Cloudflare replaces CAPTCHAs with continuous behavior checks

Bots now generate about 57% of all web requests. Humans are officially the minority online, and the CAPTCHA era is ending.

From door check to constant watch

Cloudflare’s answer launched on July 13, 2026: Precursor, a continuous behavioral validation engine that watches the entire session instead of testing you once, according to the company’s press release.

The signals are the small physical tells of being human: mouse movements, scrolling patterns, typing rhythm, all analyzed in real time at the edge. The premise is that an AI agent that can fake one click cannot fake an hour of being human.

Built for the agent era

The design acknowledges the new reality directly: modern AI agents pass one-time checks easily. A single puzzle at the door, the CAPTCHA model, filters almost nothing when the visitor is a capable agent.

So Precursor keeps refining its detection score throughout the session, and a bot cannot reset the session to escape a bad score. There is no discrete moment to defeat, just a running judgment that follows you across the visit. Deployment is one click. Cloudflare’s launch blog post says Precursor will be free to use until its GA release later this year and lists it as a feature of Enterprise Bot Management, while the press release announces it as generally available and gives no price.

The irony and the trade

The irony is hard to miss. The web is filling with machines pretending to be people, and one of the biggest network gatekeepers just switched from door checks to constant surveillance of behavior.

That framing is also the uncomfortable part of the trade. Proving you are human used to be a checkbox; now it is an ongoing evaluation of how you move, scroll and type. Prove-you-are-human is becoming a subscription, not a checkbox.

It solves a real problem, and it normalizes something new. The question worth sitting with: as detection tightens and agents improve, how long until ordinary humans start failing the test?