On August 31, 2026, Cloudflare launched Adaptive Intelligence, a new bot-detection mechanism designed to keep learning from current traffic instead of waiting for the next manual rule updates. For owners of shops and services with login systems, however, the important part is not the “AI” label itself, but the problem Cloudflare is trying to solve: bots increasingly look like normal users and spread attacks across thousands of IP addresses.

What changed?

Until now, many bot-protection systems have relied on sets of rules and models updated on fixed cycles. Attackers could observe how the system reacted, adjust their behaviour and try again. Cloudflare describes an increasingly common scenario in which automated traffic is distributed across a large network of addresses, each individual source sends only a small number of requests and the attack moves slowly through login, account recovery or checkout.

Adaptive Intelligence is designed to keep updating the detection model based on current traffic across Cloudflare’s network. The first element went live on August 31: the model responsible for bot score is expected to be retrained continuously, so new evasion techniques can be incorporated into the model faster.

WebsiteGarage / Services

Explore our services.

Why does this matter for a shop or service with user accounts?

Because a modern bot attack does not have to look like a million requests per second. It can look like thousands of perfectly ordinary login attempts spread across many addresses. In that model, simple request limits stop being enough because each individual source appears to behave normally.

This matters especially for credential stuffing, meaning automated testing of previously stolen usernames and passwords, account takeover, form abuse, password recovery and automated attempts to complete the purchase flow.

Do you need to do anything?

If you use Cloudflare Bot Management on the Enterprise plan, Cloudflare recommends checking whether Auto Update Machine Learning is enabled. Once activated, the new mechanism works without a migration to a separate version.

If you use Cloudflare Free, Adaptive Intelligence does not automatically appear in your account, but that does not mean you have no bot protection. The Free plan includes Bot Fight Mode. It is a simple domain-wide protection feature that detects some known patterns of bot traffic and responds with a computationally expensive challenge. Control is limited, however: you cannot set different behaviour for separate bot categories or create exceptions for specific parts of the website.

Pro and Business plans include Super Bot Fight Mode. Among other things, it lets you choose how to respond to particular categories of automated traffic, recognise verified bots and use additional mechanisms such as JavaScript Detections. Business also provides more detailed bot analytics, while Free and Pro users can review basic information about security events in Security Events.

Regardless of plan, it is worth separately protecting the parts of the site with the highest business value. Cloudflare points to Turnstile for protecting forms, login and checkout, and to rate limiting for restricting excessive numbers of requests. The scope of rate limiting depends on the plan: Free and Pro allow simpler rules based mainly on IP address, while Business supports more advanced conditions. This is still not Adaptive Intelligence, but it is a much more sensible approach than protecting login only with a rule that says “five attempts and then block the IP”.

If you do not use Enterprise Bot Management, today’s launch does not automatically give you the new protection. There is still an important practical takeaway: protecting login and checkout should not rely only on simple IP blocking. If a site has customer accounts, payments or forms with real business value, abuse-detection mechanisms should analyse the behaviour of the whole session and recurring patterns, not just a single request.

WebsiteGarage’s take

This is not just another “Cloudflare added a feature to the dashboard” story. The direction is more interesting. A bot no longer has to smash the front door with a hammer. It can show up a thousand times, wearing a different hat each time, press the handle once and politely walk away.

That is exactly why the classic “block the IP after five attempts” increasingly creates more of a feeling of security than actual security. The system needs to see that apparently unrelated visits form one pattern. Cloudflare is now trying to automate exactly that part of the defence.

Sources