Tactical docs · Integrations

Using Tactical with Cloudflare's AI traffic settings

What stays in Cloudflare, what Tactical adds, and how the Worker from Connect Cloudflare runs beside your AI crawler settings and firewall rules.

Keep using Cloudflare for what it does at the edge. Tactical doesn't change your Cloudflare settings. It adds what a CDN can't see from a request, and connecting it adds one Worker and one route to your zone, nothing else.

What stays in Cloudflare

Job	Cloudflare feature	Notes
Block or allow AI crawlers by group: Search, Agent, Training	AI crawler settings, on every plan	Blocked on all pages, only on pages that show ads, or not blocked
See which AI services visit; allow or block one crawler	AI Crawl Control, all plans
Check that a declared bot is who it says it is	Verified bots	A cryptographic signature, a published IP list or reverse DNS
Challenge generic bot traffic	Bot Fight Mode on Free; Bot Management on Enterprise	Bot Fight Mode can't be customised or skipped with WAF custom rules
Firewall rules on paths and request fields	WAF custom rules	Five on the Free plan

If all you want is to keep training crawlers out, this is enough. You don't need Tactical for it.

What Tactical adds

AI crawler visits, by page and product, reported by the Worker below. A visit is marked verified when the request IP matches the operator's published IP range; the ranges are refreshed nightly.
Agent browsers that don't name themselves, scored on behaviour by the Tactical snippet on your pages. Cloudflare's AI crawler settings act on bots that declare themselves.
The people AI assistants send you, by assistant.
Orders: agent orders and AI-referred orders from your platform's order data (WooCommerce today), with an evidence pack for each agent order. Cloudflare sees requests, not orders.
Rules by product, cart and checkout: coming. Join the Observe beta.

How the Worker runs beside your settings

What Connect Cloudflare changes

You create an API token with three permissions, scoped to your store's zone:

Account → Workers Scripts → Edit
Zone → Workers Routes → Edit
Zone → Zone → Read

Tactical uses the token once. It finds the zone, uploads one Worker named tactical-agent-detect, and adds one route for the zone's domain, in the form example.com/*. Then the token is discarded; Tactical never stores it. Nothing else in your account changes: not your AI crawler settings, bot settings, WAF custom rules or rate-limiting rules. Those three permissions couldn't change them.

What the Worker does

It passes every request to your store unchanged. When a request's user agent names an agent in Tactical's registry, the Worker reports the visit after the response has gone, so it never delays a page. The report carries the user agent, the URL, the time and the connecting IP address; Tactical checks the IP against the operator's published ranges and doesn't keep it with the visit.

The Worker also carries the Tactical Gate engine. It does nothing unless your store has a Gate policy, and Gate is in beta. With a policy, a request that carries a Web Bot Auth signature from an agent in Tactical's registry (ChatGPT agent, for one) is checked against the keys that agent publishes: the Worker fetches the agent's key directory, for example from chatgpt.com, with a one-second limit, and caches it for five minutes to an hour, so only an occasional signed request waits for it. Unsigned requests are never checked. See Verified agents. Any error inside the Worker passes the request through untouched.

Which runs first

Cloudflare's security features act on a request before it reaches a Worker route, and a rule that blocks or challenges a request stops it there (Cloudflare: security features interoperability). So a crawler your Cloudflare settings block never reaches the Tactical Worker and doesn't appear in Tactical. Tactical's crawler numbers are what got through; Cloudflare's own analytics show what it stopped.

Other Workers and subdomains

When more than one route matches a request, the most specific one wins (Cloudflare: routes). If another Worker has a more specific route on your zone, for example example.com/api/*, requests on those paths go to that Worker and Tactical doesn't see them.

A route for example.com/* doesn't cover www.example.com or any other subdomain. If your store is served from a subdomain, check Workers Routes in Cloudflare after connecting, and tell us at [email protected].

Updating and removing it

The agent list is built into the Worker when it's deployed; reconnecting picks up a newer list. To remove the Worker, use Remove Worker on Tactical's Cloudflare page with a fresh token (the same three permissions), or delete the Worker and its route in Cloudflare yourself.

What Tactical doesn't do in Cloudflare yet

Tactical doesn't write rules into Cloudflare. Setting Cloudflare's own AI crawler settings and custom rules from Tactical, for stores that want it, is planned and not built. Until then, set them in Cloudflare.

Shopify stores

Shopify gives apps no server-side request access, so on Shopify, Tactical sees AI crawlers only when the store's domain is on your own Cloudflare account and connected this way. See Using Tactical with Shopify's Agentic channels.