Gauging interest: optional paid bot access using x402 / Bot Guard

[zeeb0t]

Hi everyone,

I’m looking for some feedback on a possible future idea for XF Bot Guard.

As most forum owners know, automated traffic is becoming a much bigger issue. Some bots are useful, such as search crawlers. Some are unwanted scrapers. Some are AI crawlers or AI agents that may want to read, summarise, index, train on, or otherwise consume forum content.

Bot Guard already focuses on detecting and controlling automated traffic. The idea I’m considering is whether there should also be an optional way for forum owners to charge certain detected bots for access, rather than only allowing or blocking them.

What is x402?

x402 is an emerging payment protocol built around the HTTP 402 Payment Required response.

This is a standard protocol, and not to be confused with or depending on Cloudflare’s recently announced monetization gateway - which is their own implementation of x402.

In simple terms:

• A bot or automated client requests a page or resource.
• The site responds with “payment required” and provides machine-readable payment details.
• The bot or agent can choose to pay.
• If payment is valid, access is granted.

The interesting part is that x402 is designed for machine-to-machine payments, including AI agents that may have their own wallets or payment systems.

How this could relate to Bot Guard

One possible direction would be:

• Bot Guard detects automated access.
• The forum owner decides what policy applies.
• Humans continue browsing normally.
• Known search crawlers could still be allowed.
• Unwanted bots could still be blocked.
• Certain detected bots could be offered paid/licensed access instead.

This would not mean forcing every forum to charge bots.

It would be an optional feature, or possibly a separate add-on that requires Bot Guard, for admins who want to experiment with machine access licensing.

Possible use cases

• Charge AI crawlers or agents for access to forum content.
• Offer paid access to structured data or selected routes.
• Allow legitimate automated clients while blocking unknown/unlicensed scrapers.
• Create a clearer policy around machine access to forum content.
• Turn some bot traffic into a commercial option instead of a pure resource drain.

Important notes

This is only an idea at this stage.

I am not saying this will definitely be built, and I am not suggesting it would suit every forum. Many admins may prefer to simply block this kind of traffic, and that is completely valid.

I’m also not interested in adding complexity for the sake of it. If this is built, it would need to be practical, optional, and useful in the real world.

What I’d like to know

Would this kind of feature interest you?

• Would you ever want to charge bots, AI crawlers, or automated agents for access?
• Would you prefer this inside Bot Guard, or as a separate add-on that depends on Bot Guard?
• Would you use this only for specific routes/content, rather than the whole forum?
• Would you rather just block these bots entirely?
• Do you think forum owners would actually benefit from something like this?

I’m mainly trying to understand whether there is any real appetite for this before spending time exploring it further.

Interested to hear your thoughts.

 

[ES Dev Team]

It's interesting to me. I could use it as a way to fund my forum.
It should be inside bot guard.
I'd use it on the whole forum.
I'd like to block bots that don't pay.
I think this could be very beneficial to a lot of people. The only question is - would bot operators actually pat for content, or find new ways to circumvent it?

A good way to fund bot guard would be to take a 1-5% cut. Yeah, that involves coming up with payment infrastructure and such, but that work would pay for itself.

 

[zeeb0t]

It's interesting to me. I could use it as a way to fund my forum.
It should be inside bot guard.
I'd use it on the whole forum.
I'd like to block bots that don't pay.
I think this could be very beneficial to a lot of people. The only question is - would bot operators actually pat for content, or find new ways to circumvent it?

A good way to fund bot guard would be to take a 1-5% cut. Yeah, that involves coming up with payment infrastructure and such, but that work would pay for itself.

Thanks for the solid reply!

 

[azzurro]

Good idea! I've been interested in x402 for a while and was excited to learn that Cloudflare had announced some plans to integrate it on their end a year or so ago. Something the size of Cloudflare made sense as they could handle building out the payment infrastructure but I haven't heard any updates since. I have the 'Block on all pages' Cloudflare setting for blocking AI training bots but it does seem like crawlers are getting around it or they have crawled most of the site previously. As ES Dev Team mentioned it is questionable if bots would pay anything even if it was easy to set up, so perhaps that's why we haven't heard much from Cloudflare.

If a good implementation were out there, perhaps those AI bots that want the best information would be willing to pay! I'd much prefer this than relying on ads.

 

[zeeb0t]

If a good implementation were out there, perhaps those AI bots that want the best information would be willing to pay! I'd much prefer this than relying on ads.

Thanks for your reply!

The challenging part with AI bots, or any bot for that matter (aside from the ones you accept), is that they need to be blocked first, before they will be 'willing' to pay. Which is why they try so hard to be undetected!

That's the role Bot Guard plays, so it just seems like a natural extension of Bot Guard - or as an additional add-on, that it would work in concert with Bot Guard: once all checks exhaust and this is a bot we don't want - maybe they'll pay to access? And if they do, they can access the page they wanted. Otherwise, CAPTCHA / block.

 

[ES Dev Team]

Too bad you couldn't have them mining some kind of s***coin to submit the payment. The problem is it might cost you too much bandwidth to send them the software to perform said mining

 

[zeeb0t]

Too bad you couldn't have them mining some kind of s***coin to submit the payment. The problem is it might cost you too much bandwidth to send them the software to perform said mining

It’s funny, but this can actually be done - at least technically.

