Skip to content
Cloudflare Docs

Onion Routing and Tor support

Improve the Tor user experience by enabling Onion Routing, which enables Cloudflare to serve your website’s content directly through the Tor network and without requiring exit nodes.

Availability

Free Pro Business Enterprise

Availability

Yes

Yes

Yes

Yes

How it works

Onion Routing helps improve Tor browsing as follows:

  • Tor users no longer access your site via exit nodes, which can sometimes be compromised, and may snoop on user traffic.
  • Human Tor users and bots can be distinguished by our Onion services, such that interactive challenges are only served to malicious bot traffic.

Tor Browser ↗ users receive an alt-svc header ↗ as part of the response to the first request to your website. The browser then creates a Tor Circuit to access this website using the .onion TLD service provided by this header.

You should note that the visible domain in the user interface remains unchanged, as the host header and the SNI are preserved. However, the underlying connection changes to be routed through Tor, as the UI denotes on the left of the address bar ↗ with a Tor Circuit. Cloudflare does not provide a certificate for the .onion domain provided as part of alt-svc flow, which therefore cannot be accessed via HTTPS.

Enable Onion Routing

To enable Onion Routing in the dashboard:

  1. Log in to your Cloudflare account ↗, and select your account and domain.
  2. Go to Network.
  3. For Onion Routing, switch the toggle to On.