Verification challenge FAQ
Quick answers to the questions we hear most about the verification widget.
Why am I seeing a verification challenge?
The widget appears on the three unauthenticated forms — sign-in, forgot password, and reset password — to protect them against automated abuse. It is a sibling defense layer to Two-Factor Authentication (MFA) Overview, but it runs even before you enter your password.
Why don't I see the challenge every time?
We use Cloudflare Turnstile in managed mode. Cloudflare scores each request invisibly and only shows you a visible challenge when something about the request looks unusual. For most users, on most days, the widget verifies invisibly and you don't notice it.
Why does the challenge appear again after I just solved one?
Tokens are single-use and short-lived. Any form submission that fails — for example, a mistyped password or an expired reset link — burns the current token. The widget remounts automatically and you'll verify once more before retrying.
What data does Cloudflare receive?
Cloudflare receives request metadata: your IP address, user agent, and a small amount of browser-environment information. It does not receive your email address, password, or any other form fields. It does not use cross-site tracking cookies or behavioural fingerprinting.
Do passkey or single sign-on logins skip the challenge?
Yes. Passkey paths are bot-resistant by construction — only a real device with a hardware-bound credential can complete them — so they bypass the CAPTCHA gate entirely. The same applies to enterprise single sign-on if your organisation has it configured.
Can I disable the challenge?
There is no user-side toggle. The widget is either enabled for the whole deployment or disabled for the whole deployment by your administrator. We err on the side of leaving it enabled because the threat it protects against (credential stuffing) is one of the most common ways accounts get compromised.