Why IP addresses are no longer enough for fraud detection
IP-based identification worked well when the Internet was simpler. Today, mobile carrier NAT, VPNs, and CGNAT mean many users share the same IP address, so treating an IP as a single user is both inaccurate and unfair. Attackers exploit this by rotating through large IP pools to disguise repeated abuse.
Cloudflare's Turnstile CAPTCHA alternative now addresses this with Ephemeral IDs, which identify a client from aggregated browser and device signals rather than network-level information. When a visitor completes a Turnstile challenge, the service generates a unique, short-lived ID that can link actions to that client — no cookies or other persistent client-side storage required.
A better signal for grouping abuse
Ephemeral IDs are deliberately not fully unique and expire quickly. The same visitor interacting with Turnstile widgets on different Cloudflare customer sites receives different IDs, and the ID changes frequently enough that it cannot be used to track someone across multiple days.
This design gives fraud detection a middle ground between strong identifiers and IP addresses. In an attack scenario, a single human operator creating many fake accounts or attempting credential stuffing will produce a dense cluster, or "nest," of correlated Ephemeral IDs, even while rotating through thousands of IP addresses. Grouping requests by these IDs lets Cloudflare apply business logic such as discarding the traffic, requesting more verification, or stepping up to multi-factor authentication — without penalizing legitimate users who happen to share an IP range.
The visualization below illustrates the difference in fingerprinting power between the two approaches:
During an actual attack on one of Cloudflare's public forms, the collected data shows a nest of thousands of IP addresses tied together by commonly seen Ephemeral IDs:
From site verification to fraud response
For customers who want to act on Ephemeral IDs beyond Turnstile's built-in logic, the ID is included in the siteverify server-side validation response. A practical application is detecting fake signup waves: those can be logged next to account creation events and then monitored in real time or assessed retroactively for suspicious thresholds, making it possible to confirm the abuse was all generated by one client rather than by many genuine users.
The siteverify response for accounts with the feature enabled looks like this:
curl 'https://challenges.cloudflare.com/turnstile/v0/siteverify' --data 'secret=verysecret&response=<RESPONSE>'{
"success": true,
"error-codes": [],
"challenge_ts": "2024-09-10T17:29:00.463Z",
"hostname": "example.com",
"metadata": {
"ephemeral_id": "x:9f78e0ed210960d7693b167e"
}
}
Ephemeral IDs are only available through the siteverify response for Turnstile Enterprise and Bot Management Enterprise customers. That access requires contacting an account executive.
Ephemeral IDs are on by default
No code change is needed to receive the benefits of Ephemeral IDs for inbound requests. All sites protected by Turnstile automatically get the new logic for identifying abuse patterns, adding a layer of detection in cases where a single client tries to blend into a large IP range. Site owners already protecting login flows, signup forms, or high-value transactions get the extra abuse detection immediately, without needing to enable anything.
What arrived during Turnstile's first year
Turnstile has now been generally available for a year, during which it has blocked over one trillion bots and currently protects over 350,000 domains. Earlier in that period, Cloudflare launched a Turnstile plugin for Cloudflare Pages and partnered with Google Firebase for easier access to the tool. The Pre-Clearance feature also launched this year, tying Turnstile into the Cloudflare WAF Challenge action so security products can be used together with less plumbing. Ephemeral IDs extend that ongoing set of product improvements rather than replacing any of the existing anti-abuse mechanisms.
