AI Bot Access Just Got More Complicated. Here’s What Every Business Owner Should Know.

On September 15, Cloudflare is changing the default settings for how AI bots access websites protected by its network. If you have never thought about AI bots, or you have never thought about Cloudflare, this affects you anyway.

Cloudflare sits in front of millions of small and mid-sized business websites, providing security, performance, and traffic management. Chances are strong that your site uses it, whether you installed it yourself or your web team did. When Cloudflare adjusts a default, that adjustment propagates across every site that has not manually opted out.

The change on September 15 is a good reason to talk about a question most business owners have never had to answer. Who should be allowed to read your website, and why does it matter?

What Is Actually Changing

Cloudflare is updating how it categorizes AI bots and adjusting the default settings for which ones can access websites through its network. Certain AI crawlers that do not clearly identify their intent will be blocked by default. Site owners can customize the settings or opt out entirely, but the default behavior is changing for everyone who does not.

The stated goal is to give site owners more control over how their content is used to train AI models and how much automated traffic hits their servers. That is a reasonable goal. It is also a change that quietly affects every website on the network, whether the owner is paying attention or not.

Why This Is a Bigger Conversation Than a Setting Change

The Cloudflare change is the news. The bigger issue is what it reveals.

Every website makes constant decisions about who can access it, how they are treated when they arrive, and what content they can read. Most of those decisions are handled invisibly by infrastructure providers like Cloudflare, hosting platforms, content delivery networks, and firewalls. Business owners rarely see these decisions being made. They just see the results.

That has always been true. What is new is that the decisions increasingly determine whether your business appears in AI search results. An AI bot that is blocked at the infrastructure level cannot read your content. If it cannot read your content, the AI platform behind that bot cannot cite you when someone asks a question you should be the answer to.

For years, “block all bots” was the safe default. It reduced server load, protected content, and generally kept unwanted traffic out. In an AI search era, that same default can quietly make a business invisible in ChatGPT, Gemini, Perplexity, and the AI-powered search experiences customers increasingly rely on.

The Singapore Traffic Question

A specific example makes this concrete. Many businesses that look at their analytics see traffic from countries where they do not do business. Singapore is a common one. The instinct is often to block it entirely, on the theory that if you do not sell to customers there, why let the traffic through?

The answer is that a significant share of that traffic is not customers at all. It is AI infrastructure. Data centers in Singapore and other international locations are running crawlers that read websites to train and update AI models. Blocking that traffic reduces automated visits, but it also reduces the frequency and thoroughness with which AI models learn about your business.

Cutting the traffic can feel like a clean solution. It can also cut off the very AI systems your customers use to find you. The right answer is not “block everything” or “allow everything.” It is being deliberate about which traffic is worth allowing and which is genuinely worth blocking.

What Business Owners Actually Need to Do

If your website runs on Cloudflare, you have two choices before September 15. You can accept the new default settings, which will block certain AI crawlers automatically. Or you can review the settings, decide which AI bots you want to allow, and adjust accordingly.

Neither choice is inherently wrong. The wrong move is doing nothing while assuming nothing has changed. The wrong move is also blocking everything as a knee-jerk reaction without understanding which bots are worth allowing.

The question worth asking is not whether AI bots should have access to your site. It is which AI platforms you want your business to appear in, and whether your current settings support or work against that goal.

How We Handle This for Clients

Tree Ring Digital uses Cloudflare across every website we manage. That means we are watching this change closely, and we are already thinking through what the right default should be for each client we support.

The decision is not one-size-fits-all. A local service business may want different AI bot access than a multi-location retailer. A company preparing for exit may care more about brand consistency across AI platforms than a growth-stage business focused purely on lead volume. The right settings depend on what the business is trying to accomplish, not on what Cloudflare has quietly decided the default should be.

This is the kind of work that happens behind the scenes on our clients’ sites. Infrastructure updates get watched. Settings get reviewed and adjusted deliberately. Decisions get made based on the business context, not on autopilot. Owners do not have to read Cloudflare’s product emails or track policy changes across a dozen platforms. That is our job.

The Bigger Point

Cloudflare is one provider. AI bot access is one setting. Both will change again. Other providers will make similar adjustments. New AI platforms will emerge with different crawling behaviors. The infrastructure layer of the web is going to keep evolving, and every evolution has implications for whether your business shows up when customers are looking.

The businesses that stay visible will be the ones with someone watching the changes and translating them into decisions. The businesses that fall behind will be the ones that assumed a setting installed years ago would keep doing its job forever.