--- title: Challenges description: When a Challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor's legitimacy. This process involves evaluating client-side signals (data gathered from the visitor's browser environment) or asking a visitor to take minimal action such as checking a box or selecting a button. image: https://developers.cloudflare.com/core-services-preview.png --- [Skip to content](#%5Ftop) Was this helpful? YesNo [ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-challenges/index.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) Copy page # Challenges Challenges are security mechanisms used by Cloudflare to verify whether a visitor to your site is a real human and not a bot or automated script. When a Challenge is issued, Cloudflare asks the browser to perform a series of checks that help confirm the visitor's legitimacy. This process involves evaluating client-side signals (data gathered from the visitor's browser environment) or asking a visitor to take minimal action such as checking a box or selecting a button. Challenges are designed to protect your application without introducing unnecessary friction. Most visitors will pass Challenges automatically without interaction. Cloudflare does not use CAPTCHA puzzles or visual tests like selecting objects or typing distorted characters. All challenge types are lightweight, privacy-preserving, and optimized for real-world traffic. --- ## Related products **[Turnstile](https://developers.cloudflare.com/turnstile/)** Use Cloudflare's smart CAPTCHA alternative to run less intrusive Challenges. **[Bots](https://developers.cloudflare.com/bots/)** Cloudflare bot solutions identify and mitigate automated traffic to protect your domain from bad bots. **[WAF](https://developers.cloudflare.com/waf/)** Get automatic protection from vulnerabilities and the flexibility to create custom rules. **[DDoS Protection](https://developers.cloudflare.com/ddos-protection/)** Detect and mitigate Distributed Denial of Service (DDoS) attacks using Cloudflare's Autonomous Edge. ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/cloudflare-challenges/","name":"Challenges"}}]} ``` --- --- title: Troubleshooting description: If your hostname is proxied through Cloudflare, visitors may experience challenges on your webpages. image: https://developers.cloudflare.com/core-services-preview.png --- [Skip to content](#%5Ftop) Was this helpful? YesNo [ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-challenges/troubleshooting/index.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) Copy page # Troubleshooting ## Common issues ### Proxied hostnames If your hostname is proxied through Cloudflare, visitors may experience challenges on your webpages. Cloudflare issues challenges through the [Challenge Platform](https://developers.cloudflare.com/cloudflare-challenges/), which is the same underlying technology powering [Turnstile](https://developers.cloudflare.com/turnstile/). In contrast to our Challenge page offerings, Turnstile allows you to run challenges anywhere on your site in a less-intrusive way without requiring the use of Cloudflare's CDN. ### Deprecated browser support Challenges are not supported by Microsoft Internet Explorer. If you are currently using Internet Explorer, try using another modern web browser (Chrome, Safari, Firefox). If you are already using a modern web browser, make sure it is using the latest version. ### Referer header Your visitor's HTTP request contains a referer header set to the website that they came from. When they encounter and solve a Challenge Page, the request with the referer is sent to the origin, and the response to the request is served to the user. The JavaScript on the response page may read the value of `document.referer`, but it will not be accurate. For example, a visitor coming from a given website is challenged by a [WAF rule](https://developers.cloudflare.com/waf/custom-rules/) via an interstitial Challenge Page served by your domain. Once the visitor loads the website's home page, the `document.referer` value is your domain, not the origin website. This affects tools like Google Analytics, which reads the referer from JavaScript, since it replaces the previous website that visitors came from. You can add tracking scripts, such as the Google Tag Manager Javascript, within an existing [Challenge Page](https://developers.cloudflare.com/rules/custom-errors/) to capture the correct referer header on the initial request. Example JavaScript ``` ``` ### Cross-origin resource sharing (CORS) preflight requests Cross-origin resource sharing (CORS) preflight requests, or `OPTIONS`, exclude user credentials that include cookies. As a result, the `cf_clearance` cookie will not be sent with the request, causing it to fail to bypass a Challenge Page (Non-interactive, Managed, or Interactive Challenge). ### Challenges on Cloudflare-protected sites Cloudflare issues challenges to website visitors to protect against malicious activity, such as bot attacks and DDoS attempts. If a legitimate human visitor is unexpectedly challenged, the reason typically stems from a security feature flagging their request. | Source | Description | | ------------------------------------------- | --------------------------------------------------------------------------- | | High threat score | IP addresses with a high-risk score trigger Challenges. | | IP reputation | If your IP has a history