Cloudflare Is Making an AI Decision for You on September 15. Don’t Let It.

A client asked me last week if we’d “turned off ChatGPT” on their site. We hadn’t touched anything. Their host runs on Cloudflare, and somewhere between renewing a plan and ignoring a changelog email, a setting had shifted under them. Nobody flipped that switch on purpose. That’s kind of the whole problem.

Here’s the thing about running a website in 2026: it comes with decisions you didn’t know existed. Nobody emails you a ballot. A company just changes a default, and your site inherits a new personality overnight.

The next one of those lands September 15.

What’s actually changing

Cloudflare sits in front of a huge chunk of the internet and decides who gets in. On September 15, it’s resetting its default rules for AI bots. Right now, if you’ve never touched the setting, most AI crawlers can reach your site. After the 15th, that default flips for two categories: bots that train AI models, and bots acting as autonomous “agents” browsing on someone’s behalf. Both get blocked automatically, but only on pages that carry ads. Search bots, the ones that let your site show up in ChatGPT or Google answers, stay allowed. Cloudflare’s own announcement spells this out directly.

Translation, because “bots classified as Training or Agent” isn’t a sentence a business owner should have to parse. One kind of bot is scraping your content to teach a model. Another kind is out there completing tasks, like booking or comparing prices, on a person’s behalf. The search-answering crawlers behind ChatGPT, Google, and Perplexity are a third kind, and they’re the ones left alone by default.

Here’s the catch, straight from Cloudflare’s own docs. Crawlers that do double duty get judged by the strictest rule that applies to them. Googlebot is the big one. Block Training crawlers and you can end up blocking the training half of Googlebot too, even while telling yourself you only wanted the model-scrapers gone.

New domains onboarding to Cloudflare get the new default automatically on September 15. If you’re already a customer, Cloudflare is asking you to make an active choice before then. Skip it, and you inherit a setting you never reviewed. “I’ll deal with it later” isn’t really an option here. Later is the 15th.

Two very different businesses, two very different answers

Normally I’d tell you the “right” setting. I can’t, because it depends on what your website actually sells.

Say you want to be findable and quotable inside AI answers. That’s most service businesses, most local shops, most of my clients. You want AI search bots crawling you, full stop. That’s the entire premise behind getting cited by AI Overviews and ChatGPT instead of just Google’s ten blue links. Block the wrong bot and you’ve quietly opted out of an entire discovery channel without meaning to.

Now say your business’s product IS the words. A publication, a paid newsletter, a course library, anything where the writing itself is what people pay for. The calculus flips. Every page an AI trains on for free is a page that didn’t need to buy from you. Blocking training bots there isn’t paranoia. It’s just protecting the thing you sell.

Most small businesses are in the first camp and don’t realize it. Nobody grows revenue by being invisible to the tools that increasingly answer questions before a human ever clicks a website.

Google’s doing its own version of this

While Cloudflare handles the front door, Google’s been quietly rolling out a parallel choice on the back end. Search Console now has a straight Include/Exclude toggle that pulls your whole site out of AI Overviews, AI Mode, and Discover’s AI summaries. Google says flipping it does not touch your normal rankings. As of August 31, that control and a new “Generative AI” performance report went out to every site in the world, not just a test group.

Worth knowing before you get excited: that report only shows impressions, meaning how often you showed up inside an AI answer. No clicks, no queries, no idea who actually read it. It’s a start, not a dashboard.

Check your settings this week

It’s genuinely a ten-minute job.

1. Log into Cloudflare, pick the domain, and look under Security for AI or bot traffic controls.
2. See what Search, Agent, and Training are each set to right now. Most accounts default to “allow” until someone touches it.
3. Decide on purpose, not by accident. Allow if you want AI-search visibility. Block Training if your content is the product.
4. In Search Console, check whether the AI Include/Exclude toggle shows up yet for your property, and make sure it matches the call you just made in Cloudflare.
5. Write the date down somewhere. This won’t be the last default that changes without asking you first.

If you already read my post on getting more out of Cloudflare, consider this the sequel nobody asked for: one more setting hiding in an account most owners treat like a black box. I’d rather you make this call on purpose than let Cloudflare make it for you by default. Deciding which way to point your bots is a normal part of what we do in AI SEO work these days. Check the setting either way, even if you never call me about it.