Clicking Suspicious Links, Without the Risk
Email is still the primary attack vector for most organizations, yet users are expected to distinguish a malicious link from a benign one before clicking. Attackers deliberately blur this line by hosting malware on popular services and hiding URLs behind enticing buttons. Even the most vigilant employee will eventually click the wrong thing.
Cloudflare's Email Link Isolation, now integrated into its Area 1 email security product, attempts to solve this by allowing users to click without exposing corporate endpoints to the consequences. The trick is in how links are rewritten and where the browsing session actually occurs.
The Filtering Process
The first step is identifying suspicious domains. Instead of only relying on threat intelligence feeds, Cloudflare builds a dynamic list based on first-time sightings from its DNS resolver and classifiers from its Gateway product. New domains are often legitimate, and blocking them outright would break the flow of daily business. But attackers frequently stand up innocuous sites and weaponize them days later, once links are already sitting in inboxes. Cloudflare also flags infrastructure from large cloud providers that resists crawling and scanning, since threat actors are known to host malicious content there—even if links to a legitimate SharePoint site are common enough that blocking them is disruptive.
When Area 1 is deployed inline, it checks every link in an email against this list. If a domain looks suspicious, the link is automatically rewritten so that clicking it does not go straight to the website. Instead, the user lands on an interstitial warning page before the page opens in a remote browser.
The Interstitial Decision Point
The rewritten link leads to a warning where the user can either back out entirely or choose to proceed. If they continue, the website is loaded in a sandboxed Chromium instance running on Cloudflare’s network, not on the local machine. The user watches the page through an HTML5 remoting client.
From the user’s perspective, the session looks and feels like a normal browser tab because the remote page is streamed as vector instructions, not as pixels. This approach was designed to avoid the latency and fragility of legacy remote browser isolation solutions that rely on DOM-scrubbing or bandwidth-hungry pixel pushing from distant data centers. The payoff is that any malicious script or exploit executes inside the sandbox, and any suspicious file download is automatically blocked by default.
What the Protection Stops
- Credential theft from lookalike phishing pages
- Drive-by downloads and malicious payloads
- Malicious scripts running on end-user devices
- Zero-day browser exploits targeting corporate endpoints
Constant Reputation Reassessment
The system isn't static. As Cloudflare continuously evaluates each domain on the suspicious list, the behavior of corresponding links changes. If a site is confirmed benign, subsequent clicks on its links will open directly in the user's local browser. If the system reclassifies a site as malicious, all links pointing to it are immediately blocked, and users are met with an error telling them why they can't access it.
Improving the Zone of Trust
Since not every dangerous link has a clear-cut malicious reputation, Cloudflare’s Area 1 took the position that some emails are simply too risky to be trusted without a safety net. The links in those messages are rewritten even if they land in inboxes. The tradeoff is a subtle behavior difference for a small slice of everyday traffic, but the benefit is peace of mind for the rest of the corporate network.
Early Results and Availability
Now that Cloudflare has tested the feature internally for a month, it is opened for beta access. Availability is being rolled out to all Area 1 customers, with free access during the beta. Once the beta period ends, the feature will be included at no extra cost with the PhishGuard plan.
Customers interested in joining the beta can request access through Cloudflare's Email Link Isolation sign-up page. Future iterations will allow admins to link their Area 1 environment to Cloudflare Zero Trust, which will extend isolation policies, DLP controls, and in-line CASB inspection to email link traffic.