of suspicious activity, it may be flagged. | | Bot detection | Automated traffic resembling bots is filtered by Cloudflare. | | Web Application Firewall (WAF) custom rules | Site owners may set rules targeting specific regions or user agents. | | Browser Integrity Check | Cloudflare verifies that browsers meet certain standards. | | Challenge Passage | Technologies like Privacy Pass reduce the frequency of repeated Challenges. | To avoid repeated challenges, visitors can take the following steps to ensure their environment does not trigger security checks: * Ensure your web browser is updated to the latest stable version for full compatibility with modern challenge technologies. * Temporarily disable browser extensions, such as ad blockers or privacy tools, that may block standard browser headers or the necessary challenge scripts. * If your IP address has a poor reputation (often seen with shared VPNs or corporate proxies), try switching to a different, trusted network connection. ### Allowlist traffic from mitigation actions If you need to prevent a **Block** or **Challenge** action from being applied to specific requests, such as known search engine crawlers, monitoring services, or internal APIs, you must configure an exclusion using [WAF custom rules](https://developers.cloudflare.com/waf/custom-rules/). Cloudflare supports two primary methods for creating these exclusions: #### 1\. Use a Skip rule (recommended) The most robust method for creating an exception is to create a custom rule with the **Skip** action. This allows matching requests to bypass certain security features, including Bot Management and other WAF rules. Note Due to the evaluation order, **Skip** rules must be positioned before the **Block** or **Challenge** rule they are designed to bypass. Example Block Amazon Web Services (AWS) and Google Cloud Platform (GCP) because of large volumes of undesired traffic, but allow Googlebot and other known bots that Cloudflare validates. * Basic rule, no exclusion: * **Expression**: `(ip.src.asnum in {16509 15169} and not cf.client.bot)` * **Action**: Block (or a challenge action) * Rule that excludes IP addresses from being blocked or challenged: * **Expression**: `(ip.src.asnum in {16509 15169} and not cf.client.bot) and not (ip.src in {192.0.2.1 198.51.100.42 203.0.113.0/24})` * **Action**: Block (or a challenge action) * Two rules to skip remaining custom rules for specific IPs and block the rest. 1. Rule 1: * Expression: `ip.src in {192.0.2.1 198.51.100.42 203.0.113.0/24}` * Action: Skip > All remaining custom rules 2. Rule 2: * Expression: `(ip.src.asnum in {16509 15169} and not cf.client.bot)` * Action: Block (or a challenge action) #### 2\. Modify the Rule Expression You can refine the expression of a **Block** or **Challenge** rule to directly exclude known good traffic by using the logical not operator with an exclusion list, such as an IP list, country code, or ASN. This approach is useful for simple exclusions but can make complex rules more difficult to maintain than separate **Skip** rules. Example Exclude multiple IP addresses from a **Block** or **Challenge** rule that assesses attack score. * Basic rule, no exclusion: * **Expression**: `(http.host eq "example.com" and cf.waf.score lt 20)` * **Action**: Block (or a challenge action) * Rule that excludes IP addresses from being blocked/challenged: * **Expression**: `(http.host eq "example.com" and cf.waf.score lt 20) and not (ip.src in {192.0.2.1 198.51.100.42 203.0.113.0/24})` * **Action**: Block (or a challenge action) * Two rules to skip remaining custom rules for specific IPs and block the rest. 1. Rule 1: * Expression: `ip.src in {192.0.2.1 198.51.100.42 203.0.113.0/24}` * Action: Skip > All remaining custom rules 2. Rule 2: * Expression: `(http.host eq "example.com" and cf.waf.score lt 20)` * Action: Block (or a challenge action) ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/cloudflare-challenges/","name":"Challenges"}},{"@type":"ListItem","position":3,"item":{"@id":"/cloudflare-challenges/troubleshooting/","name":"Troubleshooting"}}]} ``` --- --- title: Challenge solve issues description: You may encounter a challenge loop where the challenge keeps reappearing without being solved. This is in very specific cases where we detect strong bot signals. If you are a legitimate human, you can follow the troubleshooting guide below to resolve the issue or submit a feedback report. Challenge loops can happen for several reasons: image: https://developers.cloudflare.com/core-services-preview.png --- [Skip to content](#%5Ftop) Was this helpful? YesNo [ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-challenges/troubleshooting/challenge-solve-issues.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) Copy page # Challenge solve issues ## Challenge loops You may encounter a challenge loop where the challenge keeps reappearing without being solved. This is in very specific cases where we detect strong bot signals. If you are a legitimate human, you can follow the troubleshooting guide below to resolve the issue or submit a feedback report. Challenge loops can happen for several reasons: * **Network issues**: Poor or unstable network connections can prevent the challenge from being completed. * **Browser configuration**: Some browser settings or extensions may block the scripts needed to execute the challenge. * **Unsupported browsers**: Using a browser that is not supported by Turnstile. * **JavaScript disabled**: Turnstile relies on JavaScript to function properly. * **Detection errors**: If Turnstile suspects bot-like behavior, you may encounter repeated challenges for verification. Most challenges are quick to complete and typically take only a few seconds. If it takes longer, ensure your network is stable and follow the [troubleshooting steps](#troubleshooting). Note If the issue persists, try switching to a different network or device to rule out any issues with your browser environment. Ensure your browser is updated to the latest version to maintain compatibility. ## Troubleshooting Follow the steps below to ensure that your environment is properly configured. 