Understanding Cloudflare Tor support and Onion Routing

Cloudflare does not automatically block visitors who use the Tor network.  Control Tor access via the Firewall app and enable Onion Routing in the Edge Certificates tab of the Cloudflare SSL/TLS app.


Overview

Due to the behavior of some individuals using the Tor network (spammers, distributors of malware, attackers, etc.), the IP addresses of Tor exit nodes may earn a bad reputation, elevating their Cloudflare threat score.

Our basic protection level issues CAPTCHA-based challenges to visitors whose IP address has a high threat score, depending on the level chosen by the Cloudflare customer. The choices for security range from Essentially Off to I'm Under Attack. The default level is Medium.

Cloudflare assigns the two-letter code T1 for Tor.  There's no geographical country associated with these IPs, but this approach lets Cloudflare customers override the default Cloudflare threat score to define the experience for their Tor visitors.  Cloudflare updates its list of Tor exit node IP addresses every 15 minutes.

Onion Routing

Beyond applying firewall filters to Tor traffic, Cloudflare users can improve the Tor user experience by enabling Onion Routing.  Onion Routing allows Cloudflare to serve your website’s content directly through the Tor network, without requiring exit nodes. This improves Tor browsing as follows: 

  • Tor users no longer access your site via exit nodes, which can sometimes be compromised, and may snoop on user traffic.
  • Human Tor users and bots can be distinguished by our Onion services, such that CAPTCHA challenges are only served to malicious bot traffic. 

Toggle Onion Routing On or Off via the Edge Certificates tab of the Cloudflare SSL/TLS app.

Not finding what you need?

95% of questions can be answered using the search tool. This is the quickest way to get a response.

Powered by Zendesk