Challenges and Challenge Passage time

I have Challenge Passage set to one month for my domain. I also have some WAF Rules that issue a Managed Challenge.

One rule is to issue a Managed Challenge to paths that contain /admin, another for contact and login pages.

In my experience, the Managed Challenge is presented more frequently than once a month - sometimes multiple times a week when I visit those admin pages for example.

No cache or cookies clearing involved or set on browser closing.

Reading the Challenge Passage documentation it says

  • “The Challenge Passage does not apply to challenges issued by WAF managed rules.”
  • “When that visitor tries to access other parts of your website, Cloudflare evaluates the cookie before presenting another challenge. If the cookie is still valid, no challenges will be shown.”

Does Managed Challenge respect the Challenge Passage time?

What are your experiences?

In my experience, the challenge will be presented every time my IP address changes. For that reason, I’ve disabled IPv6 on my desktop computer, as an IPv6 address would change more often than an IPv4 address.

In my case I have both static IPv4 and IPv6. The IP addresses at home haven’t changed in a decade.

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.