CloudflarePrefetch is a bot in the SEO crawlers category, operated by Cloudflare.
URL prefetching means that Cloudflare pre-populates the cache with content a visitor is likely to request next. This setting leads to a higher cache hit rate and thus a faster experience for the user. (https://developers.cloudflare.com/fundamentals/speed/prefetch-urls/)
SEO crawlers map links, keywords and technical issues for SEO tools and backlink databases. They help the tool's customers, often your competitors, rather than you. Rate limit or block the ones you do not use.
CloudflarePrefetch identifies itself with this user agent string:
Mozilla/5.0 (compatible; CloudFlare-Prefetch/0.1; +http://www.cloudflare.com/)Anyone can copy a user agent string. Transfon Security also checks where each request comes from, so a request that claims to be a known crawler but comes from the wrong network is treated as a fake, not as the real crawler.
We have not confirmed whether CloudflarePrefetch follows robots.txt. Add a rule, then check your logs to see that it stopped. robots.txt is a plain text file at the root of your domain, such as https://example.com/robots.txt.
User-agent: CloudFlare-Prefetch Disallow: /
User-agent: CloudFlare-Prefetch Disallow: /private/ Disallow: /search
User-agent: CloudFlare-Prefetch Allow: /blog/ Disallow: /
User-agent: CloudFlare-Prefetch Allow: / User-agent: * Disallow: /
User-agent: CloudFlare-Prefetch group, CloudflarePrefetch ignores your User-agent: * rules, so repeat any that should still apply.CloudFlare-Prefetch from CloudflarePrefetch's user agent; check Cloudflare's own documentation if it publishes a different robots.txt name.Treat robots.txt as a statement of your policy, and enforce it where requests arrive.
CloudflarePrefetch works for an SEO tool's customers, often your competitors. It adds server load without readers, so rate limit or block it unless you use the tool.
Transfon Security for publishersSEO crawlers map landing pages and links for competitor research. Keep CloudflarePrefetch's visits out of campaign data.
Transfon Security for advertisersCloudflarePrefetch can map your catalogue, prices and site structure for competitors. Block it unless you use the tool yourself.
Transfon Security for e-commerceAllow CloudflarePrefetch only if your team uses the tool; otherwise rate limit it on docs and marketing pages.
Transfon Security for SaaS and APIsrobots.txt is a request, not an enforcement. Transfon Security shows CloudflarePrefetch by name in the Top Bots report, so you can see how often it visits and which pages it reads. Block or allow it with a User Agent rule, or slow it down with a rate limit decision rule.
Transfon Security
CloudflarePrefetch is a bot in the SEO crawlers category, operated by Cloudflare. URL prefetching means that Cloudflare pre-populates the cache with content a visitor is likely to request next. This setting leads to a higher cache hit rate and thus a faster experience for the user. (https://developers.cloudflare.com/fundamentals/speed/prefetch-urls/)
We have not confirmed whether CloudflarePrefetch follows robots.txt. Add a robots.txt rule, then check your logs to see that it stopped, and block it by user agent if it did not.
Add "User-agent: CloudFlare-Prefetch" followed by "Disallow: /" to the robots.txt file at the root of your site. To enforce it, block requests whose user agent contains "CloudFlare-Prefetch" at your WAF. In Transfon Security that is one User Agent block rule.
No. robots.txt is voluntary, so CloudflarePrefetch may not follow it, and anyone can send CloudflarePrefetch's user agent, so a fake CloudflarePrefetch ignores your rule. Enforce the rule where requests arrive, at your WAF, and check the source network.
SEO crawlers map links, keywords and technical issues for SEO tools and backlink databases. They help the tool's customers, often your competitors, rather than you. Rate limit or block the ones you do not use.
Transfon Security identifies every bot in this directory in your traffic reports, flags fake search crawlers, and lets you allow, block or rate limit each bot.
Privacy, security, monetization, and performance insights. A few emails a month, no spam.