You have seen the screen. A page pauses, a small box appears, sometimes you tick it, sometimes it just clears on its own, and then the site lets you in. That box is Cloudflare Turnstile, and it runs at the moments a business most wants to be sure a visitor is real. On July 13, Cloudflare extended the idea past that single box with a new tool called Precursor (Cloudflare, 2026).
The change matters to more than the security team. AI agents now visit websites on behalf of real people, filling forms, pulling product details, checking availability. A business wants some of those agents through and wants others stopped. Precursor is built to tell them apart.
Here is what it is, and what each team should know.
Turnstile checks you at the door
Turnstile is Cloudflare's replacement for the old distorted-text puzzle, the Completely Automated Public Turing test to tell Computers and Humans Apart that everyone knows as a CAPTCHA. Instead of asking you to read wavy letters or pick out traffic lights, it runs a quiet check in the background and decides how much friction a visitor needs. Most real people never click anything.
It fires at the high-stakes points: logging in, creating an account, checking out. Cloudflare says Turnstile now runs close to three billion times a day on some of the most sensitive pages on the internet (Cloudflare, 2026). It is a checkpoint. You reach the door, it looks at you, it lets you pass or asks for more.
Precursor watches the whole visit
Turnstile leaves a gap. It sees you at login and checkout, but not the rest of the visit in between. Precursor fills that space. It watches how a visitor behaves across the entire session and turns that behavior into a signal (Cloudflare, 2026).
The reason behavior works as a signal comes down to a simple gap between people and software. A bot can run a browser, execute code, and clear a single checkpoint in a short burst. Keeping up a convincing human rhythm for a full visit is much harder. People move a mouse in arcs because the wrist pivots. They pause a beat between seeing a button and clicking it. Even a steady hand carries a faint tremor. Automation tends to move in straight lines, click with impossible precision, and repeat itself. One or two of those tells can be disguised. Across a whole session they stack up (Cloudflare, 2026).
Precursor reads those patterns and feeds them into Cloudflare's bot score, the number that decides whether a visitor looks human, wanted, or unwanted. An agent a customer sent to fetch information can be recognized and allowed. Automation trying to scrape, break in, or commit fraud can be caught with more accuracy, which also means fewer challenges thrown at genuine people (Cloudflare, 2026).
Do website managers have to build anything
No code, no redesign. When Precursor is switched on, Cloudflare injects a small script into your pages as they pass through its network, so nothing changes in your application itself (Cloudflare, 2026). Your developers do not add a tag or wire up an integration.
There is one real decision to make, and it belongs to whoever owns web and security policy. Precursor runs in two modes. A low-friction mode watches quietly in the background and learns what normal sessions look like on your site. A stricter mode enforces a challenge when a session does not already look verified (Cloudflare, 2026). Most teams will want to start in the quiet mode, watch the data for a few weeks, then decide where to tighten.
Why watching the whole session is the point
A single check can be gamed. A bot clears the box, then behaves however it likes once inside. Precursor keeps its record for the length of the session, so refreshing the page or restarting a challenge does not wipe the history a visitor has already built (Cloudflare, 2026). That is what makes automation expensive to hide. Faking one clean moment is easy. Faking a whole believable visit, every time, is not.
For marketing, the payoff is fewer real prospects bounced at a form or a checkout by an overcautious challenge. For the security team, it is a clearer read on which visitors turn automated partway through a visit, the kind of behavior a single checkpoint never sees.
On privacy, Cloudflare states a specific limit. Keyboard input is recorded as timing and rhythm, not the actual keys typed, and the behavioral signals feed its bot detection as aggregate patterns rather than getting tied to a person's account or login (Cloudflare, 2026).
What it costs
Precursor is free to use until Cloudflare's general availability release later this year, after which it becomes part of Enterprise Bot Management (Cloudflare, 2026). It works alongside Turnstile rather than replacing it. If you already run Bot Management or Turnstile, Precursor extends that coverage across the rest of the visit.
What an IT department should do next
Start by finding out whether your organization is on Cloudflare Enterprise Bot Management, since that is where Precursor lives. If you are, turn it on for one zone in the quiet observation mode and leave it there. Read the new session views in Security Analytics for a few weeks to learn what a normal visit looks like on your own site before you enforce anything.
Then have one conversation the tool cannot have for you. Marketing, security, and web should agree on which agents the business wants to welcome, the ones acting for real customers, and which it wants to stop. Precursor gives you the dial. Where you set it is a business call, not a default.
Set it once without that conversation and you risk turning away the same AI shoppers your competitors are learning to court.
Before general availability sets the price, decide who in your organization owns the Precursor dial. Which agents does the business want through, and which does it want stopped, and has marketing, security, and web signed off on the same answer? The tool sorts the traffic. Someone still has to decide what the sort means for revenue.
