On October 5, 2026, Cloudflare published the full list of its Birthday Week launches: 46 announcements made between September 28 and October 2. Most are for developers. A handful matter to any website behind its network: separate controls for AI bots, payment when AI uses your content, and a plan for its own certificate authority.
What we know
- The wrap-up: Cloudflare published the list on October 5, 2026, after the week that marked its 16th birthday. It counts 46 announcements, from Monday, September 28 to Friday, October 2.
- The backdrop: Cloudflare says that this year, for the first time, more than half of internet traffic was not human. On its network, daily requests from AI agents grew by more than 1,700% in a year. These are the company's own measurements.
- Training crawlers: the company says 22% of the crawler requests it saw in spring 2025 were for AI training, and 52% by June 2026, based on each crawler's stated purpose.
- Three separate controls: since July, Cloudflare has offered separate Search, Agent and Training controls on every plan, including Free. By its data, fewer than 1% of sites on its network block search crawlers and 17% block training.
- Disallow AI Training: shipped on September 15. It keeps a site indexed for search while telling the crawler's operator not to use the content for training. Apple, Google and Microsoft have committed to honor it, according to Cloudflare.
- Pay Per Use: in beta since September 30. An AI company offers a price for a specific use of content. The publisher accepts or declines in the dashboard, under Monetize → Pay Per Use. The buyer reports each use, and Cloudflare bills the buyer and pays the publisher monthly. Usage is self-reported by the buyer.
- Monetization Gateway: in closed beta, for eligible U.S. Cloudflare customers only. It lets a site charge agents per request using the HTTP 402 status code.
- Certificates: on September 29, Cloudflare announced its intent to become a public certificate authority, with free certificates issued automatically over the ACME protocol. It has applied to the Chrome, Apple, Microsoft and Mozilla root programs. It is not issuing certificates yet. It expects the first of a new format, Merkle Tree Certificates, in the first quarter of 2027.
What changes and what doesn't
The menu changes. A site behind Cloudflare no longer has a single choice between blocking and allowing "AI bots". It can treat a search engine's crawler, a crawler that trains models, and an agent that visits because a person asked an assistant something in three different ways. And there is now a third answer: yes, if you pay.
Nothing changes on its own. Pay Per Use is a beta, and Cloudflare says it is working directly with each buyer and with the publishers who opt in. Its posts do not say which AI companies take part, what they pay, or when it opens to everyone. The company itself admits that pricing is not solved yet. For a small site, the useful part today is the controls, not the payout.
Your certificate does not change either. The one your site uses today stays valid. Cloudflare is not issuing its own certificates yet, and it presents the service as a second source of free certificates, so the web depends less on Let's Encrypt.
How to tell if this affects you
It affects you if your website goes through Cloudflare. Many do without the owner knowing, because the hosting company or whoever built the site turned it on. Seven steps:
- Check whether you use Cloudflare. Look at your domain's nameservers in the account where you registered it. If they end in "ns.cloudflare.com", your site goes through its network.
- Review the three controls. In the Cloudflare dashboard, find the Search, Agent and Training settings and see how they are set. Someone may have blocked something you now want open.
- Don't block search by accident. If you want to appear in Google or Bing, their crawlers need to get in. Blocking training does not require blocking search: that is what Disallow AI Training is for.
- Decide what to do about agents. If you want an AI assistant to be able to read your site when someone asks about what you sell, don't block them. Cloudflare's point: turn an agent away and you may be turning away the person who sent it.
- See who visits. Cloudflare says its dashboard shows which crawlers come in and how much bandwidth each operator uses.
- Pay Per Use, no rush. If you publish original content, check whether any offer shows up under Monetize → Pay Per Use. Before accepting, read which use it pays for and what it allows the buyer to do with your content.
- If you don't use Cloudflare, your tool is still the robots.txt file. Ask your hosting provider whether you can see in the server logs which AI bots come in.
Related: OpenAI Models Got Into Third-Party Sites: What to Check
Sources
- Cloudflare, "Everything we launched during Birthday Week 2026", October 5, 2026
- Cloudflare, "The Internet has a second audience", September 30, 2026
- Cloudflare, "Pay Per Use: when AI uses your work, you should get paid", September 30, 2026
- Cloudflare, "Building a certificate authority for the whole Internet", September 29, 2026
Updates: this line will be updated when Pay Per Use leaves beta or when Cloudflare issues its first certificates.