Skip to content

Commit 93fe763

Browse files
copy edits
1 parent d617465 commit 93fe763

File tree

10 files changed

+18
-52
lines changed

10 files changed

+18
-52
lines changed

src/content/docs/cloudflare-challenges/challenge-types/challenge-pages/index.mdx

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,20 @@ The level of interactivity and visibility of the Challenge Page depends on the A
1616

1717
## Actions
1818

19-
The following Challenge types are the available Actions when you create a WAF rule for a Challenge Page.
19+
The following Challenge types are the available actions when you create a WAF rule for a Challenge Page.
2020

2121
### Managed Challenge (recommended)
2222

2323
Managed Challenges are where Cloudflare dynamically chooses the appropriate type of challenge served to the visitor based on the characteristics of a request from the signals indicated by their browser. This helps avoid [CAPTCHAs](https://www.cloudflare.com/learning/bots/how-captchas-work/), which also reduces the lifetimes of human time spent solving CAPTCHAs across the Internet.
2424

25-
Most human visitors are automatically verified and will see Successful on the Challenge Page. However, if Cloudflare detects non-human attributes from the visitors browser, they may be required to interact with the Challenge to solve it.
25+
Most human visitors are automatically verified and will see **Successful** on the Challenge Page. However, if Cloudflare detects non-human attributes from the visitor's browser, they may be required to interact with the Challenge to solve it.
2626

2727
Unless there are specific compatibility issues or other reasons to use other types of Challenges, Cloudflare recommends you to use Managed Challenges for your custom rules.
2828

2929
:::caution
3030
Using Cloudflare Challenges along with Rules features may cause Challenge loops. Refer to [Rules troubleshooting](/rules/reference/troubleshooting/) for more information.
3131
:::
3232

33-
3433
### Interactive Challenge
3534

3635
Interactive Challenge Pages offer the highest security for your website or application because it requires a visitor to interact with the Interstitial Challenge Page, presenting the visitor with an interactive challenge to solve.

src/content/docs/cloudflare-challenges/challenge-types/turnstile.mdx

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ sidebar:
77

88
import { Render } from "~/components";
99

10-
[Turnstile](/turnstile/) is Cloudflares CAPTCHA-alternative solution. You can embed Turnstile as a widget on your website or application, where it runs a client-side Challenge directly in the background of the visitors browser.
10+
[Turnstile](/turnstile/) is Cloudflare's CAPTCHA-alternative solution. You can embed Turnstile as a widget on your website or application, where it runs a client-side Challenge directly in the background of the visitor's browser.
1111

12-
Turnstile differs from Challenges Pages in that the Challenge does not pause the request or interrupt the users experience. Since the widget is embedded onto the webpage and only runs on a specific part of the HTML, the visitor will have already arrived at the destination URL and is viewing the page when they encounter a Turnstile widget. Instead of blocking the visitor from accessing the entire website, the Turnstile widget prevents the visitor from certain actions such as completing login or sign up forms, and more, until the widget is solved.
12+
Turnstile differs from Challenges Pages in that the Challenge does not pause the request or interrupt the user's experience. Since the widget is embedded onto the webpage and only runs on a specific part of the HTML, the visitor will have already arrived at the destination URL and is viewing the page when they encounter a Turnstile widget. Instead of blocking the visitor from accessing the entire website, the Turnstile widget prevents the visitor from certain actions such as completing login or sign up forms, and more, until the widget is solved.
1313

1414
In most cases, nothing further is required from the visitor. However, if necessary, Turnstile may display a simple checkbox that the visitor must click to proceed.
1515

@@ -21,11 +21,11 @@ After the Challenge passes, Turnstile issues a clearance token to the visitor th
2121

2222
While there are three types of widgets that you can choose to implement on your website or application, the Challenge logic behind them remains the same.
2323

24-
- **Managed (recommended)**: Functions similar to a Managed Challenge Page. It selects a Challenge based on the signals gathered from the visitors browser and presents an interaction only if it detects potentially automated traffic.
24+
- **Managed (recommended)**: Functions similar to a Managed Challenge Page. It selects a Challenge based on the signals gathered from the visitor's browser and presents an interaction only if it detects potentially automated traffic.
2525

2626
- **Non-Interactive**: The visitor can see the widget, but does not need to interact with it to verify their identity.
2727

28-
- **Invisible**: The widget is completely invisible from the visitor, but the Challenge still runs in the background.
28+
- **Invisible**: The widget is completely invisible to the visitor, but the Challenge still runs in the background.
2929

3030
## Implementation
3131

src/content/docs/cloudflare-challenges/concepts/how-challenges-work.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ Challenges can be issued in three primary ways depending on which Cloudflare pro
1717
| [HTTP DDoS attack protection](/ddos-protection/managed-rulesets/http/) | Any Challenge |
1818
| [Under Attack Mode](/fundamentals/reference/under-attack-mode/) | [Managed Challenge](/cloudflare-challenges/challenge-types/challenge-pages/#managed-challenge-recommended) |
1919

20-
Challenge Pages and Turnstile rely on the same underlying mechanism to issue challenges to your website or applications visitors.
20+
Challenge Pages and Turnstile rely on the same underlying mechanism to issue challenges to your website or application's visitors.
2121

