Removing friction from CSAM detection
Running a website or online community means dealing with the reality that some users will try to abuse the platform to distribute the worst kinds of content, including child sexual abuse material (CSAM). For smaller operators, the tools to fight this have historically been out of reach, or at least cumbersome to deploy.
Cloudflare first launched its CSAM Scanning Tool several years ago, bringing technology previously limited to large social media platforms to any website on the Internet. The tool works in partnership with the National Center for Missing and Exploited Children (NCMEC), Interpol, and many other organizations dedicated to child protection.
The original version, however, still carried a significant adoption barrier: site operators had to create their own NCMEC credentials and share them with Cloudflare before reporting could work. That step proved too confusing or burdensome for many small site owners. A change introduced in February removes that requirement entirely, and monthly adoption of the tool has since increased by 1,600%.
How the scanning works
CSAM detection relies on partner organizations maintaining hash lists of known illegal images. A hash is a numerical representation of an image, effectively a digital fingerprint. Cloudflare checks hashes of content uploaded to a customer's site against those maintained by NCMEC to identify matches.
A critical component is fuzzy hashing, which goes beyond simple exact matches. Even a minor modification to an image — a filter, a crop, or added noise — completely changes its conventional hash. A fuzzy hash creates a "perceptual fingerprint" that stays similar to the original even when the image is altered. This allows the tool to flag matches with high confidence even when abusers attempt to disguise content.
While the credential-sharing step is gone, site operators are still responsible for filing their own primary reports with NCMEC or their regional equivalent.
The current workflow
The tool now involves three straightforward steps for Cloudflare customers:
- Enable the tool: Activate the CSAM Scanning Tool on your Cloudflare zone and verify your notification email address.
- Scan and detect: Cloudflare scans your cached content, creating a fuzzy hash of each image. A match against a known bad hash generates a detection event.
- Remediate: Cloudflare blocks the URL to any identified matches and notifies you so you can take further action.
Looking ahead
The goal is straightforward: tools for a safer Internet should be equally available to everyone, not just the largest companies. The CSAM Scanning Tool is available to enable on any Cloudflare website today, with further technical details in the developer documentation. Cloudflare also encourages operators to join its community discussions around this technology as it continues to evolve.