1. Verify your browser compatibility. * Turnstile supports all major browsers, except Internet Explorer. * Ensure your browser is up to date. For more information, refer to our [Supported browsers](https://developers.cloudflare.com/cloudflare-challenges/reference/supported-browsers/). 2. Disable your browser extensions. * Some browser extensions, such as ad blockers, may block the scripts Turnstile needs to operate. * Temporarily disable all extensions and reload the page. 3. Enable JavaScript. * Turnstile requires JavaScript to run. Ensure it is enabled in your browser settings. Refer to your browser's documentation for instructions on enabling JavaScript. 4. Try Incognito or Private mode. * Use your browser's incognito or private mode to rule out issues caused by extensions or cached data. 5. Test another browser or device. * Switch to a different browser or device to see if the issue is specific to your current setup. 6. Avoid VPNs or proxies. * Some virtual private networks (VPN) or proxies may interfere with Turnstile. Disable them temporarily to test. 7. Switch to a different network. * Your current network may have restrictions causing Turnstile challenges to fail. Try switching to another network, such as a mobile hotspot. If none of the above resolves your issue, contact the website administrator with the [error code](https://developers.cloudflare.com/turnstile/troubleshooting/client-side-errors/error-codes/) and Ray ID or submit a [feedback report](https://developers.cloudflare.com/turnstile/troubleshooting/feedback-reports/) through the Turnstile widget by selecting **Submit Feedback**. ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/cloudflare-challenges/","name":"Challenges"}},{"@type":"ListItem","position":3,"item":{"@id":"/cloudflare-challenges/troubleshooting/","name":"Troubleshooting"}},{"@type":"ListItem","position":4,"item":{"@id":"/cloudflare-challenges/troubleshooting/challenge-solve-issues/","name":"Challenge solve issues"}}]} ``` --- --- title: Interstitial Challenge Pages description: An interstitial Challenge Page (a full-page screen that appears before the visitor reaches the destination URL) acts as a gate between the visitor and your website or application while Cloudflare verifies the authenticity of the visitor. image: https://developers.cloudflare.com/core-services-preview.png --- [Skip to content](#%5Ftop) Was this helpful? YesNo [ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-challenges/challenge-types/challenge-pages/index.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) Copy page # Interstitial Challenge Pages An interstitial Challenge Page (a full-page screen that appears before the visitor reaches the destination URL) acts as a gate between the visitor and your website or application while Cloudflare verifies the authenticity of the visitor. The Challenge Page intercepts the visitor from getting to the destination URL by holding the request and evaluating the browser environment for automated signals, and serving a challenge. The visitor cannot reach their destination without passing the challenge. Based on the signals indicated by their browser environment, the visitor may be asked to perform an interaction such as checking a box or selecting a button for further probing. You can implement a Challenge Page to your website or application by creating a [WAF custom rule](https://developers.cloudflare.com/waf/custom-rules/). Challenges are triggered by a rule in the [Web Application Firewall (WAF)](https://developers.cloudflare.com/waf/), [Bot Management](https://developers.cloudflare.com/bots/), or [Rate limiting](https://developers.cloudflare.com/waf/rate-limiting-rules/). The level of interactivity and visibility of the Challenge Page depends on the Action that you select when creating the WAF rule for your website or application. ## Actions The following challenge types are the available actions when you create a WAF rule for a Challenge Page. ### Non-Interactive Challenges With a Non-Interactive Challenge, Cloudflare makes the determination on whether or not the visitor is automated based on the limited information attained from their browser signals via an injected JavaScript. Then, it presents a Challenge Page that requires no interaction from a visitor except the JavaScript processed by their browser. The visitor must wait until their browser finishes processing the JavaScript, which typically takes less than five seconds. If the visitor passes the challenge, the original request continues to the destination URL. If the challenge fails or cannot be completed, the visitor is presented with another interstitial Challenge Page. ### Managed Challenges Managed Challenges are where Cloudflare