Check ID: zone_browser_integrity_check_enabled
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Browser Integrity Check configuration by verifying that HTTP headers are analyzed to identify requests from bots or clients with missing/invalid browser signatures.

​
Risk

Without Browser Integrity Check, malformed or suspicious requests reach the origin.
  • Confidentiality: basic bots can access and scrape content without challenge
  • Integrity: requests with invalid headers may exploit application vulnerabilities
  • Availability: automated traffic without browser signatures consumes resources

​
Recommendation

Enable Browser Integrity Check to filter basic bot traffic.
  • Validates HTTP headers to identify non-browser requests
  • Challenges requests with missing or invalid browser signatures
  • Enabled by default on most Cloudflare plans
  • Low impact on legitimate users with standard browsers

​
Remediation

# Enable Browser Integrity Check
resource "cloudflare_zone_settings_override" "browser_check" {
  zone_id = "<ZONE_ID>"
  settings {
    browser_check = "on"
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_browser_integrity_check_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks