Cloudflare uses various cookies to maximize network resources, manage traffic, and protect our Customers’ sites from malicious traffic.
Overview
The __cflb, __cf_bm, __cf_ob_info and __cf_use_ob, and __cfwaitingroom cookies are strictly necessary to provide the services requested by our Customers (as defined in our Privacy Policy), as we explain in more detail below.
Cloudflare encourages our Customers to disclose the use of these cookies to their End-Users (as defined in our Privacy Policy), and in some jurisdictions, Customers may be required to disclose these cookies to End Users.
Cookie data is processed in Cloudflare's data center in the United States and is subject to the cross-border data transfer section (section 7) of the Cloudflare Privacy Policy.
*__cflb* cookie for Cloudflare Load Balancer session affinity
When enabling session affinity with Cloudflare Load Balancer, Cloudflare sets a __cflb cookie with a unique value on the first response to the requesting client. Cloudflare routes future requests to the same origin, optimizing network resource usage. In the event of a failover, Cloudflare sets a new __cflb cookie to direct future requests to the failover pool.
The __cflb cookie allows us to return an End User to the same Customer origin for a specific period of time (Customer-configured), which in turn allows the Customer origin to maintain an End User’s experience seamlessly (for example, keeping an End User’s items in a shopping cart while they continue to navigate around the website). This cookie is a session cookie that lasts anywhere from several seconds up to 24 hours.
*__cf_bm* cookie for Cloudflare bot products
Cloudflare's bot products identify and mitigate automated traffic to protect your site from bad bots. Cloudflare places the __cf_bm cookie on End User devices that access Customer sites that are protected by Bot Management or Bot Fight Mode. The __cf_bm cookie is necessary for the proper functioning of these bot solutions.
This cookie expires after (at most) 30 minutes of continuous inactivity by the End User. The cookie contains information related to the calculation of Cloudflare’s proprietary bot score and, when Anomaly Detection is enabled on Bot Management, a session identifier. The information in the cookie (other than time-related information) is encrypted and can only be decrypted by Cloudflare.
A separate __cf_bm cookie is generated for each site that an End User visits, and Cloudflare does not follow users from site to site or from session to session by merging various __cf_bm identifiers into a profile. The __cf_bm cookie is generated independently by Cloudflare, and does not correspond to any user ID or other identifiers in a Customer’s web application.
*__cf_ob_info* and *__cf_use_ob* cookie for Cloudflare Always Online
The __cf_ob_info cookie provides information on:
- The HTTP Status Code returned by the origin web server,
- The Ray ID of the original failed request, and
- The data center serving the traffic.
The __cf_use_ob cookie informs Cloudflare to fetch the requested resource from the Always Online cache on the designated port. Applicable values are: 0, 80, and 443.
*__cfwaitingroom* for Cloudflare Waiting Rooms
Cloudflare’s Waiting Room product enables a waiting room for a particular host and path combination within a zone. Visitors are put in the waiting room and provided an estimate of when they will be allowed to access the application if not immediately available.
The __cfwaitingroom cookie is only used to track visitors that access a Waiting Room enabled host and path combination for a zone. The __cfwaitingroom cookie also provides time estimates for entering the application and serves visitors in the correct order. The __cfwaitingroom cookie also allows visitors to re-enter the application after leaving for a customer-specified amount of time without having to be put in the Waiting Room.
The __cfwaitingroom cookie expires in 24 hours for visitors that stay in the Waiting Room. When the visitor accesses the application, the __cfwaitingroom cookie is set to expire within the session duration, which can be configured by the customer.
Visitors using a browser that does not accept cookies cannot visit the host and path combination while the Waiting Room is active. Enable the Waiting Room feature by speaking with your Account Team. Afterward, control the Waiting Room via the Cloudflare dashboard Traffic app under the Waiting Rooms tab.
Additional cookies used by the Challenge Platform
The table below shows additional cookies used by the Challenge Platform.
|
Cookie Name (XXX represents dynamic part) |
Description |
|
cf_clearance |
Clearance Cookie that stores the proof of challenge passed. It is used to no longer issue a captcha or jschallenge challenge if present. It is required to reach origin server. |
|
- cf-cc-XXX - cf-chl-cc-XXX - cf-chl-seq-XXX - cf-chl-prog |
These cookies are used by Cloudflare for the execution of Javascript or Captcha challenges. They are not used for tracking or beyond the scope of the challenge. They can be deleted if seen. |
|
cf-chl-XXXX |
This cookie is used to check whether the [Cloudflare Edge server](https://www.cloudflare.com/en-gb/learning/cdn/glossary/edge-server/) supports cookies. It can be deleted if seen. |
|
- cf-chl-rc-i - cf-chl-rc-ni |
These cookies are for internal use which allows Cloudflare to identify production issues on clients. |