Your CDN's AI settings are a start. Here's what they can't see.

If your store sits behind a CDN, it may already have AI controls you haven't switched on. Switch them on. They are good at what they're built for, and on some CDNs they cost nothing. A CDN sees your store as requests, though, and some of what AI agents do on a store never shows up in a request. This post is about where that line falls, using Cloudflare as the example because its controls are documented and free.

What CDN controls do well

• Declared AI crawlers, by group, for free. Since July 2026, every Cloudflare plan, the free one included, can set Search, Agent and Training crawlers to be blocked on all pages, blocked on pages that show ads, or not blocked.
• Checking a bot is who it says it is. Cloudflare verifies a bot that declares itself through a cryptographic signature, a published IP list or reverse DNS (verified bots). That's a stronger check than reading the user agent.
• Seeing which AI services visit. AI Crawl Control, available on all plans, shows which AI services access your content and lets you allow or block them.
• Stopping a request before it reaches your store. A crawler turned away at the edge costs your server nothing.
• A broad switch for other bots. On the free plan, Bot Fight Mode challenges requests that match bot patterns. It can't be customised or skipped with WAF custom rules, so it's all or nothing.

If what you want is to keep training crawlers out, do it at the CDN. It's free, it's at the edge, and it's one setting to undo.

What a CDN can't see

A CDN answers one question per request: who is asking, and should it pass? Four things a store cares about aren't in that question.

Agent browsers that don't announce themselves

Some assistants shop by driving a real browser. One that doesn't name itself sends requests that look like a person's. A CDN's AI crawler controls act on bots that declare themselves. Cloudflare also scores undeclared automation, from heuristics, machine learning and JavaScript detections, but granular bot scores are an Enterprise product.

Tactical looks at what happens after the page loads: whether the mouse moves, whether the page scrolls, how evenly the session moves from page to page. Agent browsers are scored on behaviour, and the score firms up as the session goes on. A score is a probability, not a verdict, and we haven't published accuracy figures.

Orders

A CDN sees requests, not orders. It can't tell you whether an agent bought, what, or for how much. And an order placed in an AI platform's own checkout never loads your storefront at all: on Shopify, Google Analytics and custom pixels don't fire in Meta's direct checkout.

Tactical reads the store's orders and labels each one an agent order, an AI-referred order or neither, including agent-checkout orders pixels never see. Order data comes from WooCommerce today; on Shopify it needs order access the app doesn't have yet, and Shopify's own Agentic report covers its AI channels in the meantime.

What a request means for your catalog

CDN rules match URLs and request fields. A product, a collection, a cart, a checkout or a drop window becomes a path rule you write and keep current, within the plan's budget: five custom rules on the free plan. The CDN doesn't know that a URL is part of this week's drop, or that an add-to-cart on it came from an agent.

Tactical records what agents do by product: which products they viewed, which they added to the cart and, with order data, which they bought. Drop protection and agent-checkout rules, coming: join the Observe beta.

The people AI sends you

A person who arrives from a ChatGPT answer is ordinary traffic to a CDN, and should be. Tactical records AI-referred visitors by assistant, and their orders are attributed last-touch and labeled estimated.

How to use both

1. Set your CDN's AI crawler groups to what you want. Leave Search allowed if you want to appear in AI search answers: OpenAI says sites that opt out of OAI-SearchBot won't be shown in ChatGPT search answers.
2. Leave the edge to the CDN. Crawlers you've decided to keep out, generic bot traffic and rate limits belong there.
3. Add Tactical for the rest: agent browsers that don't announce themselves, the people AI sends you, what agents do by product and, on WooCommerce, what they buy, with an evidence pack for each agent order.
4. On Cloudflare, connect the two. Tactical's Cloudflare connection adds a Worker that reports the AI crawlers a page snippet can't see, and leaves your AI crawler settings and firewall rules as they are. Using Tactical with Cloudflare's AI traffic settings.

Your CDN sees declared bots. Your platform sees its own AI channels. Tactical is for the rest, and it works beside both. Five ways to handle AI agents, compared · Start free.