# What you can do to resist Cloudflare?
| 🖼 | 🖼 |
| --- | --- |
|  |  |
[Matthew Prince (@eastdakota)](https://twitter.com/eastdakota)
"*I’d suggest this was armchair analysis by kids – it’s hard to take seriously.*" [t](https://www.theguardian.com/technology/2015/nov/19/cloudflare-accused-by-anonymous-helping-isis)
"*That was simply unfounded paranoia, pretty big difference.*" [t](https://twitter.com/xxdesmus/status/992757936123359233)
"*We also work with Interpol and other non-US entities*" [t](https://twitter.com/eastdakota/status/1203028504184360960)
"*Watching hacker skids on Github squabble about trying to bypass Cloudflare's new anti-bot systems continues to be my daily amusement.* 🍿" [t](https://twitter.com/eastdakota/status/1273277839102656515)
---
_click me_
## Website consumer
- If the website you like is using Cloudflare, tell them not to use Cloudflare.
- Whining on social media such as Facebook, Reddit, Twitter or Mastodon makes _no_ difference. [Actions are louder than hashtags](https://twitter.com/phyzonloop/status/1274132092490862594).
- Try to contact to the website owner _if_ you want to make yourself useful.
[Cloudflare said](https://github.com/Eloston/ungoogled-chromium/issues/783):
```
We recommend that you reach out to the administrators for the
specific services or sites that you run into issue with and share your experience.
```
If you don't [ask for it](PEOPLE.md), website owner *never* know this problem.
[Successful example](https://counterpartytalk.org/t/turn-off-cloudflare-on-counterparty-co-plz/164/5).
You have a problem? [Raise your voice now](https://github.com/maraoz/maraoz.github.io/issues/1). Example below.
```
You are just helping corporate censorship and mass surveillance.
https://codeberg.org/crimeflare/stop_cloudflare/src/branch/master/README.md
```
```
Your web page is in the privacy-abusing private walled-garden of CloudFlare.
See https://codeberg.org/crimeflare/stop_cloudflare/
```
- Take some time to read website's privacy policy.
- ...if the website is behind Cloudflare or website is using services connected to Cloudflare.
It must explain what the "_Cloudflare_" is, and ask for permission to share your(user) data with Cloudflare. Failure to do so will result in the breach of trust and the website in question should be avoided.
An _acceptable_ privacy policy example is [here](https://archive.is/bDlTz) (look at "Subprocessors" > "Entity Name")
```
I've read your privacy policy and I cannot find the word "Cloudflare".
I refuse to share data with you if you continue to feed my data to Cloudflare.
See https://codeberg.org/crimeflare/stop_cloudflare/
```
For example, [Liberland Jobs](https://archive.is/daKIr) [privacy policy](https://docsend.com/view/feiwyte) says:
... is not going to happen.
Cloudflare have their own "privacy policy", and there's no way to hear customer's privacy policy needs.
Cloudflare [loves doxxing people](https://www.reddit.com/r/GamerGhazi/comments/2s64fe/be_wary_reporting_to_cloudflare/).
Here's a good example for website's signup form.
AFAIK, zero website do this. Will you trust them?
```
By clicking “Sign up for XYZ”, you agree to our terms of service and privacy statement.
You also agree to share your data with Cloudflare and also agrees to cloudflare's privacy statement.
If Cloudflare leak your information or won't let you to connect to our servers, it's not our fault. [*]
[ Sign up for XYZ ] [ I disagree ]
```
[*] [People's voice](PEOPLE.md)
- Try not to use their service. Remember you are being watched by Cloudflare.
- [I'm in your TLS, sniffin' your passworz](https://codeberg.org/crimeflare/stop_cloudflare/media/branch/master/image/iminurtls.jpg)
- Search for other website. There are alternatives and opportunites on the internet!
- Convince your friends to use [Tor](https://www.torproject.org/download/tor/) on the daily basis.
- Anonymity should be the standard of the open internet!
- Do note that the Tor project [dislikes this stop_cloudflare project](HISTORY.md).
------
_click me_
## Add-ons
- If your browser is `Firefox`, `Tor Browser`, or `Ungoogled Chromium` use one of these add-ons below.
