Check ID: zone_challenge_passage_configured
Provider: Cloudflare
Service: zone
Severity: LOW
Categories: internet-exposed
Resource type: Zone

​
What this check verifies

Cloudflare zones are assessed for Challenge Passage (challenge TTL) configuration by checking if it is set between 15 minutes and 45 minutes to balance security with user experience.

​
Risk

Improperly configured Challenge Passage can impact security or user experience.
  • Confidentiality: TTL set too long may allow attackers extended access after passing initial challenge
  • Integrity: security controls become less effective with overly permissive TTL settings
  • Availability: TTL set too short causes excessive challenges degrading user experience

​
Recommendation

Configure Challenge Passage between 15 and 45 minutes.
  • Values below 15 minutes may frustrate legitimate users with excessive challenges
  • Values above 45 minutes give attackers too much time after passing challenges
  • The default Cloudflare value of 30 minutes is recommended for most use cases
  • Adjust based on your specific threat model and user experience requirements

​
Remediation

# Configure Challenge Passage between 15-45 minutes
resource "cloudflare_zone_settings_override" "challenge_passage" {
  zone_id = "<ZONE_ID>"
  settings {
    challenge_ttl = 1800 # 30 minutes - recommended default
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Cloudflare account. Findings appear at Cloud Security → Findings filterable by Check ID = zone_challenge_passage_configured. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Cloudflare checks