Monero is the obvious example because it is relatively CPU-friendly compared with a lot of other coins. So, in theory, a JS/WASM-capable bot sitting on a challenge page could be made to contribute compute while it attempts to solve.

The problem is the economics.

If you wanted it to be meaningful in ad terms, say roughly $1 per 1,000 page views, the bot would generally need to do something like:

1. Render JavaScript;
2. Keep the page open and compute for a long time - potentially close to an hour depending on hashrate;
3. Then maybe be granted access.

That last part is where it falls apart. Most bots probably won’t happily satisfy all three conditions. They’ll block the script, fail the environment checks, rotate away, or decide the target is not worth the cost.

Could thousands of JS-enabled bots hit a forum and sit there for 30–60 seconds at a time while contributing tiny amounts of mining revenue? Possibly.

Would it be meaningful income? Probably not unless the bot volume is enormous.

Would it be funny? Absolutely.

Would I make it the core monetisation model? No.

The cleaner model is still x402: pay a small amount for access, or don’t get the content. The “compute instead of payment” idea is more of a weird fallback/tarpit than a serious replacement for payment.

Also, the legal/ethical side matters. If a human user’s device is mining without clear disclosure and consent, that crosses into cryptojacking territory very quickly. So if anyone ever did this, it would need to be very explicitly disclosed, jurisdiction-checked, and carefully limited to traffic classified as automated/high-volume.

 

[Slavik]

To be brutally honest, I dont see any scrapers/bots/crawlers being willing to pay.

 

[zeeb0t]

To be brutally honest, I dont see any scrapers/bots/crawlers being willing to pay.

Generally I would agree. I do think, depending on the content/topic (e.g., my forum is in finance sector) they might. For instance, my users often post in-depth market research, technical analysis, and so on.

 

[ES Dev Team]

If you want bots to pay, the price should be cheap and if you're using crypto mining, the time be small, like 5-10 seconds.
$0.00001 for access for a day per unique IP address can add up if you can get them to pay by having the price be low.

It just needs to cost you less to deliver the WASM/JS payload.. maybe with a 100kb payload, that's possible.
Add a 33% profit margin of course

 

[smallwheels]

To be brutally honest, I dont see any scrapers/bots/crawlers being willing to pay.

Well, obviously. As until now everything was free as in free beer - they could just grab it and run away. However: With AI companies charging for the content they scraped and at the same time by offering the information stop people from visiting the pages they scraped the information from for free the economy is changing and has to change. It is more or less like classical media offered their content on the internet for free for 20 years, everyone got used to it and when at some point in time those media started to charge readers for their content on the net those were - surprisingly - not willing to pay as they were used to not having to. In the meantime, these models have started to be accepted. This will change with bots as well over time and having the technical infrastructure for it in beforehand is a necessity. The willingness to pay will come in the very moment when either it gives a competitive advantage (as they get more and better content) or they will be sued with massive fines when they circumvent payment while most potential quality sources demand payment.

 

[smallwheels]

If you want bots to pay, the price should be cheap and if you're using crypto mining, the time be small, like 5-10 seconds.
$0.00001 for access for a day per unique IP address can add up if you can get them to pay by having the price be low.

Well, I think it depends. Personally, I still don't like the idea of giving my content to an AI and even less the idea of being more or less forced to do so. Business models have very much changed from buying to licensing (see Netflix, Spotify and even connected services for your car etc.) - so why not license the content to AIs, so they have to pay for every month they keep it in their portfolio. I know that this is not how AI models currently work - what's in there once typically cannot be redacted. However: Why should I give away whatever can be scraped with in a day for a one time fee of 0.00001$ for unlimited commercial use and resale, while creating it took years? So I'd probably rise the payment bar so high that bots loose interest in scraping my page. If on the other hand they are willing to pay the virtual 100.000$ I charge for small set of pages - why not?

This way a payment model could contribute actively to lock AI bots out as they will not be willing to pay the price and on the other hand if they circumvent payment there is a solid foundation to sue them. Which will be easier if you do have unique content and information to offer and all of a sudden find it within an AI model that never paid for it.

So what would be necessary would be for one to set a price yourself, second to select, wich of your pages or content you offer at all and which not and possibly what your license terms are and whome you are willing to sell to and who's excluded. The "buyer" on the other hand has to be transparent, so that you know who has the right to use your content.

I've not read the docs for the AI-bot payment model but assume, that all of that is not the case. The idea is a simple model where you get some peanuts for your content while completely loosing control over it. Therefor I am not really interested in playing this game.

 

[duderuud]

Sounds interesting! But as said before here, I don't think it will generate much income unfortunately...

 

[Faust]

definitely interesting, but I doubt it will be making significant amount of money. Same with Google ads

 

[akok]

If this method can save even 1% of the budget and not disturb users and forum guests, then it’s a worthy undertaking...

 

[akok]

Announcing the Monetization Gateway: charge for any resource behind Cloudflare via x402

We're opening the waitlist for our Monetization Gateway, which will allow you to charge for any web page, dataset, API, or MCP tool behind Cloudflare. The charges will settle in stablecoins over the x402 open protocol, with no payments stack of your own to build.

blog.cloudflare.com

So it turns out that it remains to be implemented for those who don't use Cloudflare?