# Ensure Cloudflare Zone Browser Integrity Check Is Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790787222032213-ensure-cloudflare-zone-browser-integrity-check-is-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Cloudflare](https://support.icompaas.com/support/solutions/c_1790786902273285) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1790786912003423)
- Last updated: 2026-09-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Browser Integrity Check is turned on, so that Cloudflare looks at the HTTP headers of each request and challenges or blocks requests with headers commonly used by spammers and abusive bots, such as a missing or non-standard user agent.

**Rationale**

Many simple bots and attack tools send requests with missing or suspicious headers. Browser Integrity Check blocks this low-quality automated traffic before it reaches your origin, reducing spam, scraping, and attack attempts with no custom rules needed.

**Impact**

-   Blocks requests with suspicious or missing headers
    
-   Reduces spam and simple bot traffic
    
-   Some legitimate API clients without a user agent may need an exception
    

**Default Value**

By default, Browser Integrity Check is enabled.

**Pre-Requisites**

-   Cloudflare account with Administrator or Super Administrator role for the zone
    

**Test Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Check the Browser integrity check setting and verify that it is On.
    
5.  If it is not On, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Set Browser integrity check to On.
    

**Backout Plan**

1.  Sign in to the Cloudflare dashboard at [https://dash.cloudflare.com](https://dash.cloudflare.com/).
    
2.  Select your account and the domain (zone) you want to review.
    
3.  Go to Security > Settings and (optionally) filter by DDoS attacks. On older dashboards, the setting is under Security > Settings, Security > Bots, or Scrape Shield.
    
4.  Set Browser integrity check back to its previous value.
    

**Reference**

-   [https://developers.cloudflare.com/waf/tools/browser-integrity-check/](https://developers.cloudflare.com/waf/tools/browser-integrity-check/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.