Back to Checks
cloudflare

Cloudflare Zone Challenge Passage Is Configured Between 15 and 45 Minutes

zone_challenge_passage_configured
Service: zoneSeverity: low
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:Zone

Cloudflare zones are assessed for Challenge Passage (challenge TTL) configuration by checking if it is set between 15 minutes and 45 minutes to balance security with user experience.

Prowler logoProwlerprowler-provider-cloudflare

Risk

Improperly configured Challenge Passage can impact security or user experience.

  • Confidentiality: TTL set too long may allow attackers extended access after passing initial challenge
  • Integrity: security controls become less effective with overly permissive TTL settings
  • Availability: TTL set too short causes excessive challenges degrading user experience

Run this check with Prowler

Run in Prowler Cloud
Run
prowler cloudflare --checks zone_challenge_passage_configured

Recommendation

Configure Challenge Passage between 15 and 45 minutes.

  • Values below 15 minutes may frustrate legitimate users with excessive challenges
  • Values above 45 minutes give attackers too much time after passing challenges
  • The default Cloudflare value of 30 minutes is recommended for most use cases
  • Adjust based on your specific threat model and user experience requirements

Remediation

Terraform

# Configure Challenge Passage between 15-45 minutes
resource "cloudflare_zone_settings_override" "challenge_passage" {
  zone_id = "<ZONE_ID>"
  settings {
    challenge_ttl = 1800 # 30 minutes - recommended default
  }
}

Other

1Log in to the Cloudflare dashboard and select your account and domain
2Go to Security > Settings
3Scroll to Challenge Passage
4Set the value between 15 and 45 minutes
5The default value of 30 minutes is recommended for most use cases

Check Code

from prowler.lib.check.models import Check, CheckReportCloudflare
from prowler.providers.cloudflare.services.zone.zone_client import zone_client


class zone_challenge_passage_configured(Check):
    """Ensure that Challenge Passage is configured between 15 and 45 minutes for Cloudflare zones.

    Challenge Passage (Challenge TTL) determines how long a visitor who has passed
    a security challenge can access the site before being challenged again. A value
    between 15 and 45 minutes balances security with user experience.
    """

    def execute(self) -> list[CheckReportCloudflare]:
        """Execute the Challenge Passage configured check.

        Iterates through all Cloudflare zones and verifies that Challenge Passage
        is set between 15 and 45 minutes.

        Returns:
            A list of CheckReportCloudflare objects with PASS status if Challenge
            Passage is between 15 and 45 minutes, or FAIL status otherwise.
        """
        findings = []
        min_minutes = 15
        max_minutes = 45

        for zone in zone_client.zones.values():
            report = CheckReportCloudflare(
                metadata=self.metadata(),
                resource=zone,
            )
            # API returns seconds, convert to minutes
            challenge_ttl_minutes = zone.settings.challenge_ttl // 60

            if min_minutes <= challenge_ttl_minutes <= max_minutes:
                report.status = "PASS"
                report.status_extended = f"Challenge Passage is set to {challenge_ttl_minutes} minutes for zone {zone.name}."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Challenge Passage is set to {challenge_ttl_minutes} minutes for zone {zone.name} "
                    f"(recommended: between {min_minutes} and {max_minutes} minutes)."
                )
            findings.append(report)
        return findings

References