| Path | Type | Triggered by |
|---|---|---|
| /waf/managed | Managed Challenge | WAF custom rule → action "Managed Challenge" |
| /waf/js | JS Challenge (non-interactive, "unmanaged") | WAF custom rule → action "JS Challenge" |
| /waf/interactive | Interactive Challenge ("unmanaged") | WAF custom rule → action "Interactive Challenge" |
| /waf/iuam | I'm Under Attack Mode | Configuration rule → Security Level "I'm Under Attack" |
Solving one sets cf_clearance for the whole hostname, so later /waf/* pages may pass without a challenge. Clear cookies for this site (or use a private window) to see each one fresh.
| Path | Mode | Behaviour |
|---|---|---|
| /turnstile/managed | Turnstile: Managed widget | Widget embedded in your own page. Runs checks in an iframe; shows a checkbox only if Cloudflare is unsure. Produces a token your backend must verify with Siteverify. |
| /turnstile/non-interactive | Turnstile: Non-interactive widget | Visible widget with a spinner, never asks for a click. Token or failure, no human fallback. |
| /turnstile/invisible | Turnstile: Invisible widget | No visible widget at all. Checks run in a hidden iframe and the token arrives via callback. |