22-
JavaScript detections support Cloudflares Enterprise Bot Management. While it still relies on client-side detections, JavaScript detections function using a more performant challenge logic than Challenge Pages or Turnstile.
22+
JavaScript detections support Cloudflare's Enterprise Bot Management. While it still relies on client-side detections, JavaScript detections function using a more performant challenge logic than Challenge Pages or Turnstile.
2323

2424
---
2525

src/content/docs/cloudflare-challenges/frequently-asked-questions.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large
8585

8686
Previously, unless you customize your front-end application, any AJAX request that is challenged will fail because AJAX calls are not rendered in the DOM.
8787

88-
Now, you can [opt-in to Turnstiles Pre-Clearance cookies](/turnstile/concepts/pre-clearance-support/). This allows you to issue a challenge early in your web application flow and pre-clear users to interact with sensitive APIs. Clearance cookies issued by a Turnstile widget are automatically applied to the Cloudflare zone that the Turnstile widget is embedded on, with no configuration necessary. The duration of the clearance cookies validity is controlled by the zone-specific configurable [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage) security setting.
88+
Now, you can [opt-in to Turnstile's Pre-clearance cookies](/turnstile/concepts/pre-clearance-support/). This allows you to issue a challenge early in your web application flow and pre-clear users to interact with sensitive APIs. Clearance cookies issued by a Turnstile widget are automatically applied to the Cloudflare zone that the Turnstile widget is embedded on, with no configuration necessary. The duration of the clearance cookie's validity is controlled by the zone-specific configurable [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage) security setting.
8989

9090
## Why would I not find any failed challenges?
9191

Lines changed: 2 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,8 @@
11
---
22
title: Pre-clearance support
33
pcx_content_type: reference
4+
external_link: /cloudflare-challenges/concepts/clearance/#pre-clearance-support-in-turnstile
45
sidebar:
56
order: 3
67

7-
---
8-
9-
Pre-clearance in Turnstile allows websites to streamline user experiences by using clearance cookies. These cookies enable visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
10-
11-
You can integrate Cloudflare challenges by allowing Turnstile to issue a pre-clearance cookie. The pre-clearance level is set upon widget creation or widget modification using the Turnstile API's `clearance_level`. Possible values for the configuration are:
12-
13-
- `no_clearance`
14-
- `jschallenge`
15-
- `managed`
16-
- `interactive`
17-
18-
All widgets are set to `no_clearance` by default.
19-
20-
For Enterprise customers eligible to toggle off domain checks, Cloudflare recommends issuing pre-clearance cookies on widgets where at least one domain is specified.
21-
22-
:::note
23-
24-
Clearance cookies only support zones that are orange-clouded.
25-
:::
26-
27-
Refer to the [blog post](https://blog.cloudflare.com/integrating-turnstile-with-the-cloudflare-waf-to-challenge-fetch-requests) for more details on how pre-clearance works with WAF.
28-
29-
## Pre-clearance level options
30-
31-
- **Interactive (High)**: Allows a user with a clearance cookie to not be challenged by Interactive, Managed Challenge, or JavaScript Challenge Firewall Rules
32-
- **Managed (Medium)**: Allows a user with a clearance cookie to not be challenged by Managed Challenge or JavaScript Challenge Firewall Rules
33-
- **Non-interactive (Low)**: Allows a user with a clearance cookie to not be challenged by JavaScript Challenge Firewall Rules
34-
35-
## Clearance cookie duration
36-
37-
Clearance cookies generated by the Turnstile widget will be valid for the time specified by the zone-level Challenge Passage value. To configure the Challenge Passage setting, refer to the [Challenges documentation](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage).
38-
39-
## Setup
40-
41-
To set up pre-clearance cookies, refer to [Enable pre-clearance cookies](/turnstile/get-started/pre-clearance/).
8+
---

src/content/docs/turnstile/get-started/mobile-implementation.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ sidebar:
88

99
Turnstile is designed to run in a standard browser environment, which includes mobile devices. On native mobile applications, Turnstile can be used with WebViews. This applies to native web applications for iOS and Android. When implementing Turnstile for mobile, ensure you address the common issues below to avoid integration problems.
1010

11-
Any modifications to the environment, such as the User Agent, [Content Security Policy settings](/turnstile/reference/content-security-policy/), or domain allowlisting, can disrupt the successful completion of Turnstile challenges. To ensure compatibility, it is recommended to start with a default, unmodified environment and gradually introduce changes, validating Turnstiles functionality after each adjustment.
11+
Any modifications to the environment, such as the User Agent, [Content Security Policy settings](/turnstile/reference/content-security-policy/), or domain allowlisting, can disrupt the successful completion of Turnstile challenges. To ensure compatibility, it is recommended to start with a default, unmodified environment and gradually introduce changes, validating Turnstile's functionality after each adjustment.
1212

1313

1414
## WebView configurations
@@ -46,4 +46,4 @@ If pre-clearance is done in a different environment, the clearance cookie may be
4646

