You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Challenges can be issued in three primary ways depending on which Cloudflare products or features are in use. Each method is designed to balance security with seamless visitor experience.
[Turnstile](/turnstile/) is Cloudflare’s CAPTCHA-alternative solution. You can embed Turnstile as a widget on your site, where it runs a challenge directly in the visitor’s browser.
22
+
23
+
Turnstile does not pause the request or interrupt the user’s experience. Instead, the widget runs a client-side challenge in the background. In most cases, nothing further is required from the visitor. When needed, Turnstile may display a simple checkbox that the visitor must click to proceed.
24
+
25
+
After the challenge passes, Turnstile issues a token that you must validate using the [siteverify API](/turnstile/get-started/server-side-validation/) before completing a sensitive action like login, sign up, or other form submissions.
26
+
27
+
### Interstitial challenge pages
28
+
29
+
When a challenge is triggered by a rule in the [Web Application Firewall (WAF)](/waf/), [Bot Management](/bots/), or [Rate Limiting](/waf/rate-limiting-rules/), Cloudflare presents a full-page interstitial challenge page. The request is paused while Cloudflare evaluates the browser environment. In some cases, the visitor may be asked to check a box for further probing.
30
+
31
+
If the challenge passes, the original request continues to your origin. If the challenge fails or cannot be completed, the visitor is presented with another interstitial challenge page.
32
+
33
+
### JavaScript detection in Bot Management
34
+
35
+
In Bot Management, [JavaScript detections](/bots/additional-configurations/javascript-detections/) run silently in the browser to validate that the visitor supports and executes standard browser JavaScript, and provides a lightweight and privacy-preserving way to distinguish between bots and real users without adding friction to the experience.
36
+
37
+
:::note
38
+
If the check fails, the bot score is set to 1.
39
+
:::
40
+
41
+
The script runs a short set of tasks and, if successful, sets a `cf_clearance` cookie indicating that the visitor passed the check. This is exposed as the `cf.bot_management.js_detection.passed` field that you can use in [WAF custom rules](/waf/custom-rules/) to take further action — such as issuing an interstitial challenge page.
42
+
43
+
If a visitor was unable to run JavaScript detection, the `cf.bot_management.js_detection.passed` field is set to `False`. Cloudflare advises that you should never block a request based on this field unless you are certain that the visitor has run JavaScript detections.
44
+
45
+
---
46
+
47
+
## Limitations
48
+
49
+
Cloudflare challenges cannot support the following:
50
+
51
+
-[Browser extensions](#browser-extensions) that modify the browser's `User-Agent` value or Web APIs such as `Canvas` and `WebGL`.
52
+
- Implementations where a domain serves a challenge page originally requested for another domain.
53
+
- Challenge pages cannot be embedded in cross-origin iframes.
54
+
- Client software where the solve request of a Managed Challenge comes from a different IP than the original IP a challenge request was issued to. For example, if you receive the challenge from one IP and solve it using another IP, the solve is not valid and you may encounter a challenge loop.
A challenge is a security mechanism that Cloudflare uses to verify whether a visitor to your site is a real human and not a bot or automated script.
10
+
<Description>
11
+
Challenges are security mechanisms used by Cloudflare to verify whether a visitor to your site is a real human and not a bot or automated script.
12
+
</Description>
13
+
14
+
<Plantype="all" />
11
15
12
16
When a challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor’s legitimacy. This process involves evaluating client side signals or asking a visitor to take minimal action such as checking a box. Challenges are designed to protect your application without introducing unnecessary friction. Most visitors will pass challenges automatically without interaction.
13
17
14
18
Cloudflare does not use CAPTCHA puzzles or visual tests like selecting objects or typing distorted characters. All challenge types are lightweight, privacy-preserving, and optimized for real-world traffic.
15
19
16
-
## How challenges work
17
-
18
-
Challenges can be issued in three primary ways depending on which Cloudflare products or features are in use. Each method is designed to balance security with seamless visitor experience.
[Turnstile](/turnstile/) is Cloudflare’s CAPTCHA-alternative solution. You can embed Turnstile as a widget on your site, where it runs a challenge directly in the visitor’s browser.
32
-
33
-
Turnstile does not pause the request or interrupt the user’s experience. Instead, the widget runs a client-side challenge in the background. In most cases, nothing further is required from the visitor. When needed, Turnstile may display a simple checkbox that the visitor must click to proceed.
34
-
35
-
After the challenge passes, Turnstile issues a token that you must validate using the [siteverify API](/turnstile/get-started/server-side-validation/) before completing a sensitive action like login, sign up, or other form submissions.
36
-
37
-
### Interstitial challenge pages
38
-
39
-
When a challenge is triggered by a rule in the [Web Application Firewall (WAF)](/waf/), [Bot Management](/bots/), or [Rate Limiting](/waf/rate-limiting-rules/), Cloudflare presents a full-page interstitial challenge page. The request is paused while Cloudflare evaluates the browser environment. In some cases, the visitor may be asked to check a box for further probing.
40
-
41
-
If the challenge passes, the original request continues to your origin. If the challenge fails or cannot be completed, the visitor is presented with another interstitial challenge page.
42
-
43
-
### JavaScript detection in Bot Management
44
-
45
-
In Bot Management, [JavaScript detections](/bots/additional-configurations/javascript-detections/) run silently in the browser to validate that the visitor supports and executes standard browser JavaScript, and provides a lightweight and privacy-preserving way to distinguish between bots and real users without adding friction to the experience.
46
-
47
-
:::note
48
-
If the check fails, the bot score is set to 1.
49
-
:::
50
-
51
-
The script runs a short set of tasks and, if successful, sets a `cf_clearance` cookie indicating that the visitor passed the check. This is exposed as the `cf.bot_management.js_detection.passed` field that you can use in [WAF custom rules](/waf/custom-rules/) to take further action — such as issuing an interstitial challenge page.
20
+
---
52
21
53
-
If a visitor was unable to run JavaScript detection, the `cf.bot_management.js_detection.passed` field is set to `False`. Cloudflare advises that you should never block a request based on this field unless you are certain that the visitor has run JavaScript detections.
Get automatic protection from vulnerabilities and the flexibility to create
35
+
custom rules.
36
+
</RelatedProduct>
60
37
61
-
-[Browser extensions](#browser-extensions) that modify the browser's `User-Agent` value or Web APIs such as `Canvas` and `WebGL`.
62
-
- Implementations where a domain serves a challenge page originally requested for another domain.
63
-
- Challenge pages cannot be embedded in cross-origin iframes.
64
-
- Client software where the solve request of a Managed Challenge comes from a different IP than the original IP a challenge request was issued to. For example, if you receive the challenge from one IP and solve it using another IP, the solve is not valid and you may encounter a challenge loop.
0 commit comments