You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-challenges/challenge-types/challenge-pages/detect-response.mdx
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,10 +7,10 @@ sidebar:
7
7
8
8
## Detect a Challenge Page response
9
9
10
-
When a request encounters a Cloudflare Challenge Page instead of the originally anticipated response, the Challenge Page response (regardless of the Challenge Page type) will have the `cf-mitigated` header present and set to `challenge`. This header can be leveraged to detect if a response was challenged when making fetch/XHR requests. This header provides a reliable way to identify whether a response is a challenge or not, enabling a web application to take appropriate action based on the result. For example, a front-end application encountering a response from the backend may check the presence of this header value to handle cases where Challenge Pages encountered unexpectedly.
10
+
When a request encounters a Cloudflare Challenge Page instead of the originally anticipated response, the Challenge Page response (regardless of the Challenge Page type) will have the `cf-mitigated` header present and set to `challenge`. This header can be leveraged to detect if a response was challenged when making fetch/XHR requests. This header provides a reliable way to identify whether a response is a Challenge or not, enabling a web application to take appropriate action based on the result. For example, a front-end application encountering a response from the backend may check the presence of this header value to handle cases where Challenge Pages encountered unexpectedly.
11
11
12
12
:::note
13
-
Regardless of the requested resource-type, the content-type of a challenge will be `text/html`.
13
+
Regardless of the requested resource-type, the content-type of a Challenge will be `text/html`.
14
14
:::
15
15
16
16
For the `cf-mitigated` header, `challenge` is the only valid value. The header is set for all Challenge Page types.
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-challenges/challenge-types/challenge-pages/index.mdx
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,7 +20,7 @@ The following Challenge types are the available actions when you create a WAF ru
20
20
21
21
### Managed Challenge (recommended)
22
22
23
-
Managed Challenges are where Cloudflare dynamically chooses the appropriate type of challenge served to the visitor based on the characteristics of a request from the signals indicated by their browser. This helps avoid [CAPTCHAs](https://www.cloudflare.com/learning/bots/how-captchas-work/), which also reduces the lifetimes of human time spent solving CAPTCHAs across the Internet.
23
+
Managed Challenges are where Cloudflare dynamically chooses the appropriate type of Challenge served to the visitor based on the characteristics of a request from the signals indicated by their browser. This helps avoid [CAPTCHAs](https://www.cloudflare.com/learning/bots/how-captchas-work/), which also reduces the lifetimes of human time spent solving CAPTCHAs across the Internet.
24
24
25
25
Most human visitors are automatically verified and will see **Successful** on the Challenge Page. However, if Cloudflare detects non-human attributes from the visitor's browser, they may be required to interact with the Challenge to solve it.
26
26
@@ -32,7 +32,7 @@ Using Cloudflare Challenges along with Rules features may cause Challenge loops.
32
32
33
33
### Interactive Challenge
34
34
35
-
Interactive Challenge Pages offer the highest security for your website or application because it requires a visitor to interact with the Interstitial Challenge Page, presenting the visitor with an interactive challenge to solve.
35
+
Interactive Challenge Pages offer the highest security for your website or application because it requires a visitor to interact with the Interstitial Challenge Page, presenting the visitor with an Interactive Challenge to solve.
36
36
37
37
For more information about why Cloudflare does not recommend using Interactive Challenge, in favor of Managed Challenge, refer to our [blog post](https://blog.cloudflare.com/end-cloudflare-captcha/).
38
38
@@ -42,4 +42,4 @@ With a JavaScript (JS) Challenge, Cloudflare makes the determination on whether
42
42
43
43
The visitor must wait until their browser finishes processing the JavaScript, which typically takes less than five seconds.
44
44
45
-
If the visitor passes the Challenge, the original request continues to the destination URL. If the Challenge fails or cannot be completed, the visitor is presented with another interstitial Challenge page.
45
+
If the visitor passes the Challenge, the original request continues to the destination URL. If the Challenge fails or cannot be completed, the visitor is presented with another Interstitial Challenge Page.
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-challenges/concepts/clearance.mdx
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -8,19 +8,19 @@ import { Render } from "~/components";
8
8
9
9
## `cf-clearance` cookies
10
10
11
-
A `cf-clearance` cookie proves to Cloudflare that the visitor is a verified human and has passed the challenge presented to them.
11
+
A `cf-clearance` cookie proves to Cloudflare that the visitor is a verified human and has passed the Challenge presented to them.
12
12
13
-
If a visitor passes an interactive challenge (highest security level), then the `cf-clearance` cookie indicates this to the origin and allows the visitor to bypass any other challenge on the website, whether it is another interactive challenge, a managed challenge, or a non-interactive JavaScript challenge for as long as the cookie is valid.
13
+
If a visitor passes an Interactive Challenge (highest security level), then the `cf-clearance` cookie indicates this to the origin and allows the visitor to bypass any other Challenge on the website, whether it is another Interactive Challenge, a Managed Challenge, or a non-interactive JavaScript Challenge for as long as the cookie is valid.
