Cloudflare Now Scores Whether AI Assistants Cite You

Cloudflare released its AEO Visibility Dashboard on August 6, 2026, moving answer engine optimization measurement out of the SEO-tool startup layer and onto the CDN. The dashboard reports how often AI assistants cite your site, sitting beside per-operator crawl and referral logs drawn from your own traffic. It is available in early access by request, and no price is published anywhere.

Two things make this worth a careful read rather than a headline. First, the citation metrics probe exactly two assistant families — Anthropic’s Claude and OpenAI’s GPT — so nothing here covers Gemini, Perplexity, Copilot or Grok. Second, your score is not a live read of what those assistants said about you today: it is measured against a category baseline that Cloudflare computes once and reuses across every account in that category.

What follows is the launch itself and the methodology underneath it, not another tools roundup — for the category map, see our guide to the AI-visibility tool category Cloudflare just entered. Below: what shipped and what did not, what each metric is a percentage of, where the sampling argument breaks down, and which of the twenty agent-readiness checks are worth doing regardless of vendor.

The clean way to read August 6 is as a three-level taxonomy. The AEO Suite is the umbrella product line. The AEO Visibility Dashboard is the new tool inside it, described in Cloudflare’s press release as the newest addition to that suite. Agent Readiness is the third piece — and Cloudflare describes it verbatim as the existing tool in the suite. It launched on April 17, 2026 as the free scanner at isitagentready.com plus a Cloudflare Radar dataset. What happened on August 6 is that it moved into the Cloudflare dashboard.

That distinction matters because most coverage compresses it. Saying “Cloudflare launched Agent Readiness” is wrong by nearly four months. The accurate version: the visibility dashboard is new, the readiness scanner is not, and the news is that they now sit in one place. The engineering post that accompanies the launch — From ranking to recommended, by Matthew Conroy and Jack Galilee — carries the technical detail; the press release carries the positioning and both executive quotes.

The pitch underneath the launch is a traffic argument. Cloudflare writes that by our count, fewer than half of all HTML page requests now come from a human — and immediately qualifies it: Not all of those machines are agents acting for a person, but that share is growing fast. Both halves matter. The denominator is HTML page requests observed across Cloudflare’s network, not all internet traffic and not visits, and “by our count” is a self-measurement hedge Cloudflare put there deliberately. For precise bot-versus-human figures with their bases stated, use our dated reference on bot-versus-human traffic rather than a number pulled from a live dashboard.

Every write-up of this launch lists the metric names. Almost none state what each number is a percentage of — and the bases genuinely differ. Prominence, for example, is conditional on having been cited at all, so it sits on a strictly smaller base than Citation Rate. A Prominence score that improves while your citation count shrinks is not progress; it is a smaller sample.

There is also a fifth metric that the press release omits. Industry Fit — a score measuring whether an AI assistant views your site alongside your actual competitors — appears in the engineering blog post but not in the release. Any “four metrics” framing of this product is incomplete. All five are produced by probing the same two assistant families.

Cloudflare’s own reading of the gap between Mention Rate and Citation Rate is the most useful diagnostic in the set. Assistants naming you far more than they cite you, the blog argues, means you are on their radar but not yet earning the citation — a specific, targetable gap. The press release sharpens the same point: a brand mentioned but not cited has an authority problem, not an awareness problem. That is a fair and non-obvious read, and it is the part of the product we would actually use.

If you are assembling your own scorecard rather than adopting a vendor’s, the useful comparison is against a written spec. Ours is at how an AI-visibility score should be specified, and it exists precisely because most vendor metrics ship without a stated denominator.

This is the single most consequential architectural fact in the launch, and Cloudflare states it plainly rather than burying it. The category panel your score is measured against is not run when you open the AEO tab. It was run once for your whole category, and every account in that category is scored against the same copy.

Cloudflare frames this as a benefit, and on latency it is one: the first listed advantage is zero latency, with results loading instantly from a snapshot rather than waiting for live model queries. It also makes the numbers comparable between accounts in the same category, which a per-account live query would not.

Four further design choices follow from the same primary, and each changes how you should report the output:

• Your category is inferred, not declared. Cloudflare infers your industry and category from your site. A mis-inferred category benchmarks you against the wrong competitor set, and every metric in the table above inherits that error.
• The panel prompts are unbranded. Cloudflare queries assistants with likely prompts in the category without specifying your brand. So the metrics describe unprompted category discovery, not how you perform when someone asks about you by name.
• Prompts are repeated to absorb model variance. Because assistants rarely answer the same question the same way twice, Cloudflare routes prompts through its AI Gateway and asks each assistant multiple times across different models. The number of repeats is not stated.
• Scoring uses a model judge, but not a self-judge. Workers AI does the work where genuine judgment is required, and Cloudflare says it uses exact text analysis rather than a model grading its own output. Read that precisely: the claim is not that no model grades anything.