4747
## Use Flutter with Turnstile
4848

49-
For developers using [Flutter](https://pub.dev/packages/flutter_inappwebview), Turnstile is compatible and tested with Flutters WebView implementation. Refer to the official Flutter WebView package for more details and usage.
49+
For developers using [Flutter](https://pub.dev/packages/flutter_inappwebview), Turnstile is compatible and tested with Flutter's WebView implementation. Refer to the official Flutter WebView package for more details and usage.

src/content/docs/turnstile/get-started/server-side-validation.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import { GlossaryTooltip, Render, TabItem, Tabs } from "~/components";
1111

1212
Turnstile needs to be verified using Siteverify because it is a front-end widget that creates a token which is cryptographically secured. To ensure that a token is not forged by an attacker or has not been consumed yet, it is necessary to check the validity of a token using Cloudflare's Siteverify API.
1313

14-
You must call the Siteverify endpoint to validate the Turnstile widget response from your websites backend. The widget response must only be considered valid once it has been verified by the Siteverify endpoint. The presence of a response alone is not enough to verify it as it does not protect from replay or forgery attacks. In some cases, Turnstile may purposely create invalid responses that are rejected by the Siteverify API.
14+
You must call the Siteverify endpoint to validate the Turnstile widget response from your website's backend. The widget response must only be considered valid once it has been verified by the Siteverify endpoint. The presence of a response alone is not enough to verify it as it does not protect from replay or forgery attacks. In some cases, Turnstile may purposely create invalid responses that are rejected by the Siteverify API.
1515

1616
Tokens issued to Turnstile using the success callbacks, via explicit or implicit rendering, must be validated using the Siteverify endpoint. The Siteverify API will only validate a token once. If a token has already been checked, the Siteverify API will yield an error on subsequent verification attempts indicating that a token has already been consumed.
1717

@@ -244,7 +244,7 @@ async function handlePost(request) {
244244
The `remoteip` parameter helps to prevent abuse by ensuring the current visitor is the one who received the token. This is currently not strictly validated.
245245
:::
246246

247-
The Siteverify endpoint behaves similar to reCAPTCHAs or hCaptcha's Siteverify endpoint.
247+
The Siteverify endpoint behaves similar to reCAPTCHA's or hCaptcha's Siteverify endpoint.
248248
The API accepts `application/x-www-form-urlencoded` and `application/json` requests, but the response type will always be `application/json`.
249249

250250
It always contains a `success` property, either true or false, indicating whether the operation was successful or not.

src/content/docs/turnstile/index.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ import {
2020

2121
<Description>
2222

23-
Cloudflares smart CAPTCHA alternative.
23+
Cloudflare's smart CAPTCHA alternative.
2424

2525
</Description>
2626

src/content/docs/turnstile/reference/workers-templates/price-scraping.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ async function getPrice(token){
7373
);
7474
// await price information from pricing endpoint
7575
const price = await response.json();
76-
// set the pricing information to whats returned in the callback
76+
// set the pricing information to what's returned in the callback
7777
priceBox.innerText = price.pricing
7878
}
7979
function init(){

src/content/docs/turnstile/troubleshooting/client-side-errors/error-codes.mdx

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ When an error code is marked with `***`, it means that the remaining numbers can
1818
| ----------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
1919
| `100***` | Initialization Problems: There was a problem initializing Turnstile before a challenge could be started. | No | This could be caused by an old instance of the challenge that was solved. It is advised to reload the page and restart Turnstile. On continuous failures, this is indicative of an automated device. |
2020
| `102***` | Invalid Parameters: The visitor sent an invalid parameter as part of the challenge towards Turnstile. | Yes | It is advised to retry the challenge. On continuous failures, this is indicative of an automated device. |
21-
| `102***`<br/>`103***`<br/>`104***`<br/>`106***` | Invalid Parameters: The visitor sent an invalid parameter as part of the challenge towards Turnstile. | Yes | It is advised to retry the challenge. On continuous failures, this is indicative of an automated device and you must verify the visitors authenticity by other means. |
21+
| `102***`<br/>`103***`<br/>`104***`<br/>`106***` | Invalid Parameters: The visitor sent an invalid parameter as part of the challenge towards Turnstile. | Yes | It is advised to retry the challenge. On continuous failures, this is indicative of an automated device and you must verify the visitor's authenticity by other means. |
2222
| `105***` | Turnstile API Compatibility: Turnstile was invoked in a deprecated or invalid way. | No | It is advised to refer to the [Turnstile documentation](/turnstile/) again and refresh the page to obtain the most recent Turnstile version. |
2323
| `110100` <br/> `110110` | Invalid <GlossaryTooltip term="sitekey">sitekey</GlossaryTooltip>: Turnstile was invoked with an invalid sitekey or a sitekey that is no longer active. | No | Verify if the sitekey provided is still active via the [Cloudflare dashboard](https://dash.cloudflare.com/). |
2424
| `110200` | Unknown domain: Domain not allowed. | No | Turnstile was used on a domain that was not allowed for this widget to be used on. Ensure that the domain is allowed in the widget configuration via the [Cloudflare dashboard](https://dash.cloudflare.com/). |

0 commit comments

Comments
 (0)