Expert insights on AI traffic, content monetization, and GDPR compliance for publishers.
Many automated visits to a website never introduce themselves. Here is how we now describe them in plain words — by kind, never by guesswork about who sent them.
A new Pro+ feature reviews your site's existing schema.org markup, flags the gaps, and helps you generate complete, correctly-shaped structured data for the pieces you're missing — no code required.
A new robots.txt directive lets a site point crawlers at a licensing document instead of just an allow/deny rule. Here's what it actually does, how it differs from a rights declaration, and — honestly — whether any AI crawler reads it yet.
robots.txt only ever controlled whether a crawler visits. A newer, separate declaration answers a different question: what may it do with what it reads? Here's the EU copyright mechanism behind it — and why 'declare' is the accurate word, not 'block'.
Cloudflare's own 2026 data shows bots now account for 57.5% of web HTML requests. What the crossover means for your site, and how to see who's really visiting.
A crawler-control recommendation that only lists the bots already in your logs is incomplete by design. Here is why we recommend an explicit rule for every AI crawler we track — including the ones that have not visited yet.
Before any control of ours starts rejecting requests, we prove in a log-only mode that it is complete, that it actually fires, and that it never trips legitimate traffic.
Two changes make your traffic intelligence more trustworthy: traffic over your plan limit is still measured instead of going dark, and geography is read from the real visitor rather than the delivery edge.
Our re-authentication interface maintains a single source of truth across asynchronous identity loads, ensuring user-initiated method selections remain stable through background session validation.
Our authentication and team-invitation flows now apply a stricter validation check on the security tokens they handle, rejecting malformed input at the API edge.
Our compliance log that tracks account changes now stores only hashed identifiers. The change advances GDPR Article 5(1)(c) data minimization without compromising row-continuity needed for Polish 5-year tax retention obligations.
Before any destructive change to our compliance trail database, an automated verification pass confirms the operation will not lose audit-trail integrity. The pattern caught a real divergence this session and prevented data loss.
When privacy notices, marketing pages, PDF DPAs, and the live service all reference the same retention periods and processing limits, drift between them is a real misleading-claim risk. Here is how HumanKey closes that class of drift mechanically.
Pro+ customers can now embed a privacy-by-default verification mark on their websites. The badge confirms active monitoring with a click-through verification page.
When you exercise GDPR Art. 17, your email is now removed from team-invite and admin-action records held by other accounts.
How invitation, acceptance, and member removal events on your team are recorded in your account activity log — supporting GDPR Art. 15 Right of Access.
An update on what you see in your dashboard when you switch into a team account you manage — the sites, plan, traffic, and snippets all reflect the same context together.
An update on the in-dashboard step that lets customers switch from monthly to yearly billing, with the prorated charge and the new renewal date shown before they confirm.
An update on the explicit-acceptance step we apply when inviting people to HumanKey workspaces. Invitees see the inviter's name, when one is set, and the proposed role before accepting — acceptance is an explicit click, not an automatic action.
When plan tiers and feature gates spread across many code paths, drift is inevitable — unless you mechanically enforce a single source of truth. Here's how HumanKey closes that class of bug across our customer-facing surfaces.
Three analytics tools, three different visitor counts on the same site. We explain what each one measures, why the gap between them is structural, and which number to use for which decision.
An operator-side update on the review pattern we use to keep our customer-facing surfaces consistent. We publish the methodology — not the findings — and explain why.
What we learned after 90 days of running an AI-transparency banner under EU AI Act Article 50: what we measured, where the wording was harder than the engineering, and what we'd change.
Rule-based detection can't keep up with modern bots. Learn how ML-based behavioral scoring catches what static rules miss — and why it matters for your website.
Major publishers are signing multi-million dollar licensing deals with AI companies. Here's how the content licensing landscape is evolving and what it means for website owners of all sizes.
The EU AI Act becomes fully applicable in August 2026 with strict transparency obligations. Here's what website owners need to understand about AI crawler compliance and content rights.
How protocols like x402 and tools like Cloudflare AI Crawl Control are creating a new revenue stream for publishers. Learn what pay-per-crawl means for your website.
Perplexity sponsored answers, Google AI Overview ads, and ChatGPT commerce — the next wave of digital advertising is AI-native. Here is what publishers should prepare for.
GPTBot has grown from a minor crawler to one of the most active AI bots on the web. What this means for website owners and how to track its impact on your traffic.