Cloudflare’s strongest structural argument is that it sits at the network layer and can see what AI systems actually do, rather than inferring it from a sample. Stephanie Cohen, Cloudflare’s Chief Strategy Officer, puts it in the release: Cloudflare sees real crawl activity and real referrals across millions of sites, and that is what powers these tools. On the AI Operator Activity panel, that is straightforwardly true — it reports the real crawl and referral traffic on your site, per operator, including the errors those operators hit on the way, such as 403 blocked and 404 dead links.

The tension is that the citation metrics are not built that way.

And yet the AEO tab probes Claude and GPT with likely customer prompts and reads the answers, which is prompt sampling. That is not a gotcha and it does not make Cloudflare dishonest; the honest formulation is narrower and more useful. Cloudflare’s network-layer advantage is real, and it lives in the operator panel. The citation metrics rest on the same sampling technique as the rest of the category. The release compresses two different evidence types into one claim. PPC Land reached the same reading independently, writing that the blog post describes the AEO tab doing precisely what the release characterises as the limited method.

There is independent work on why sampled brand metrics wobble, and it needs to be cited carefully rather than borrowed as proof. A July 2026 arXiv preprint by Dmitrij Żatuchin decomposes the variance in LLM brand answers. Three scope limits travel with it. It is a single-author preprint that has not been peer-reviewed. It measures multilingual sentiment polarity rather than citation rate. And its corpus is 12,933 responses covering 20 Central and Eastern European brands in 8 languages across GPT-5.2, Gemini 3 Flash and Perplexity, so Claude is not in its model set. It is corroboration that sampled brand metrics are noisy. It is not a measurement of Cloudflare’s product.

The paper’s practical finding cuts both ways for Cloudflare. It reports that per unit of query budget, adding languages and models reduces relative-error variance far more than adding repeats — a repeat past the fifth reduces it by only 0.0003 — and that reliability is bought by spreading across languages and models, not by repeating one prompt. Cloudflare’s stated approach of prompting multiple times across different models matches that advice. A single-category, single-language panel probing two assistant families does not address the largest facet the paper identifies.

Cloudflare is also not the first platform to ship citation reporting. Microsoft got there twice already — see Bing’s own citation-share reporting and Microsoft Clarity’s citation measurement. What makes Cloudflare the interesting third entrant is not the metrics; it is that this is the first of the three to sit at the CDN layer, where the crawl and referral logs already are.

The nesting here is easy to get wrong. Agent Readiness is the dashboard tab. Diagnostics is the technical checkup within Agent Readiness — Cloudflare’s own phrasing — and it is Diagnostics that produces the checks grouped into effort buckets. Diagnostics scores a site from “Not Ready” up to fully agent-native, rolling per-hostname checks into a single view.

Each check returns one of three states, not two: every check comes back as pass, fail, or neutral, with a note on why it matters, and an evidence trail showing the exact request and response we saw. The neutral state is doing real work — it is how the tool handles checks that do not apply to a given site type, and calling this a two-state checklist misreads the output.

Remediation is genuinely well designed. Where a Cloudflare setting fixes a failing check, you get a Set up in Cloudflare deep link — Cloudflare names Markdown for Agents and managed robots.txt as examples. Where it does not, there is a Copy Agent Prompt button that proposes what your coding agent needs to build. That is a sensible acknowledgement that most of this list is engineering work, not a toggle.

The two tools also organise the same territory differently. The free scanner groups its checks by subject — discoverability, content accessibility, bot access control, API/auth/MCP discovery, and commerce. The August dashboard groups by effort — Quick wins, Technical groundwork, Advanced integration, Commerce. That is a product moving from “what standards exist” to “what should you do Monday,” which is a reasonable move. It also means the two do not hand you the same mental model, and that matters for the comparison in Section 08.

The Advanced integration bucket is where a vendor scorecard quietly becomes an opinion about the future. Of the six checks Cloudflare names in it, four are drafts or vendor proposals rather than ratified standards — and one of them says so in its own text.

That line comes from the WebMCP specification itself. The same audit applied across the rest of the bucket: Web Bot Auth is an IETF draft, the MCP Server Card is described by Cloudflare’s own April post as a proposal currently in draft, and the Agent Skills index is a Cloudflare proposal — Cloudflare writes that it has proposed that sites make this information available at a well-known agent-skills path. The ratified work sits a bucket lower: the API Catalog, mapped to Technical groundwork, is published as RFC 9727 and Link headers as RFC 8288. That is a fair critique to make of any readiness score: part of it grades you on unratified work.