- If you want to add _other_ new add-on ask about it [here](issues) first.
| Name | Developer | Support | Can Block | Can Notify | support Chrome |
| -------- | -------- | -------- | -------- | -------- | -------- |
| [Bloku Cloudflaron MITM-Atakon](subfiles/about.bcma.md) | Crimeflare #Addon | [Link](https://codeberg.org/crimeflare/stop_cloudflare/issues) | **Yes** | **Yes** | **Yes** |
| [Ĉu ligoj estas vundeblaj al MITM-atako?](subfiles/about.ismm.md) | Crimeflare #Addon | [Link](https://codeberg.org/crimeflare/stop_cloudflare/issues) | No | **Yes** | **Yes** |
| [Ĉu ĉi tiuj ligoj blokos Tor-uzanton?](subfiles/about.isat.md) | Crimeflare #Addon | [Link](https://codeberg.org/crimeflare/stop_cloudflare/issues) | No | **Yes** | **Yes** |
| [Block Cloudflare MITM Attack](https://trac.torproject.org/projects/tor/attachment/ticket/24351/block_cloudflare_mitm_attack-1.0.14.1-an%2Bfx.xpi)
[**DELETED BY TOR PROJECT**](HISTORY.md) | nullius | [Link](https://github.com/nym-zone/block_cloudflare_mitm_fx), [Link](https://codeberg.org/crimeflare/stop_cloudflare/issues) | **Yes** | **Yes** | No |
| [TPRB](http://34ahehcli3epmhbu2wbl6kw6zdfl74iyc4vg3ja4xwhhst332z3knkyd.onion/) | Sw | [Link](http://34ahehcli3epmhbu2wbl6kw6zdfl74iyc4vg3ja4xwhhst332z3knkyd.onion/) | **Yes** | **Yes** | No |
| [Detect Cloudflare](https://addons.mozilla.org/en-US/firefox/addon/detect-cloudflare/) | Frank Otto | [Link](https://github.com/traktofon/cf-detect) | No | **Yes** | No |
| [True Sight](https://addons.mozilla.org/en-US/firefox/addon/detect-cloudflare-plus/) | claustromaniac | [Link](https://github.com/claustromaniac/detect-cloudflare-plus) | No | **Yes** | No |
| [Which Cloudflare datacenter am I visiting?](https://addons.mozilla.org/en-US/firefox/addon/cf-pop/) | 依云 | [Link](https://github.com/lilydjwg/cf-pop) | No | **Yes** | No |
- "[Decentraleyes](https://addons.mozilla.org/en-US/firefox/addon/decentraleyes/)" can stop connection to "CDNJS (Cloudflare)".
- It prevents a lot of requests from reaching networks, and serves local files to keep sites from breaking.
- The developer replied: "[very concerning indeed](https://github.com/Synzvato/decentraleyes/issues/236#issuecomment-352049501)", "[widespread usage severely centralizes the web](https://github.com/Synzvato/decentraleyes/issues/251#issuecomment-366752049)"
------
_click me_
## Website owner / Web developer
- Do not use Cloudflare solution, Period.
- You can do better than that, *right*? Here's how to [remove Cloudflare subscriptions, plans, domains, or accounts](https://support.cloudflare.com/hc/en-us/articles/200167776-Removing-subscriptions-plans-domains-or-accounts).
| 🖼 | 🖼 |
| --- | --- |
|  |  |
- Want more customers? You know what to do. Hint is "_above line_".
- Hello, you wrote "[We take your privacy seriously](https://it.slashdot.org/story/19/02/19/0033255/stop-saying-we-take-your-privacy-and-security-seriously)" but I got "_Error 403 Forbidden Anonymous Proxy Not Allowed_". Why are you blocking Tor? Or VPN?
- Using Cloudflare will increase chances of an outage. Visitors can't access to your website if your server is down *or Cloudflare is down*. Did you really think [Cloudflare never go down](https://www.ibtimes.com/cloudflare-down-not-working-sites-producing-504-gateway-timeout-errors-2618008)? [Another](https://twitter.com/Jedduff/status/1097875615997399040) [sample](https://twitter.com/search?f=tweets&vertical=default&q=Cloudflare%20is%20having%20problems). [Need more](PEOPLE.md)?
- Using Cloudflare to proxy your "API service", "Client(software) [update server](https://forums.clamwin.com/viewtopic.php?t=4915)" or "RSS feed" will harm your customer. A customer called you and said "_I can't use your API anymore_", and you have no idea what is going on. Cloudflare can [silently block your customer](PEOPLE.md). [Do you think it is okay](https://twitter.com/Skyfusion89/status/1101596592426151937)?
- There are many RSS reader client and RSS reader online service. Why are you publishing RSS feed if you're not allowing people to subscribe?
- Do you need HTTPS certificate? Use "[Let's Encrypt](https://letsencrypt.org/)" or just buy it from CA company.
- Do you need [DNS server](https://twitter.com/IngeniousAppsIA/status/1187730384492077057)? Can't set up your own server? Then how about [1984 FreeDNS](https://www.1984hosting.com/), [Hurricane Electric Free DNS](https://dns.he.net/), [Dyn.com](https://dyn.com/dns/) or [this (warning: Admin delete your account if you use TOR)](https://freedns.afraid.org/)?
