This Cloudflare feature stops AI bots from scraping your site and sends them down an endless rabbit hole to waste their time

If you run a website today, there’s a good chance that AI bots are trying to index and scrape your content. Cloudflare sees more than 50 billion AI crawler requests each day on its network. Many of these bots ignore standard “no crawl” rules and, without the site owner’s consent, siphon off content to train large language models. Blocking them outright often just tips them off, prompting them to change tactics.

That’s why I was intrigued by Cloudflare’s new feature called AI Labyrinth. It flips the script on these bots by feeding them an endless series of AI-generated pages. The bots waste time and computing power on this junk content instead of stealing real data. Even better, AI Labyrinth quietly fingerprints these bots, allowing them to be blocked more effectively in the future. It’s a simple feature with considerable potential, and it’s available to all Cloudflare customers, free or paid.

How Cloudflare’s AI Labyrinth works

Turning AI-generated content into a defensive tool

At its core, AI Labyrinth employs generative AI to generate entire networks of linked decoy pages. When Cloudflare detects bot activity that violates its guidelines, instead of blocking the requests outright, it serves these bots a collection of convincing but ultimately useless pages. To the crawler, it appears to be valid content that can be indexed and processed. To human visitors, these links remain invisible, so the normal browsing experience is unaffected.

Cloudflare is using Workers AI to generate this content ahead of time. The pages are stored in R2 storage for fast retrieval, and care is taken to prevent cross-site scripting vulnerabilities. The AI-generated topics are factual but irrelevant to the actual website being protected, thereby avoiding any contribution to misinformation. Think of it like generating content on vintage television repair for a site about health and fitness programs. Crawlers that follow these links soon find themselves trapped in a maze of pages with no real value to harvest.

One clever side effect of this approach is that it serves as a sophisticated honeypot. Human visitors would never stumble several links deep into this AI-generated maze. So, if a crawler follows these links extensively, Cloudflare gains high-confidence signals that it’s dealing with an unauthorized bot. That data is then fed back into its machine learning models to improve future detection.

Why this approach is so effective

Wasting bot resources while fingerprinting bad actors

What makes AI Labyrinth clever is that it wastes bot resources without alerting the bot operators. Traditional blocking approaches can tip off attackers, leading them to adjust their tactics in an ongoing cat-and-mouse game. But sending bots down an endless maze of AI-generated pages quietly soaks up their time and computing cycles without raising red flags.

At the same time, Cloudflare is collecting valuable intelligence. The AI Labyrinth doesn’t just act as a speed bump. Instead, it’s also a fingerprinting system. Bots that engage deeply with the fake content reveal behavioral patterns that Cloudflare’s detection systems can analyze. This will lead to better identification and blocking of similar bots across all Cloudflare-protected sites in the future.

Another strength is that the AI-generated content is created in advance and integrated seamlessly. This means there’s no performance impact on legitimate site visitors. The hidden links are only served to suspected AI crawlers, and SEO is protected by ensuring the pages are not indexed by search engines. It’s a thoughtful design that minimizes collateral effects.

How to enable AI Labyrinth on your site

Getting started with one simple toggle

If you use Cloudflare, enabling AI Labyrinth couldn’t be easier. It’s an opt-in feature available to all customers, including those on the service’s free plan. You’ll find the option in the Bot Management section of your Cloudflare dashboard. Simply toggle the AI Labyrinth setting to “on” and the system begins protecting your site automatically — no further configuration needed.

Here’s a quick step-by-step guide to enable it:

1. Log in to your Cloudflare dashboard.
2. Navigate to your site’s Security -> Bot Management settings.

   

   Source: Cloudflare

3. Find the AI Labyrinth option.

   

   Source: Cloudflare

4. Toggle it to On.
5. That’s all you need to do. AI Labyrinth starts working immediately.

Once active, Cloudflare will monitor bot activity and selectively serve AI-generated decoy pages as needed. You don’t need to write any rules or maintain the system yourself. It’s a set-it-and-forget-it defensive layer that complements other bot mitigation features.

What’s coming next for AI Labyrinth

A continuously evolving defensive technique

AI Labyrinth is still in its early stages, but Cloudflare is already planning future enhancements. Currently, the AI-generated pages form a convincing yet generic decoy network. The problem is, the generated pages won’t necessarily look like the rest of the site’s content. AI crawlers could, conceivably, be trained to recognize this deception and avoid those pages.

To address this, Cloudflare’s future plans for the AI honeypot include further integrating these pages programmatically with the target website’s structure. It will create a link structure that conforms with the site’s legitimate content and format the pages to adopt the site’s branding and organization. This will make it even harder for bots to detect the trap.

Cloudflare also plans to expand the system’s integration with its broader machine learning models. Each bot caught in the labyrinth feeds valuable data back into Cloudflare’s detection systems. Over time, this creates a feedback loop that strengthens protection across millions of sites.

What’s even better is that AI Labyrinth operates quietly in the background, allowing it to complement other Cloudflare security tools without disrupting your site or legitimate visitors. As bot scraping tactics evolve, this kind of proactive, adaptive defense will prove crucial in protecting your content.

Why I think this feature is a must-enable

Cloudflare’s AI Labyrinth is one of the most clever responses I’ve seen to the explosion of unauthorized AI crawling. It’s easy to activate, requires no tuning, and quietly turns the bots’ own compute hunger against them. At the same time, it provides valuable signals to improve detection across the entire Cloudflare network. If you’re already using Cloudflare, there’s little reason not to enable AI Labyrinth today. The arms race against AI scrapers isn’t likely to go away anytime soon, if at all. Tools like this give website owners a valuable new way to fight back, without tipping their hand. While I don’t run any sites that require this service, I’ll be watching closely as Cloudflare continues to develop this promising defensive technique.