Clientless Web Isolation Reaches General Availability
Cloudflare has announced that Clientless Web Isolation is now generally available. The feature provides a new entry point into Browser Isolation that combines Zero Trust Network Access (ZTNA) with remote browsing protections against zero-day exploits, phishing, and data loss. Users can protect their sessions on any device and any website, internal application, or SaaS offering without requiring software installation or certificate configuration on the endpoint.
Access to the remote browser is simplified to a direct hyperlink, formatted as https://<your-auth-domain>.cloudflareaccess.com/browser. From there, administrators and end users get several practical deployment patterns previously detailed in the beta announcement.
Key Use Cases
Consistent Secure Browsing for Teams
Analysts, researchers, and other staff can navigate directly to the Clientless Web Isolation endpoint and land in a remote browser session. This masks their public IP address and keeps their local device isolated from potentially malicious code hosted on the destination site.
Deep Linking for Suspicious Content
Untrusted hyperlinks and PDF documents can be rewritten to route through the clientless endpoint. For example, a link can be transformed to https://<authdomain>.cloudflareaccess.com/browser/https://www.example.com/suspiciouslink. This pattern fits naturally into security incident monitoring tools, help desks, and any workflow where users may encounter unknown links.
Integration with Existing Secure Web Gateways
Organizations running legacy secure web gateways can connect Browser Isolation through a custom redirecting block page. This approach enables safe browsing without the overhead of maintaining block lists, and example block pages are available in the developer documentation.
BYOD Access to Sensitive Data
Clientless Web Isolation addresses scenarios where users cannot rely on managed corporate devices — contractors, remote workers without a company machine, or employees in high-risk travel areas. The traditional answer, Virtual Desktop Infrastructure (VDI), was built for a time when most business software was desktop-based. With browser-hosted applications now the norm, VDI has become an expensive way to deliver BYOD support while still requiring complex network administration for DNS filtering and web gateway connectivity.
Traffic from the isolated browser to the internet or Cloudflare Access-protected applications is automatically inspected by the Secure Web Gateway. Administrators can require Gateway device posture checks for Clientless Web Isolation users with a few clicks in the dashboard.
Availability
Clientless Web Isolation is available to all Cloudflare Zero Trust subscribers with Browser Isolation added to their plan. Further details and configuration examples can be found in the beta announcement post and the developer documentation.
