Back to Checks
cloudflare

Cloudflare Zone Browser Integrity Check Is Enabled

zone_browser_integrity_check_enabled
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Browser Integrity Check configuration by verifying that HTTP headers are analyzed to identify requests from bots or clients with missing/invalid browser signatures.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Without Browser Integrity Check, malformed or suspicious requests reach the origin.

  • Confidentiality: basic bots can access and scrape content without challenge
  • Integrity: requests with invalid headers may exploit application vulnerabilities
  • Availability: automated traffic without browser signatures consumes resources

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_browser_integrity_check_enabled

Recommendation

Enable Browser Integrity Check to filter basic bot traffic.

  • Validates HTTP headers to identify non-browser requests
  • Challenges requests with missing or invalid browser signatures
  • Enabled by default on most Cloudflare plans
  • Low impact on legitimate users with standard browsers

Remediation

Terraform

# Enable Browser Integrity Check
resource "cloudflare_zone_settings_override" "browser_check" {
  zone_id = "<ZONE_ID>"
  settings {
    browser_check = "on"
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > Settings
3Enable Browser Integrity Check
4This feature is enabled by default on most Cloudflare plans

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_browser_integrity_check_enabled(Check):
    """Ensure that Browser Integrity Check is enabled for Cloudflare zones.

    Browser Integrity Check analyzes HTTP headers to identify requests from
    bots or clients with missing/invalid browser signatures. It challenges
    suspicious requests that don't have valid browser characteristics,
    protecting against basic automated attacks and malformed requests.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Browser Integrity Check enabled check.

        Iterates through all Cloudflare zones and verifies that Browser
        Integrity Check is enabled. This feature validates browser headers
        to filter out basic bot traffic.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Browser
            Integrity Check is enabled, or FAIL status if it is disabled.
        """
        findings = []
        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            browser_check = (zone.settings.browser_check or "").lower()
            if browser_check == "on":
                report.status = "PASS"
                report.status_extended = (
                    f"Browser Integrity Check is enabled for zone {zone.name}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Browser Integrity Check is not enabled for zone {zone.name}."
                )
            findings.append(report)
        return findings

References