Cloudflare’s new AI bot defaults may be deciding which AI agents can see your store

Since September 15, 2026, new domains on Cloudflare start with AI Training and Agent bots blocked on pages that show ads, with Search allowed. Cloudflare also changed what "Block" means for training: it now covers mixed-use crawlers like Google bot, Bing bot and Apple bot.

For an online store that's a revenue decision, but it's usually made by security or whoever set up the CDN. Cloudflare splits AI traffic into three types. Each needs its own call:

• Search bots (OAI-SearchBot, Claude-SearchBot, PerplexityBot) get you cited in AI answers. Most stores should allow them.
• Agent fetchers (ChatGPT-User, Claude-User, Perplexity-User) visit your page live because a shopper asked. Allow them on product, category, returns and FAQ pages. Throttle abuse, and prefer verified bots on cart and checkout.
• Training crawlers (GPTBot, ClaudeBot, CCBot) shape what models remember about you long-term. Allowing them is a business choice, but avoid a blanket Block, since it can catch Google bot too.

Why it matters: Adobe found AI traffic to US retail sites converted 42% better than non-AI traffic in March 2026. One study of 1,058 domains found sites blocking PerplexityBot had a median Perplexity citation score of zero.

What we'd suggest:

• Name one owner, usually the Head of Ecommerce, not the CISO
• List every layer that can block AI bots: CDN, WAF, robots.txt, plugins
• Review Search, Agent and Training settings quarterly, and monthly through Q4

Full post with the decision matrix: https://alhena.ai/blog/ai-agent-access-policy/

Has anyone checked what their CDN is actually doing with AI bots?