Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Monitor collects Precursor signals without letting them change bot scores or Challenge clearance; Arm mode can affect both.
- The Interstitial is configured separately from Off, Monitor and Arm, with rules that can override the sitewide default for selected requests.
- When enabled, an Interstitial can affect API requests from curl, mobile backends and server-to-server jobs that do not have browser cookies.
- Sites already using JavaScript Detections keep them running while they test Precursor in Monitor mode.
Monitor collects signals without changing bot scores
On October 19, 2026, Cloudflare announced three Precursor status options: Off, Monitor and Arm. Monitor collects client-side session signals, but those signals do not change bot scores or Challenge clearance. Arm allows Precursor signals to affect both outcomes.
Monitor is therefore a way to observe how signals cover sessions before relying on them for enforcement. It does not mean Precursor is blocking traffic. Cloudflare's announcement does not specify which plans or accounts qualify, so check the target zone in your dashboard and the documentation for your plan.
The Interstitial is a separate setting
The Precursor Interstitial is a lightweight Challenge a visitor may see before continuing. It is configured separately from Monitor or Arm: in Security > Settings, set a sitewide default, then use Interstitial Rules to override that default for selected requests.
For example, a hypothetical store could establish session state in the background on most pages but require a Challenge on `/checkout`. This example has not been tested on a live site, and it does not guarantee that every session is verified; confirm that your own rules match the intended requests.
Check whether an Interstitial could reach your APIs
When the sitewide Interstitial default is on, visitors without a verified Precursor session must complete a Challenge first. Cloudflare notes that this can affect APIs called by non-browser clients, mobile backends, server-to-server jobs and browser API requests that do not send cookies.
If browser pages and APIs share a zone, one option is to leave the sitewide default off and require an Interstitial only on browser pages or paths that need it. Another is to turn it on by default and explicitly turn it off for API hostnames or paths. For browser XHR or fetch calls that should receive a Challenge, confirm through your application’s identity flow whether cookies should be included; do not expect a server-side API client to handle a browser Challenge page.
Monitor keeps existing JavaScript Detections running
JavaScript Detections (JSD) collect client-side signals in the browser. Cloudflare's documentation says JSD continues to run in Monitor mode, so a site can test Precursor without losing that existing coverage.
When switching to Arm, Cloudflare disables JSD on traffic where JSD was already in use to avoid running both features on the same traffic. Precursor takes over the detection coverage, while JSD-driven security rules still apply. Check the active mode and analytics before and after a change; collecting Monitor signals is not the same as enforcing a block.
Review signals in Security Analytics before changing modes
In the Cloudflare dashboard, select the target zone and open Security > Settings. Filter for Bot traffic or Precursor, choose Monitor, and then review the sitewide Interstitial setting and the scope of each rule.
Precursor detections appear in Security > Analytics > Traffic > Bot analysis. Review the hosts, paths and sessions producing signals, then follow your site's own testing process before switching to Arm or adding Challenge rules. Cloudflare does not promise that every session will be verified, and the cited documents do not state specific account eligibility, pricing or detection accuracy.
Sources
Frequently Asked Questions
Can visitors still see a Challenge in Monitor mode?
Monitor signals do not change bot scores or Challenge clearance, but the Interstitial is controlled separately. Visitors may still be challenged if the Interstitial is enabled sitewide or by a rule for their request.
Does Monitor disable my existing JavaScript Detections?
No. Cloudflare says JSD continues to run in Monitor mode. In Arm mode, Cloudflare disables JSD for traffic that was already using it to avoid running both detection systems on the same traffic.
Why did an API receive an HTML page after I enabled the Interstitial?
Requests without browser cookies, such as curl, mobile backend or server-to-server calls, can receive an Interstitial Challenge page. Check Interstitial Rules for the API hostname and path, then use Cloudflare's documented settings to turn the challenge off for that API scope. Do not treat the HTML page as a JSON API response.
Is Cloudflare Precursor Monitor available on every plan?
The cited release note and Precursor documentation do not specify plan eligibility or pricing. Check the target zone in Cloudflare and the documentation for your plan instead of assuming every account can use it.