3

I am considering using Cloudflare CDN for my own website, which has a user base of 10.000 people. It's used world-wide, and there is a lot of room for caching, thus I wanted to use a CDN.

However, I noticed recently, that I have to verify that I am a human at pages that use cloudflare (for example at ChatGPT). So I wonder, when I use free cloudflare CDN, is it possible that my customers have to verify that they are human?

Improve this question

1 Answer 1

Reset to default
4

When you visited ChatGPT, you likely ran into CloudFlare's Turnstile challenge. While strictly speaking Turnstile is a CAPTCHA due to its challenge-response pattern, CloudFlare markets it as not a captcha due to its less intrusive nature (a single button click rather than a visual challenge).

With CloudFlare enabled on your site, at most a user of yours would be asked to click a "verify you are human" button. If you want to reduce the amount of your visitors who receive this Turnstile challenge, you can control its prevalence by changing the Security Level of your website in your CloudFlare settings. If you want as few of your users as possible to be presented the Turnstile challenge, you can set your website's security level to "Essentially off".

Improve this answer
4
  • Yes, the Turnstile challenge is exactly what I meant. Do you happen to know if such kind of CAPTCHA is also added for other CDN provider, like bunny.net? Commented Oct 9, 2023 at 18:38
  • Actually just checking my dashboard, and it seems I have to add "Turnstile" for pages manually, so it looks to me that by default this should be off. So could it be that I can use Cloudflare CDN cache without having to annoy my customers with Turnstile? Commented Oct 9, 2023 at 18:44
  • CloudFlare's "Essentially off" setting is likely what you're looking for. According to CloudFlare, "Essentially Off means that we’ve set an exceptionally low sensitivity level so in most cases traffic won't be mitigated for you. However, attack traffic will be mitigated at exceptional levels to ensure the safety and stability of the Cloudflare network." My guess is that other CDN providers likely have similar levels of mitigation in place, so CloudFlare "Essentially off" won't annoy your visitors more than a different CDN would. Commented Oct 9, 2023 at 18:57
  • 3
    By default, Turnstile shows challenges to users with low IP reputation. But by setting your site to "Essentially off", Cloudflare will only show challenges to users that it deems to pose a threat to Cloudflare themselves (i.e. very low IP reputation). More info at the Security Level KB page. Commented Oct 9, 2023 at 19:00

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.