The table below is the full twenty-check list from the live free scanner, mapped to the August effort buckets, with each check’s standards status and the adoption figure where Cloudflare has published one. The verdict column is ours. Where a status could not be established from the sources read, the cell says so rather than guessing.

Two details fall out of that table. The first is the commerce discrepancy: the August blog post’s Commerce bucket names x402, ACP, UCP and AP2, while the live free scanner lists x402, MPP, UCP and ACP — and the scanner’s own skills index defines MPP as Machine Payment Protocol. The dashboard product and the free scanner do not check the same commerce list, so do not treat a free-scanner result as a preview of the dashboard one. If you want the background on the one with the most existing coverage, we have a walkthrough of x402, the payment standard in the unscored commerce bucket.

The second is that the deeper you go down the bucket list, the more you are optimising for a machine-identity future that has not settled. That is not an argument against doing any of it — it is an argument for sequencing. Cloudflare has been building toward this for a while; its earlier work on agent identity and temporary accounts is the same thesis from the access-control side.

The strongest argument for doing this work is not the new dashboard. It is the adoption baseline Cloudflare published back in April, and it comes with an unusually well-specified denominator. Cloudflare Radar took the 200,000 most-visited domains on the internet, filtered out categories where agent readiness is irrelevant — redirects, ad servers, tunnelling services — and scanned what was left. Every figure below is a share of that filtered set, not of the web.

The most striking figure is the one that does not fit on a bar chart. Across that entire scanned set, MCP Server Cards and API Catalogs together appear on fewer than 15 sites. Not fewer than 15 percent — fewer than 15 sites. On those two checks — the API Catalog in Technical groundwork and the MCP Server Card in Advanced integration — essentially nobody has shipped anything, which is worth holding in mind before treating a low readiness score as a competitive disadvantage.

The Markdown check carries a tension of its own, and it comes straight out of Cloudflare’s own testing. Of 7 agents Cloudflare tested as of February 2026, only 3 — Claude Code, OpenCode and Cursor — request content with an Accept: text/markdown header by default. So the scanner scores you on serving Markdown to agents while most of the agents Cloudflare itself tested do not ask for it. The denominator there is seven agents Cloudflare tested, not the agent population.

While the dashboard sits behind an early-access request, the free scanner is live with no account and no waitlist at the time of writing — and it publishes its own scope in machine-readable form. Its manifest states that it scans a website URL to check its AI agent readiness level from 0 to 5 across 20 checks covering discoverability, content accessibility, bot access control, API/auth/MCP discovery, and commerce. The homepage check list sums independently to the same total: 4 + 1 + 3 + 8 + 4 = 20. It also publishes 23 skill documents, each with a SHA-256 digest, at a well-known agent-skills index.

One published detail is easy to miss: llms.txt is not a default check. Cloudflare states it plainly — By default, we only check whether the site correctly handles Markdown content negotiation, and do not check for llms.txt — and adds that you can customise the scan to include it if you choose. That is a meaningful signal about where a major infrastructure vendor thinks the convention sits. It lines up with llms.txt adoption in practice and with Google’s position on llms.txt.

The practical read: run the free scanner first. It costs nothing, requires no waitlist, and the twenty checks it runs overlap heavily with what Diagnostics grades. Just do not assume the two produce identical results — the commerce row above is a concrete demonstration that they do not check the same list, and the April scanner and August dashboard organise their findings around different mental models.

The useful question is not whether to adopt Cloudflare’s scorecard. It is which of these checks you would want done even if this product disappeared tomorrow. Sorted by that test, the list separates cleanly.

The forward view is the interesting part. Citation measurement is converging on the platforms that already hold the logs — Microsoft shipped it inside Bing Webmaster Tools and Clarity, and Cloudflare has now shipped it at the CDN layer, where crawl and referral data already lives. Our read is that this is where the category ends up: the sampling half of these products is commoditised and will converge on similar numbers, while the differentiator becomes whose observed-traffic data you already have. That argues for treating citation scores as a directional input and per-operator crawl and referral logs as the operational one.

It also raises the pressure on access decisions. Cloudflare has announced that on September 15, 2026 it will set new defaults for newly onboarding domains, blocking the Training and Agent crawler categories by default on pages that display ads while leaving Search allowed — existing customers can opt out in Security settings before then. That is on our Q3 2026 platform deadline calendar. Measuring citations while your crawl posture changes underneath you is a good way to misread the result, so decide the posture first. If you want the crawler-reachability side audited properly, start with auditing whether crawlers can actually reach your archive, and for the strategy layer our agentic SEO engagements start with exactly this sequence.