Skip to content
Cloudflare Docs

Configure Browser Isolation

Cloudflare Browser Isolation seamlessly executes active webpage content in a secure isolated browser to protect users from zero-day attacks, malware, and phishing.

Browser Isolation provides unique and transparent protection for your users using methods that surpass the capabilities of a traditional secure web gateway. This section focuses primarily on Browser Isolation for external services, assuming that most traffic from a device or a network is being forwarded to Cloudflare. For other applications of Browser Isolation, refer to the Zero Trust Web Access (ZTWA) learning path.

As a note, Cloudflare’s Browser Isolation technology was built to be used for 100% of your user’s daily browsing. These recommendations do not suggest that you should limit or be cautious with your use of Browser Isolation, but instead help identify practical outcomes that balance technology with actualized security benefits.

Get the most out of Browser Isolation

If your organization is interested in implementing Browser Isolation, there are a few methods that Cloudflare recommends exploring.

Block copy, paste, and upload/download for shadow IT

As you have begun deploying Cloudflare Zero Trust, you may have started to visualize user traffic patterns using Shadow IT Discovery. This feature gives you visibility into detected SaaS applications that your users use. Administrators can categorize applications and services on the basis of proper organizational use. If you do not use Shadow IT Discovery and instead maintain a similar list manually or with other tools, you can port that data into a Zero Trust list, update it via the API, and achieve the same outcomes.

You can control potential risk and shape user behavior without applying heavy-handed block policies by applying policies to isolate user traffic to applications that match your defined categories. You can then set additional parameters in the policy, such as the ability to restrict copy/paste and upload/download. Users can still access information in the tools — if not use the tools to a lesser extent — while you minimize the risk of data loss.

  1. In Zero Trust, go to Gateway > Firewall Policies.

  2. In the HTTP tab, select Add a policy.

  3. Name the policy.

  4. In Traffic, add the following expression:

    SelectorOperatorValueAction
    Hostin listShadow ITIsolate

  5. In Configure policy settings, turn on the following options:

    • Disable copy / paste
    • Disable file downloads
    • Disable file uploads

  6. Select Create policy.

Isolate all “gray-listed” traffic

A common method for using Browser Isolation to protect against unknown or zero-day threats can dramatically enhance your security posture: Separate all HTTP traffic into known acceptable, known malicious, and unknown buckets. Once your sort your traffic, isolate everything in the unknown bucket.

You can accomplish this by creating the following policies:

  • Explicit allow policies for all of your known applications and trusted websites using either Cloudflare application definitions or a list
  • Explicit block policies for all security risks, known malicious traffic, and against-acceptable-use intentional denies
  • A policy to isolate all other traffic in this middle

In this context, if some traffic is unknown to your organization, Cloudflare will isolate it by default. Cloudflare will also prevent any malicious code from being executed client side, with additional controls available.

  • Allow known applications and websites:

    SelectorOperatorValueAction
    Domainin listKnown DomainsAllow

  • Block security risks:

    SelectorOperatorValueAction
    Security RisksinAll Security RisksBlock

  • Isolate all other traffic:

    SelectorOperatorValueAction
    Hostmatches regex.*Isolate

Many vendors that may exist within your security framework support URL manipulation. You can use URL manipulation as an on-ramp for Browser Isolation to add additional security controls.

For example, vendors like Zscaler and Proofpoint allow you to prepend links to URLs in a static or dynamic format. You can prepend the clientless isolation link generated for your Cloudflare account to derive additional security benefits for potentially risky clicks. This means that if you have traffic not sent through Cloudflare today (such as through another proxy), you can potentially prepend specific filtered requests with a link to automatically send the traffic to a Cloudflare isolated browser session without an endpoint agent installed.

flowchart TB
    %% Accessibility
    accTitle: Browser Isolation architecture
    accDescr: Flowchart describing the order of operations for user traffic for in-line Browser Isolation.

    %% User traffic
    user(["User goes to </br>risky.example.com"])--"Connects to"-->cloud[Third-party SWG cloud]

    %% Third-party SWG
    cloud-->warning[Third-party interstitial block or warning page]
    warning--"Appends Cloudflare subdomain"-->biso

    %% Browser Isolation
    subgraph cf [Cloudflare global network]
    biso[[Cloudflare Clientless Web Isolation]]
    inline(["Isolated browser"])
    biso--"User's browser goes to </br>customer.cloudflareaccess.com/browser/risky.example.com"-->inline
    end
Cloudflare DashboardDiscordCommunityLearning CenterSupport Portal