C
Why this grade
A middle-of-the-pack C. Credit on robots.txt AI-agent rules, but the biggest gaps are on SDK availability across languages and JSON error bodies for API callers — closing those would lift this toward a B.
Get notified when this grade changes
Subscribe to grade-change alerts for cloudflare.com — we'll email you when a new scan moves the grade or score.
Quick wins
Low-cost fixes that would nudge this grade up.
- JSON error bodies for API callers Return a JSON error body (application/json or application/problem+json), not an HTML page, when the caller sends `Accept: application/json`.
- /ai.txt AI-crawler directives Add a short `/ai.txt` at the site root declaring your AI-crawler usage terms (see spawning.ai/ai-txt).
- /.well-known/ai-plugin.json manifest Publish a `/.well-known/ai-plugin.json` manifest with name_for_model, description_for_model, and an api block.
Blocking issues
High-weight checks that aren't passing.
- /.well-known/agent.json (A2A AgentCard) agent.json present; 3 of 4 required keys found, missing: endpoints.
Per-category breakdown
| Category | Score | Percent |
|---|---|---|
| Anti Bot | 15 / 15 | |
| Api | 10 / 15 | |
| Crawl | 23 / 23 | |
| Docs | 3 / 14 | |
| Html Meta | 4 / 8 | |
| Identity | 10 / 10 | |
| Onboarding | 3 / 6 | |
| Protocols | 14 / 18 | |
| Registries | 5 / 5 | |
| Root Level | 16 / 16 | |
| Well Known | 10 / 18 |
Findings (33)
Anti Bot · 2
| Check | Status | Points | Notes |
|---|---|---|---|
| Anti-bot interstitial | pass | 10 / 10 | No anti-bot interstitial markers on a single polite homepage request — behavioural anti-bot can still challenge real crawler traffic. |
| User-agent sniffing | pass | 5 / 5 | Homepage responses for default and curl UAs are effectively identical. |
Api · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| GraphQL introspection | skip | — | No GraphQL endpoint found at any of 3 conventional paths. |
| JSON error bodies for API callers | fail | 0 / 5 | HTTP 404 served an HTML body for an API-like caller (Accept: application/json). |
| OpenAPI specification discovery | pass | 10 / 10 | OpenAPI 3.1.0 served at /openapi.json (3 paths, 0 schemas). |
Crawl · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| RSS/Atom feed | skip | — | No RSS/Atom feed found at probed paths or via `<link rel="alternate">`. |
| robots.txt AI-agent rules | pass | 13 / 13 | All 13 documented AI user-agents can crawl /. |
| XML sitemap discovery | pass | 10 / 10 | Sitemap at /sitemap.xml (urlset, 896 entries). |
Docs · 2
| Check | Status | Points | Notes |
|---|---|---|---|
| Docs platform discoverability | warn | 3 / 6 | Docs found at /docs but platform is custom — crawler-friendliness is unknown. |
| SDK availability across languages | fail | 0 / 8 | No SDKs discoverable via npm, PyPI, or the docs page. |
Html Meta · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| JSON-LD structured data | pass | 4 / 8 | JSON-LD present (Organization, WebSite); missing a machine-targeted `@type: WebAPI`/`SoftwareApplication` for full credit. |
| meta description | info | — | Meta description present (68 characters) (informational — not graded). |
| Open Graph tags | info | — | All three core Open Graph tags present on the homepage (informational — not graded). |
Identity · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| Email auth (SPF, DMARC, DKIM) | info | — | Email auth present: SPF + DMARC + DKIM (informational — mail trust/deliverability, not graded). |
| security.txt responsible-disclosure declaration | info | — | security.txt at https://www.cloudflare.com/.well-known/security.txt declares a Contact (informational — a human security-researcher signal, not graded). |
| TLS + HSTS + HTTPS redirect | pass | 10 / 10 | Valid TLS cert (issuer: C=US, O=Google Trust Services, CN=WE1, expires 2026-10-06), http → https redirect confirmed. (HSTS max-age=31536000 — informational.) |
Llm Training · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| Common Crawl index presence | info | — | 50 pages from cloudflare.com in CC-MAIN-2026-30 (informational — corpus presence, not graded). |
| Hacker News mentions | info | — | 50 verified HN mention(s) of cloudflare.com (informational — popularity signal, not graded). |
| Wikipedia article | info | — | Wikipedia article "Cloudflare" links to cloudflare.com (https://blog.cloudflare.com/terminating-service-for-8chan/) (informational — corpus knowledge, not graded). |
Onboarding · 1
| Check | Status | Points | Notes |
|---|---|---|---|
| API-key / signup path discoverability | warn | 3 / 6 | Signup/API-key page found at /developers but nothing on the homepage or docs links to it — a crawler would have to guess. |
Protocols · 2
| Check | Status | Points | Notes |
|---|---|---|---|
| Public MCP registry listing | pass | 10 / 10 | Listed in 1 registry/registries: official. |
| A2A AgentCard conformance | warn | 4 / 8 | AgentCard partially conformant: missing or empty `version`; empty `endpoints[]`. |
Registries · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| GitHub public repository | pass | 5 / 5 | 4 attributable repo(s): cloudflare/cloudflare-docs (homepage field); cloudflare/cloudflared (homepage field); cloudflare/cloudflare-go (homepage field); cloudflare/moltworker (homepage field). Agent topics: ai-agents. |
| npm SDK package | skip | — | No npm packages attributable to cloudflare.com — name matches without a verifiable attribution signal are not counted. |
| PyPI SDK package | skip | — | PyPI package(s) exist at probed name(s) (cloudflare) but none carry a verifiable attribution signal — name-existence alone is not counted. |
Root Level · 3
| Check | Status | Points | Notes |
|---|---|---|---|
| /ai.txt AI-crawler directives | skip | — | No /ai.txt present (404) — this is a secondary signal, not a negative one. |
| /llms-full.txt long-form index | pass | 8 / 8 | llms-full.txt present, 153.4 KB. |
| /llms.txt index for LLMs | pass | 8 / 8 | llms.txt present, 16.5 KB, starts with '# Cloudflare'. |
Well Known · 5
| Check | Status | Points | Notes |
|---|---|---|---|
| /.well-known/agent.json (A2A AgentCard) | warn | 6 / 10 | agent.json present; 3 of 4 required keys found, missing: endpoints. |
| /.well-known/ai-plugin.json manifest | skip | — | No /.well-known/ai-plugin.json present (404). |
| /.well-known/mcp.json (Model Context Protocol) | warn | 4 / 8 | mcp.json parses but lacks MCP indicator keys (server / capabilities / tools). Could be a different use of the path. |
| OpenID Connect configuration + dynamic registration | skip | — | No /.well-known/openid-configuration — site does not advertise an OIDC provider. |
| /.well-known/openapi.{json,yaml} | skip | — | No OpenAPI spec at either well-known path. |
Score over time
- Latest
- 68 — flat
- Best
- 68
- Worst
- 68
- Scans
- 3
Scan history
Embed this grade
Paste the badge anywhere — your README, a status page, a docs site. The image always reflects the latest scan.