14
14
15
-
If a visitor receives a `cf-clearance` cookie on a page that uses a WAF rule with managed or JavaScript challenge (lower security levels), then encountering a different page with a higher security clearance level challenge will prompt them to solve the challenge again.
15
+
If a visitor receives a `cf-clearance` cookie on a page that uses a WAF rule with Managed or JavaScript Challenge (lower security levels), then encountering a different page with a higher security clearance level Challenge will prompt them to solve the Challenge again.
16
16
17
-
The original `cf-clearance` cookie that was issued to the visitor from a lower security clearance level challenge will be replaced with the new `cf-clearance` cookie from a higher security clearance level challenge.
17
+
The original `cf-clearance` cookie that was issued to the visitor from a lower security clearance level Challenge will be replaced with the new `cf-clearance` cookie from a higher security clearance level Challenge.
18
18
19
19
## Pre-clearance support in Turnstile
20
20
21
-
Pre-clearance in [Turnstile](/turnstile/) allows websites to streamline user experiences by using `cf-clearance` cookies. The `cf-clearance` cookie enables visitors to bypass WAF challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
21
+
Pre-clearance in [Turnstile](/turnstile/) allows websites to streamline user experiences by using `cf-clearance` cookies. The `cf-clearance` cookie enables visitors to bypass WAF Challenges downstream, based on the security clearance level set by the customer. This can be particularly useful for trusted visitors, enhancing usability while maintaining security.
22
22
23
-
By default, Turnstile issues a one-time use token to the visitor when they solve a challenge via the widget. The token goes to your website's backend that needs to be validated by Siteverify API.
23
+
By default, Turnstile issues a one-time use token to the visitor when they solve a Challenge via the widget. The token goes to your website's backend that needs to be validated by Siteverify API.
Challenge Pages and Turnstile rely on the same underlying mechanism to issue challenges to your website or application's visitors.
20
+
Challenge Pages and Turnstile rely on the same underlying mechanism to issue Challenges to your website or application's visitors.
21
21
22
22
JavaScript detections support Cloudflare's Enterprise Bot Management. While it still relies on client-side detections, JavaScript detections function using a more performant challenge logic than Challenge Pages or Turnstile.
Copy file name to clipboardExpand all lines: src/content/docs/cloudflare-challenges/frequently-asked-questions.mdx
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,16 +7,16 @@ sidebar:
7
7
8
8
## Why am I being challenged on a Cloudflare-protected site?
9
9
10
-
Cloudflare issues challenges to website visitors to protect against malicious activity such as bot attacks and DDoS attacks. Key reasons include:
10
+
Cloudflare issues Challenges to website visitors to protect against malicious activity such as bot attacks and DDoS attacks. Key reasons include:
11
11
12
-
-**High threat score**: IP addresses with a high-risk score trigger challenges.
12
+
-**High threat score**: IP addresses with a high-risk score trigger Challenges.
13
13
-**IP reputation**: If your IP has a history of suspicious activity, it may be flagged.
14
14
-**Bot detection**: Automated traffic resembling bots is filtered by Cloudflare.
15
15
-**Web Application Firewall (WAF) custom rules**: Site owners may set rules targeting specific regions or user agents.
16
16
-**Browser Integrity Check**: Cloudflare verifies that browsers meet certain standards.
17
-
-**Challenge Passage**: Technologies like Privacy Pass reduce the frequency of repeated challenges.
17
+
-**Challenge Passage**: Technologies like Privacy Pass reduce the frequency of repeated Challenges.
18
18
19
-
To avoid repeated challenges, ensure your browser is up to date, disable any privacy tools that might block standard browser headers, or use a different network connection if your current one has a poor IP reputation.
19
+
To avoid repeated Challenges, ensure your browser is up to date, disable any privacy tools that might block standard browser headers, or use a different network connection if your current one has a poor IP reputation.
20
20
21
21
## How do I exclude certain requests from being blocked or challenged?
22
22
@@ -25,7 +25,7 @@ In certain situations you want to enforce a blocking or challenging action but m
25
25
Cloudflare supports two methods of allowing requests using WAF custom rules:
26
26
27
27
- Exclude a type of request from being blocked or challenged in a custom rule by updating the rule expression, for example adding an exclusion based on IP address, ASN, or country.
28
-
- Create a separate custom rule with a [_Skip_ action](/waf/custom-rules/skip/). This skip rule must appear before the rule with the block/challenge action in the rules list.
28
+
- Create a separate custom rule with a [_Skip_ action](/waf/custom-rules/skip/). This skip rule must appear before the rule with the block or challenge action in the rules list.
29
29
30
30
The examples below illustrate a few possible approaches.
31
31
@@ -85,33 +85,33 @@ Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large
85
85
86
86
Previously, unless you customize your front-end application, any AJAX request that is challenged will fail because AJAX calls are not rendered in the DOM.
87
87
88
-
Now, you can [opt-in to Turnstile's Pre-clearance cookies](/turnstile/concepts/pre-clearance-support/). This allows you to issue a challenge early in your web application flow and pre-clear users to interact with sensitive APIs. Clearance cookies issued by a Turnstile widget are automatically applied to the Cloudflare zone that the Turnstile widget is embedded on, with no configuration necessary. The duration of the clearance cookie's validity is controlled by the zone-specific configurable [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage) security setting.
