Cloudflare's default AI-bot block is silently killing publisher GEO visibility

Independent testing through mid-June 2026 confirms that Cloudflare’s “Block AI bots” setting is enabled by default on every new domain provisioned through the platform, blocking GPTBot, ClaudeBot, Google-CloudVertexBot and other large-language-model crawlers at the network edge before any robots.txt rule is read. Cloudflare itself publishes traffic data on the impact via Cloudflare Radar, but the default-on configuration means many site owners are blocking AI crawlers without ever having made an explicit decision to do so.

Why this matters

For European publishers, content sites, and small-business operators investing in Generative Engine Optimisation (GEO) or AI search visibility, the default-block setting silently undoes that investment. If a site’s content cannot be crawled by ChatGPT, Claude, Perplexity, or Google’s AI Overviews bots, it cannot be cited in AI-generated answers, no matter how well the content is structured for AI consumption. Site owners who switched to Cloudflare in the past 12 months and never reviewed the security settings are likely affected and may not have realised it.

The action is a single setting check: in the Cloudflare dashboard, under Security → Bots → AI bots, confirm whether the toggle is set to Block, Allow, or Monitor. For sites pursuing AI search visibility, the toggle needs to be set to Allow (or specific bots whitelisted) and individual AI crawlers verified via Cloudflare’s bot-management rules. Sites running ad-supported business models may have a different calculus and reasonably choose to block; sites positioning for AI citation as a discovery channel cannot afford to block by default.

For context on RWE’s GEO and AI-search content strategy, see our Brexit Schengen mobility paradox and the broader insights archive where our front-loaded entity strategy is designed for AI citation.