Personal AI Agents Are Visiting Business Websites: How to Respond

A customer may ask a personal AI agent to compare products, find a support article or complete a purchase. To your website, those actions can look like automated traffic. Without knowing which agent is visiting and what it is doing, it can be hard to tell whether to welcome it, limit it or block it.

Cloudflare announced new analytics and access policies for personal agents on November 4, 2026. The changes give site owners more ways to see agent activity and set different access rules. For business owners, the useful question is not simply whether AI agents are good or bad. It is what they can do on your site, and whether that fits your customers and business.

What Cloudflare has introduced

Cloudflare’s Security Analytics now includes Personal Assistants as a category in the Bot Analysis chart. Site owners can use it to view personal agent traffic over time. A new Personal Assistants widget lists which agents visit and how many requests each sends.

Selecting an agent filters other analytics to show its requested paths, response status codes and networks. That can help you see whether an agent is reading product pages, attempting to reach checkout, logging in or encountering errors. These details turn a broad category of automated traffic into activity you can examine.

Cloudflare has also expanded its access policies for supported personal agents. In Security Settings, site owners can set an overall Agents policy and choose a different policy for each supported agent. The available choices are Allow (do not block), Block on pages with ads, or Block.

Cloudflare is renaming the setting AI Crawler and Agent access policies to reflect its wider scope. The existing Search and Training policies stay as they are. During onboarding, Cloudflare asks whether a site monetizes pages with ads and tailors recommended policies to the answer. Site owners can revisit their controls in Security Settings.

For details, read Cloudflare’s announcement about personal agent visibility and control.

Why this matters to your business

A personal agent can act as an intermediary between a person and your website. If it can find your products or support information, it may help a customer reach what they need. If it cannot use a page, its requests may instead show up as errors or activity that needs investigation. Cloudflare’s announcement points out that blocking agents altogether can mean losing customers.

That does not mean every agent should have unrestricted access. A publisher may want an agent to read its articles, but not access pages where ads support the content. A retailer may want to understand whether agents are reaching product pages or checkout before deciding what rules fit. The right choice depends on your site and the role each page plays in your business.

Visibility can also help with account security. For sites using Cloudflare’s Account Abuse Protection, which is currently in early access, the announcement describes views that connect agent activity with user accounts. Teams can see which agents are active across users, whether a personal agent made a login or sign-up request, and which agent was involved. An account overview can show the agents acting for that account.

This context may help a fraud analyst distinguish an agent a customer has used over time from one that has appeared for the first time. Cloudflare also says analysts can mitigate an account directly with a WAF rule on its Hashed User ID, rather than blocking an agent for everyone who relies on it. These features are specifically described for sites using Account Abuse Protection; they are not the same as the general traffic analytics and access policies.

If you are reviewing your own customer journey, a website audit can help you examine the pages and paths agents may be trying to reach. Keep the review focused on whether those paths work as intended and whether your access decisions reflect the purpose of each page.

What to inspect before setting rules

Start by understanding what is actually happening on your site. Avoid deciding based on the label “automated” alone. The announcement’s analytics are designed to show which agents are present and what paths they request, giving you a basis for a more deliberate policy.

Review the available information with your website, security and customer-support responsibilities in mind. In particular, look for:

• Which personal agents are visiting, and how many requests each sends.
• Which pages or paths each agent requests, including product, support, login and checkout pages.
• The status codes those requests receive, especially where agents appear unable to use a page.
• Whether a page is supported by advertising or has another reason to limit access.
• Whether agent activity is connected to account events, if you use the relevant Account Abuse Protection features.

Then consider what each page is meant to do. A public support article and an account login page may call for different decisions. So might an ad-supported article and a product page. Treat these as business choices, not one blanket rule for every part of your site.

If your business is exploring how AI can support customer interactions, our AI solutions page outlines related services. That is a separate consideration from allowing third-party personal agents to access your website: one concerns tools you choose to use, while the other concerns agents acting for visitors.

Choose controls with care

Cloudflare’s policy options let site owners combine an overall Agents setting with exceptions for supported personal agents. For example, the announcement describes setting the overall policy to Block on pages with ads, then allowing a supported agent you want to welcome. That is an example, not a universal recommendation.

Before changing access, write down the outcome you want for each important area of your site. Decide whether an agent should be able to read the page, proceed to an action, or be blocked there. Make sure the people responsible for content, sales and security understand the reasoning behind the choice.

After applying a policy, return to the analytics and check the traffic details available to you. Look for whether the agent’s requests match your intention and whether important pages are returning errors. If your policy is not producing the access pattern you wanted, reconsider the setting rather than assuming all agents behave alike.

Be careful not to treat the agent as a complete substitute for information about the customer. Cloudflare says a site may recognize the agent but lack context such as whether the person is an existing customer, what they authorized the agent to do, whether they have a subscription or which protections should apply. The company says privacy-aware ways to carry user context, assess reputation and establish accountability are areas it is working on with others in the ecosystem.

That limitation matters when an agent reaches sensitive parts of your site. An agent’s presence alone may not tell you what the person intended or what access they should receive. Keep decisions about accounts and protected actions aligned with the information and safeguards available to your business.

What to do next

1. Check whether your site has the relevant Cloudflare features. Review the available analytics and access settings in your account. Account Abuse Protection is described as being in early access, so do not assume its account-level views are available to every site.
2. Inspect agent activity before blocking or allowing it. Use the Bot Analysis category and Personal Assistants widget, where available, to review agents, requested paths and response codes.
3. Decide page by page where access makes sense. Consider the purpose of each page, whether it carries ads and whether an agent reaching it supports a customer task or creates a concern.
4. Set an overall policy and agent-specific choices. Use the available controls to reflect your decisions for supported agents. Keep your existing Search and Training policies in mind; Cloudflare says those remain unchanged.
5. Review the results and update your decision. Return to the traffic details after making changes. If you need help evaluating your website’s journeys and priorities, you can book a free strategy call.

Personal agents are another route by which customers may reach your business. Cloudflare’s announcement offers site owners more visibility and more specific controls, but the decision remains yours. Review what agents are doing, set rules that fit your pages, and revisit those rules as your needs change.