dynamically chooses the appropriate type of challenge served to the visitor based on the characteristics of a request from the signals indicated by their browser. This helps avoid [CAPTCHAs ↗](https://www.cloudflare.com/learning/bots/how-captchas-work/), which also reduces the lifetimes of human time spent solving CAPTCHAs across the Internet. Most human visitors are automatically verified and the Challenge Page will display **Successful**. However, if Cloudflare detects non-human attributes from the visitor's browser, they may be required to interact with the challenge to solve it. Cloudflare recommends Managed Challenges for most WAF rules. Unless there are specific compatibility issues, do not use other challenge types. Warning Using Cloudflare Challenges along with Rules features may cause challenge loops. Refer to [Rules troubleshooting](https://developers.cloudflare.com/rules/reference/troubleshooting/) for more information. ### Interactive Challenges Interactive Challenge Pages require a visitor to interact with the challenge to pass. Cloudflare always recommends using a Managed Challenge. For more information, refer to the [Cloudflare blog post ↗](https://blog.cloudflare.com/end-cloudflare-captcha/). ## Compatibility limitations Challenge Pages interrupt the request flow by returning a full HTML page for the user's browser to render and solve. This mechanism fails when the browser expects a non-HTML response, such as an AJAX or XHR (fetch) request. To ensure your API calls are protected without breaking single-page applications (SPAs) or API integrations, Cloudflare recommends using Turnstile Pre-clearance. By enabling Pre-clearance, the Turnstile widget issues a persistent clearance cookie (`cf_clearance`) upon successful human verification on an initial HTML page. This cookie pre-clears the visitor to interact with sensitive API endpoints secured by WAF rules, allowing you to deploy granular security without forcing a disruptive Challenge Page response. For implementation details, refer to the [guidance on Pre-clearance for Turnstile](https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/#pre-clearance-support-in-turnstile). ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"/directory/","name":"Directory"}},{"@type":"ListItem","position":2,"item":{"@id":"/cloudflare-challenges/","name":"Challenges"}},{"@type":"ListItem","position":3,"item":{"@id":"/cloudflare-challenges/challenge-types/","name":"Available Challenges"}},{"@type":"ListItem","position":4,"item":{"@id":"/cloudflare-challenges/challenge-types/challenge-pages/","name":"Interstitial Challenge Pages"}}]} ``` --- --- title: Additional configuration description: Refer to supported languages for more information. image: https://developers.cloudflare.com/core-services-preview.png --- [Skip to content](#%5Ftop) Was this helpful? YesNo [ Edit page ](https://github.com/cloudflare/cloudflare-docs/edit/production/src/content/docs/cloudflare-challenges/challenge-types/challenge-pages/additional-configuration.mdx) [ Report issue ](https://github.com/cloudflare/cloudflare-docs/issues/new/choose) Copy page # Additional configuration ## Multi-language support Refer to [supported languages](https://developers.cloudflare.com/cloudflare-challenges/reference/supported-languages/) for more information. --- ## Favicon customization Cloudflare Challenges take the favicon of your website using `GET /favicon.ico` and displays it on the Challenge Page. You can customize your favicon by using the HTML snippet below. HTML element ``` ``` --- ## Custom Content Security Policy (CSP) and error pages Cloudflare-served Challenge Pages operate in a strictly controlled environment to maximize security and ensure the challenge mechanism functions correctly. Because of this, you cannot set your own Content Security Policy (CSP) or Referer-Policy using `` tags or Transform Rules on Challenge Pages. Origin headers can be modified within the Challenge Page context and are not immutable, but they may cause issues. If you have an active Transform Rule configured to modify HTTP response headers globally across your website, such as adding custom CSP headers, this rule will interfere with and cause the Challenge Page to fail. To prevent this conflict, you must modify your Transform Rule expression to explicitly exclude Challenge Page error types. Prefix your Transform Rule expression with the following logical exclusion: ``` not cf.response.error_type in {"managed_challenge" "iuam" "legacy_challenge" "country_challenge"} ``` This exclusion ensures that your custom header modification logic is only applied to traffic destined for your origin, allowing Cloudflare's Challenge Platform to function without being impacted by conflicting response headers. --- ## Custom Challenge Pages Before defining a custom Challenge Page in your Cloudflare account, you will need to design and code that page. It can be hosted on your own web server or using a Cloudflare product like [Snippets](https://developers.cloudflare.com/rules/snippets/). Refer to [Design your custom error page](https://developers.cloudflare.com/rules/custom-errors/edit-error-pages/#1-design-your-custom-error-page) for more information. ### How it works When a zone has a custom Challenge Page configured, your uploaded HTML is fetched from the Custom Pages Worker (KV-backed). Cloudflare replaces the `::CF_WIDGET_BOX::` placeholder token with the full challenge bootstrap `