| AI Crawl Control blocks | AI Crawl Control | Each crawler you set to Block. Cloudflare enforces it as one custom security rule. |
| Your own custom security rules | Security > Security rules | Any rule that blocks or challenges requests by AI crawler category or user agent. |
| Super Bot Fight Mode, Verified bots | Security > Settings, filter by Bot traffic | Set to Block, it refuses every crawler that identifies itself, AI crawlers included. On Cloudflare Pro plans and above. |
| Bot Fight Mode | Security > Settings, filter by Bot traffic | Challenges traffic that looks like a known bot, which can include AI agents. No rule can make an exception to it. |
A training-only block (Training set to Block or Disallow) costs you nothing on naulon. A training corpus is negotiated, not charged per read, so naulon does not report it.
Do not rely on Cloudflare's defaults. They have changed more than once, so check what your zone actually has.
What naulon checks
Every site Cloudflare fronts shows a Cloudflare card at the top of its Connection row.
Without a connection, the card cannot see your settings. It says so, links to the three places above, and offers the read-only connection.
With a connection, naulon reads your zone every six hours and names each setting that turns an agent away, with a link to the page where it is changed. The site story raises it too, so you see it on the site list as well.
Connect Cloudflare read-only
An owner or admin connects Cloudflare once, in Settings > Integrations, or from the Cloudflare card on any site.
- Press Connect Cloudflare (read-only) and approve on Cloudflare's own page. Choose the account your sites are in.
- naulon ticks the zones your sites sit in and reads them straight away. Tick any other zone you want watched.
The connection can read your AI crawler and agent policies, Bot Fight Mode settings, custom security rules and which Worker serves each route. It cannot change anything, and it never sees your visitors or your traffic. naulon keeps only the read-only key Cloudflare issues, encrypted.
To stop it, press Disconnect. naulon hands the key back to Cloudflare and deletes everything it read. Nothing on Cloudflare changes.
If Cloudflare stops accepting the key, the card says Reconnect. It says the same, and names the permission, when naulon starts reading a setting your connection was approved without. Reconnecting keeps the zones you ticked.
Fix it for me
When the card finds a setting it can change, it offers Fix it for me. It lists every setting it will change before you leave for Cloudflare, then:
- asks Cloudflare for permission to change bot settings on that zone, once;
- sets the AI crawler and agent policies that block charged reads to Allow, and verified bots to Allow if Super Bot Fight Mode blocks them;
- reads the zone again, and reports a setting Cloudflare kept as not changed rather than as done;
- hands the permission back.
It never changes your training policy, Bot Fight Mode or your own custom rules. Those are yours to decide, and the card links to each one.
Free for AI and Block AI
If your terms make AI reads free, a Cloudflare block costs you nothing but still turns away the agents your terms invite, so the card still reports it. If your terms refuse AI, Cloudflare blocking agents agrees with you, and the card says so instead of raising a finding.