{"version":"v1","site":{"name":"expectedwrong","url":"https://expectedwrong.com"},"links":{"collection":"https://expectedwrong.com/api/public/posts","rss":"https://expectedwrong.com/rss.xml","llms":"https://expectedwrong.com/llms.txt"},"post":{"slug":"cloudflare-ai-audit-default","title":"Cloudflare Turned On the Lights","subtitle":"AI Audit is now on by default, which means you've been logging bot traffic this whole time and didn't know it.","url":"https://expectedwrong.com/cloudflare-ai-audit-default","api_url":"https://expectedwrong.com/api/public/posts/cloudflare-ai-audit-default","published_at":1751025600,"published_at_iso":"2025-06-27T12:00:00.000Z","updated_at":1771556828,"updated_at_iso":"2026-02-20T03:07:08.000Z","tags":["cloudflare","ai","crawlers","security","honeypot"],"excerpt":"AI Audit is now on by default, which means you've been logging bot traffic this whole time and didn't know it.","meta_description":"AI Audit is now on by default, which means you've been logging bot traffic this whole time and didn't know it.","reading_time_minutes":1,"word_count":194,"engagement":{"signals":0,"counterpoints":0},"body_markdown":"Cloudflare quietly enabled AI Audit by default, so every crawler that's been hitting your site — GPTBot, ClaudeBot, the unnamed ones that don't bother identifying themselves — is now logged. You didn't have to do anything. It was just on.\n\nThis is a strange gift. Most people will look at the dashboard once, say \"huh,\" and move on. But the implication is sitting right there: you now have a complete record of which AI companies are indexing you, how often, what paths they care about.\n\nThe obvious next move is the honeypot. Deploy a Worker site with a `robots.txt` that says don't come in here — then watch who comes in anyway. A `Disallow: /private` that points at something real. Log every hit. Cross-reference the user agents. Build a list of who respects the rules and who treats them as a suggestion.\n\nThe robots.txt convention was always honor-system. Nobody enforced it because nobody could. Now you can at least see the receipts.\n\nCloudflare just handed you a passive intelligence operation. You don't have to do anything clever — just deploy a Worker, write a spicy `robots.txt`, and wait. The bots will tell you everything.","body_text":"Cloudflare quietly enabled AI Audit by default, so every crawler that's been hitting your site — GPTBot, ClaudeBot, the unnamed ones that don't bother identifying themselves — is now logged. You didn't have to do anything. It was just on. This is a strange gift. Most people will look at the dashboard once, say \"huh,\" and move on. But the implication is sitting right there: you now have a complete record of which AI companies are indexing you, how often, what paths they care about. The obvious next move is the honeypot. Deploy a Worker site with a robots.txt that says don't come in here — then watch who comes in anyway. A Disallow: /private that points at something real. Log every hit. Cross-reference the user agents. Build a list of who respects the rules and who treats them as a suggestion. The robots.txt convention was always honor-system. Nobody enforced it because nobody could. Now you can at least see the receipts. Cloudflare just handed you a passive intelligence operation. You don't have to do anything clever — just deploy a Worker, write a spicy robots.txt, and wait. The bots will tell you everything.","hindsight":{"verdict":"right","note":"AI crawler transparency became standard. The honeypot idea was prescient — the data about who's indexing you and how often turned out to matter more than the blocking mechanisms.","links":[],"at":1739980800,"at_iso":"2025-02-19T16:00:00.000Z"}}}