JavaScript Is the Product, Not a Glitch

Every time a website tells you "JavaScript is disabled in your browser," you think you've hit a technical error — some broken script keeping you from loading the page. The fix is a button. You click it, JavaScript turns on, the page works.

Now here is the picture most investors carry around — and the part it deletes. That "JavaScript is disabled" message isn't a bug in the system. It's the system doing its job. Cloudflare (NYSE: NET) built an entire $112 billion business on the mechanism behind that message. And the company's CEO says this is barely started.

Put away the acronym for thirty seconds. Think about a nightclub.

The guard who watches the whole night

A bouncer stands at the door and checks IDs. That's how internet security used to work — a single checkpoint. One CAPTCHA. One login wall. Pass it, you're in.

But what happens when someone hires actors with fake IDs? Or what happens when thousands of fake IDs show up at once? The door bouncer doesn't know what happens after entry. He's blind to the crowd inside.

Now imagine a new kind of guard. Instead of checking the ID once, she watches how you move through the whole building. How you walk. Whether your body language matches a person who is actually there. She notices that some "guests" never pause, never blink, never respond to someone tapping their shoulder. She doesn't block the real guests. She just quietly removes the ones who can't mimic being human for more than a few seconds.

That is what Cloudflare does. And the "JavaScript is disabled" message is the guard asking you to walk into the light so she can see what you are.

Now label the props

• The JavaScript snippet = the guard's observation window. Cloudflare injects a lightweight piece of code into web pages. It runs invisibly in your browser and watches behavioral signals — mouse movement, scrolling rhythm, typing cadence, page focus.
• The "cf_clearance" cookie = the badge. If the code runs and your behavior looks human, your browser gets a clearance cookie. It lasts 15 minutes. After that, you get scanned again.
• The "JavaScript is disabled" message = the wall. If your browser can't run the code, or if the code detects non-human behavior, you hit the challenge. You are either a real person who needs to enable JavaScript, or a bot that can't fake being one.
• Cloudflare = the guard company that charges websites to keep the doors staffed.
• The websites paying Cloudflare = the nightclubs that can't afford a stampede of fakers crashing their event.

The trick is not in the code. It's in the scale. Cloudflare sits behind more than 20 percent of the entire web and analyzes over 1 trillion requests per day. They run nearly 3 billion verification challenges daily through their Turnstile system alone. That's not a security feature. That's a toll road.

The problem that makes their business bigger

Here's where the reader's old picture should become uncomfortable.

Most investors picture bot traffic as a problem Cloudflare will eventually solve — like a disease that gets cured. Once bots are stopped, the argument goes, the security bill comes down.

But bot traffic isn't being cured. It's the opposite. Non-human traffic exceeded human traffic for the first time in 2025. Today it accounts for roughly 57 percent of all web requests. More than half the activity on the internet is now machines.

And the company's CEO, Matthew Prince, thinks this is still early. On the Q2 2026 earnings call, Cloudflare's CFO projected that if current trends continue, non-human traffic could reach human traffic within five years. Humans would make up 0.1 percent of web activity — a rounding error.

This isn't because people are leaving the internet. It's because AI agents are flooding onto it. Agents that scrape content, make reservations, buy concert tickets, fill out forms, crawl data for training. They are, in Prince's words from the Q4 2025 call, "the new users of the internet".

For every customer that gets frustrated by a bot problem, Cloudflare doesn't lose a client. They gain one. The problem is their moat.

The small numbers

In the toy version, there are only three players and ten dollars.

A website earns $10 in ad revenue from real visitors. A bot farm sends 100 fake visitors. The website now has 100 times the server cost for the same $10. It pays Cloudflare $3 to filter out the fakes. The website now keeps $7 instead of losing $90 on server bills. Everyone wins. Cloudflare keeps the $3.

Now run the adverse path. Bot traffic grows 1,000-fold. The website would face 100,000 fake visitors. Server costs explode. Cloudflare's filter now charges $10. The website pays it because the alternative is bankruptcy. Cloudflare's revenue grows with the problem, not despite it.

Now replace the toy with the company's numbers

Cloudflare reported $696.1 million in Q2 2026 revenue — a 36 percent year-over-year increase. They ended the quarter with 4,698 customers paying over $100,000 annually, up 27 percent. Non-GAAP net income was $107.8 million, up 44 percent from the year-ago quarter.

For Q3 2026, they guided to $736–737 million in revenue — above the $732.6 million analyst consensus. Full-year 2026 guidance sits between $2.79 and $2.80 billion, above the $2.74 billion street estimate. Analyst scripts point to $5.4 billion in revenue and $581 million in earnings by 2029, implying roughly 29 percent annual growth.

They also just launched Precursor, a product that goes beyond the checkpoint and watches an entire browsing session continuously. If a bot can fake one moment, Precursor asks: can you fake 20 minutes of human behavior — the wrist pivot, the cognitive load, the micro-pauses? It's free through a trial period and then rolls into the Enterprise Bot Management suite. More precision, higher customer retention, stickier pricing.

That analogy has now done its job. Here is where it breaks.

The nightclub guard model works until you notice that real people sometimes have ad blockers, old browsers, or corporate firewalls that strip JavaScript. They hit the wall even though they're legitimate. Cloudflare handles this with "managed challenges" — softer gates that don't lock genuine users out. But the friction is real, and it's the eternal balancing act of security: protect the site without annoying the human.

The guard model also hides the fact that Cloudflare is simultaneously protecting websites against AI agents while also hosting AI agents on their Workers platform. They are the bouncer and the event promoter. About 2 million new developers are building AI workloads on Cloudflare this year alone. Nearly 80 percent of leading AI companies are Cloudflare customers. The company is trying to be the infrastructure layer for both sides of the fight. That's defensible — but it means their future depends on picking winners in the AI agent ecosystem, not just blocking bad traffic.

And the valuation is steep. At a market cap of $112 billion, Cloudflare trades at roughly 45 times trailing sales. The stock is up roughly 59 percent year-to-date. On a GAAP basis, the company still runs a loss — Q2 2026 showed a GAAP net loss of $170 million. Non-GAAP profitability is real and growing, but the stock price has front-run several years of that trajectory.

The question the stock returns to

If you remember one relationship, use this one: Cloudflare doesn't need to solve the bot problem to grow. They need it to persist — and they have strong reasons to believe it will. Their JavaScript detection, their behavioral analysis, their edge network — these are the pipes that every website relies on as the internet shifts from human clicks to machine activity.

The inspection question is straightforward. As non-human traffic scales, does Cloudflare's revenue growth keep pace with — or outpace — the traffic growth? If bot traffic grows 10 times but Cloudflare's revenue only grows 3 times, they're losing leverage. If revenue grows 15 times, they're monetizing the shift. The quarterly customer counts, large-customer additions, and pricing trends will tell you which path is happening.

The warning: understanding why Cloudflare's business grows as bots multiply doesn't mean the stock can't fall. A 45-times-sales multiple assumes the flywheel never stutters. It assumes hyperscalers don't build their own bot defenses. It assumes the AI agent economy actually scales to the levels Cloudflare's leadership projects. The mechanism is clear. The valuation prices certainty that hasn't arrived.