88
+
Now, you can [opt-in to Turnstile's Pre-clearance cookies](/turnstile/concepts/pre-clearance-support/). This allows you to issue a Challenge early in your web application flow and pre-clear users to interact with sensitive APIs. Clearance cookies issued by a Turnstile widget are automatically applied to the Cloudflare zone that the Turnstile widget is embedded on, with no configuration necessary. The duration of the clearance cookie's validity is controlled by the zone-specific configurable [Challenge Passage](/cloudflare-challenges/challenge-types/challenge-pages/#challenge-passage) security setting.
89
89
90
-
## Why would I not find any failed challenges?
90
+
## Why would I not find any failed Challenges?
91
91
92
-
Users do not complete all challenges. Cloudflare issues challenges that are never answered — only 2-3% of all served challenges are usually answered.
92
+
Users do not complete all Challenges. Cloudflare issues Challenges that are never answered — only 2-3% of all served Challenges are usually answered.
93
93
94
94
There are multiple reasons for this:
95
95
96
-
- Users give up on a challenge.
97
-
- Users try to solve a challenge but cannot provide an answer.
98
-
- Users keep refreshing the challenge, but never submit an answer.
99
-
- Cloudflare receives a malformed challenge answer.
96
+
- Users give up on a Challenge.
97
+
- Users try to solve a Challenge but cannot provide an answer.
98
+
- Users keep refreshing the Challenge, but never submit an answer.
99
+
- Cloudflare receives a malformed Challenge answer.
100
100
101
-
You can calculated the number of failed challenges as follows: `number of challenges issued - number of challenges solved`.
101
+
You can calculated the number of failed Challenges as follows: `number of Challenges issued - number of Challenges solved`.
102
102
103
103
## Why do I have matches for a firewall rule that was not supposed to match the request?
104
104
105
105
Make sure you are looking at the correct request.
106
106
107
-
Only requests that triggered a challenge will match the request parameters of the rule. Subsequent requests with a `[js]challengeSolved` action may not match the parameters of the rule — for example, the bot score may have changed because the user solved a challenge.
107
+
Only requests that triggered a Challenge will match the request parameters of the rule. Subsequent requests with a `[js]challengeSolved` action may not match the parameters of the rule — for example, the bot score may have changed because the user solved a Challenge.
108
108
109
-
The "solved" action is an informative action about a previous request that matched a rule. This action states that "previously a rule had matched a request with the action set to _Interactive Challenge_ or _JS Challenge_ and now that challenge was answered."
109
+
The "solved" action is an informative action about a previous request that matched a rule. This action states that "previously a rule had matched a request with the action set to _Interactive Challenge_ or _JS Challenge_ and now that Challenge was answered."
110
110
111
111
## Are custom Content Security Policies (CSP) or custom error pages supported?
112
112
113
-
You cannot set your own Content Security Policy (CSP) and/or Referer-Policy via meta tags or [Transform Rules](/rules/transform/) in challenge pages.
113
+
You cannot set your own Content Security Policy (CSP) and/or Referer-Policy via meta tags or [Transform Rules](/rules/transform/) in Challenge Pages.
114
114
115
-
Origin headers also cannot be modified for challenge pages.
115
+
Origin headers also cannot be modified for Challenge Pages.
116
116
117
-
If you are setting any of these headers using Transform Rules for your entire website, you must prefix the rule with `not (starts_with(http.request.uri.path, "/cdn-cgi/challenge-platform/") or cf.response.error_type in {"managed_challenge" "iuam" "legacy_challenge" "country_challenge"})` in the rule expression to avoid issues with challenges.
117
+
If you are setting any of these headers using Transform Rules for your entire website, you must prefix the rule with `not (starts_with(http.request.uri.path, "/cdn-cgi/challenge-platform/") or cf.response.error_type in {"managed_challenge" "iuam" "legacy_challenge" "country_challenge"})` in the rule expression to avoid issues with Challenges.
Challenges are security mechanisms used by Cloudflare to verify whether a visitor to your site is a real human and not a bot or automated script.
12
12
</Description>
13
13
14
-
When a challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor's legitimacy. This process involves evaluating client-side signals or asking a visitor to take minimal action such as checking a box or selecting a button.
14
+
When a Challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor's legitimacy. This process involves evaluating client-side signals or asking a visitor to take minimal action such as checking a box or selecting a button.
15
15
16
-
Challenges are designed to protect your application without introducing unnecessary friction. Most visitors will pass challenges automatically without interaction.
16
+
Challenges are designed to protect your application without introducing unnecessary friction. Most visitors will pass Challenges automatically without interaction.
17
17
18
18
Cloudflare does not use CAPTCHA puzzles or visual tests like selecting objects or typing distorted characters. All challenge types are lightweight, privacy-preserving, and optimized for real-world traffic.
19
19
@@ -22,7 +22,7 @@ Cloudflare does not use CAPTCHA puzzles or visual tests like selecting objects o
0 commit comments