Description

Ensure the Challenge Passage setting, which controls how long a visitor stays verified after solving a Cloudflare challenge, is set to a value between 15 and 45 minutes. This is the range Cloudflare recommends for balancing security and user experience.

Rationale

After a visitor solves a challenge, Cloudflare issues a cf_clearance cookie that lets them skip further challenges until it expires. A very long passage lets a bot that solved one challenge keep access for a long time. A very short passage annoys real users with repeated challenges. Keeping it between 15 and 45 minutes balances both.

Impact

  • Limits how long a solved challenge stays valid

  • Avoids frequent repeat challenges for real users

  • Visitors may be challenged again after the passage expires

Default Value

By default, Challenge Passage is 30 minutes, which is within the recommended range.

Pre-Requisites

  • Cloudflare account with Administrator or Firewall permissions for the zone

Test Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Find Challenge passage and check its timeout value.

  5. If it is below 15 minutes or above 45 minutes, follow the implementation steps.

Implementation Steps

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Find Challenge passage and select the edit icon.

  5. Select a timeout between 15 and 45 minutes (for example, 30 minutes) and save.

Backout Plan

  1. Sign in to the Cloudflare dashboard at https://dash.cloudflare.com.

  2. Select your account and the domain (zone) you want to review.

  3. Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.

  4. Find Challenge passage, select the edit icon, and set the previous timeout.

Reference