The Cloudflare AI-bot switch nobody checked was even in the path
Every AI-crawler bulletin from the last few months tells you to go and check one setting: whether Cloudflare is set to block AI bots. It's a reasonable instruction if the site actually runs through Cloudflare. We wanted to know how often that's true, so we checked our own estate.
We looked at the domains we run or manage and asked a narrower question than "is Cloudflare configured": is Cloudflare actually sitting in the request path, actually answering the request, right now. On our estate, the number of domains where that was true was zero. Every AI-bot setting in that dashboard would have been a statement of intent that nothing enforced.
We checked the method wasn't just producing zeros by default. We ran it against public domains outside our estate that do sit behind Cloudflare, and it found them, corroborated independently by the cf_ray header the edge adds to a request it actually handled. The check works. Our zero is a measurement, not a broken instrument.
We want to be precise about what this does and doesn't tell you. Our estate is Vercel-heavy by construction, most of our own sites route through it directly, so this isn't a claim about how common the gap is across the wider market. It's a demonstration that the failure mode is real and that it's checkable. If you're relying on a dashboard setting for AI-crawler control, the first question isn't what the setting says. It's whether the thing holding the setting is even in the way.
If you want to check your own, the fix is boring and worth doing anyway: confirm the DNS record for the domain actually resolves to Cloudflare, then confirm a real request comes back with a cf_ray header before you trust anything the dashboard tells you about it.