Know what’s on your site before a plaintiff’s firm does
A free privacy audit shows which cookies, pixels and trackers are running — and which ones commonly appear in privacy claims.
If you’ve ever waited on a “Checking your browser” page or ticked a Cloudflare Turnstile box, you’ve been given a cf_clearance cookie. It’s Cloudflare’s record that your browser passed a challenge, so you aren’t asked again on every page.
What Is the cf_clearance Cookie?
Cloudflare’s cookie documentation says cf_clearance “stores the proof of challenge passed. It is used to no longer issue a challenge if present. It is required to reach an origin server.” Cloudflare also says it stores the results of its JavaScript detections, which help spot bots.
Cloudflare states that its cookies are strictly necessary to provide the services its customers request, unless it says otherwise. It encourages site owners to disclose them anyway.
How Long Does cf_clearance Last?
It depends on the site’s settings. Cloudflare’s Challenge Passage page says the cookie has a default lifetime of 30 minutes, and Cloudflare recommends between 15 and 45 minutes. Site owners can set a different duration in their security settings, so some sites set much longer periods. When Cloudflare checks the cookie it allows a few extra minutes for clock skew.
Technical Details
- Domain: set on the protected site’s domain.
- Attributes: Cloudflare sets it with
SameSite=None; Secure; Partitioned, so inside third-party embeds it’s stored in a partition tied to the top-level site and isn’t shared between sites (the browser feature known as CHIPS). - HTTPS: Cloudflare notes that sites not using HTTPS may have problems with the cookie.
- Not portable: the clearance is tied to the browser and conditions under which the challenge was solved, which is why copying it to a different tool or IP often fails.
Related Cloudflare Cookies
You’ll often see cf_clearance with __cf_bm (bot management, 30 minutes of inactivity) and _cfuvid (rate limiting for visitors who share an IP address). The old __cfduid cookie was retired years ago. Other vendors’ bot-defense cookies, such as Akamai’s _abck and Google’s _grecaptcha, play a similar role.
Does cf_clearance Need Consent?
EU and UK: generally no. Keeping a site safe from bots and abuse, and letting the person through after a check, is part of providing the service they requested, and it’s the kind of security cookie that falls under the strictly necessary exemption. List it in your cookie policy under Necessary.
US states: it’s a security cookie and isn’t used for advertising, so it’s not a “sale” or “sharing.” Disclose it alongside your other cookies.
One caution on data transfers: Cloudflare says cookie data may be processed in its US data centers by default, and that customers on its Data Localization Suite can control where it’s processed. EU-focused teams should cover this in their transfer assessments.
How to Delete or Block cf_clearance
- Visitors: clear the site’s cookies. You’ll likely see a challenge again, and if you block the cookie entirely, you may be stuck in a challenge loop.
- Site owners: shorten or lengthen Challenge Passage in the Cloudflare dashboard, and keep the consent banner from blocking Cloudflare cookies, or legitimate visitors may be locked out.
Classifying It Correctly
Consent tools that guess categories sometimes mark Cloudflare cookies as “unclassified,” which can lead to them being blocked. Captain Compliance’s scanner identifies cf_clearance as a Cloudflare security cookie in your cookie scanner results, so your consent banner can list it under strictly necessary.
FAQ
Is cf_clearance a tracking cookie?
No. It records that a challenge was passed. Cloudflare doesn’t describe it as being used for advertising or cross-site tracking.
Why do I keep getting Cloudflare challenges?
The cookie may have expired, been blocked by a privacy extension, or your IP or browser may have changed since the challenge.
Can a stolen cf_clearance be reused?
It’s tied to the conditions of the original challenge, which limits reuse, but treat it like any session token.
The risk with cf_clearance is rarely privacy. It’s a consent banner that blocks it by mistake and locks out the visitors the site is trying to let in.
Put this into practice
Turn privacy guidance into working controls.
Captain Compliance helps teams discover tracking technologies, enforce consent, manage privacy requests and document the evidence behind every decision.
