Content Security Policy

The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page.

We recommend using the nonce-based approach documented with CSP3 ↗. Make sure to include your nonce in the api.js script tag and we will handle the rest. Cloudflare Turnstile works with strict-dynamic.

Alternatively, add the following values to your CSP header:

• script-src: https://challenges.cloudflare.com
• frame-src: https://challenges.cloudflare.com

We recommend validating your CSP with Google's CSP Evaluator ↗.

Note

You cannot set your own CSP and/or Referer-Policy via meta tags or Transform rules in challenge pages.

Pre-Clearance support

If you are using Turnstile in pre-clearance mode, Turnstile sets the cf_clearance cookie by doing a fetch request to a special endpoint in /cdn-cgi/ of your domain.

For this request to succeed, your connect-src directive must include 'self'.

Was this helpful?

What did you like?

Accurate

Easy to understand

Solved my problem

Helped me decide to use the product

Other

What went wrong?

Hard to understand

Incorrect information

Missing the information

Other

Thank you for helping improve Cloudflare's documentation!