- Looking for hosting service? "Free" only? Well, how about [Onion Service](http://vww6ybal4bd7szmgncyruucpgfkqahzddi37ktceo3ah7ngmcopnpyyd.onion/en/security/network-security/tor/onionservices-best-practices), [Free Web Hosting Area](https://freewha.com/), [Autistici/Inventati Web Site Hosting](https://www.autinv5q6en4gpf4.onion/services/website), [Github Pages](https://pages.github.com/), [Surge](https://surge.sh/) or [this](https://www.reddit.com/r/webdev/comments/5m8tr4/how_do_i_host_the_website_i_just_built/dc1qpk7/)?
- [Cloudflare Alternatives](subfiles/cloudflare-alternatives.md)
- Are you using "_cloudflare-ipfs.com_"? Do you know [Cloudflare IPFS is bad](PEOPLE.md)?
- Install Web Application Firewall (such as OWASP) and Fail2Ban on _your_ server and configure it _properly_.
- Blocking Tor is not a solution. Don't punish everyone just for small bad users.
- If you want to know more alternative solutions, take a look at [this blog's "Alternative solutions" section](http://www.unixsheikh.com/articles/stay-away-from-cloudflare.html).
- Redirect or block "_Cloudflare Warp_" users from accessing your website. And provide a reason if you can.
> IP list is from "[Cloudflare’s current IP ranges](cloudflare_inc/)".
> Method A: Just block them
```
server {
...
deny 173.245.48.0/20;
deny 103.21.244.0/22;
deny 103.22.200.0/22;
deny 103.31.4.0/22;
deny 141.101.64.0/18;
deny 108.162.192.0/18;
deny 190.93.240.0/20;
deny 188.114.96.0/20;
deny 197.234.240.0/22;
deny 198.41.128.0/17;
deny 162.158.0.0/15;
deny 104.16.0.0/12;
deny 172.64.0.0/13;
deny 131.0.72.0/22;
deny 2400:cb00::/32;
deny 2606:4700::/32;
deny 2803:f800::/32;
deny 2405:b500::/32;
deny 2405:8100::/32;
deny 2a06:98c0::/29;
deny 2c0f:f248::/32;
...
}
```
> Method B: Redirect to warning page
```
http {
...
geo $iscf {
default 0;
173.245.48.0/20 1;
103.21.244.0/22 1;
103.22.200.0/22 1;
103.31.4.0/22 1;
141.101.64.0/18 1;
108.162.192.0/18 1;
190.93.240.0/20 1;
188.114.96.0/20 1;
197.234.240.0/22 1;
198.41.128.0/17 1;
162.158.0.0/15 1;
104.16.0.0/12 1;
172.64.0.0/13 1;
131.0.72.0/22 1;
2400:cb00::/32 1;
2606:4700::/32 1;
2803:f800::/32 1;
2405:b500::/32 1;
2405:8100::/32 1;
2a06:98c0::/29 1;
2c0f:f248::/32 1;
}
...
}
server {
...
if ($iscf) {rewrite ^ https://example.com/cfwsorry.php;}
...
}
We are sorry, but we can't serve you because your connection is being intercepted by Cloudflare.
Please read https://codeberg.org/crimeflare/stop_cloudflare for more information.
CLOUDFLARED;
die();
```
- Set up [Tor Onion Service](https://www.torproject.org/docs/onion-services.html.en) or I2P insite _if_ you believe in freedom and welcome anonymous users.
- Tor developers will thank you.
- Tor users will endorse your service! Pro-privacy!
- Ask for advice from other [Clearnet/Tor dual website operators](https://trac.torproject.org/projects/tor/wiki/org/projects/WeSupportTor) and make anonymous friends! :)
------
_click me_
## Software user
- Discord is using CloudFlare. Alternatives? We recommend [**Briar** (Android)](https://f-droid.org/en/packages/org.briarproject.briar.android/), [Ricochet (PC)](https://ricochet.im/), or [Tox over Tor Socks (Android/PC)](https://tox.chat/download.html).
- Briar includes Tor daemon so you don't have to install Orbot.
- Qwtch developers, Open Privacy (Canada), deleted stop_cloudflare project from their git service without notice.
- If you use Debian GNU/Linux, or any derivative, subscribe to [bug #831835](https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831835). And if you can, help verify the patch, and help the maintainer come to the right conclusion on whether it should be accepted.
- Always recommend these browsers.
| Name | Developer | Support | Comment |
| -------- | -------- | -------- | -------- |
| [Ungoogled-Chromium](https://ungoogled-software.github.io/ungoogled-chromium-binaries/) | Eloston | [Link](https://codeberg.org/Eloston/ungoogled-chromium/) | PC (Win, Mac, Linux) _Not Tor_ |
| [Bromite](https://www.bromite.org/fdroid) | Bromite | [Link](https://github.com/bromite/bromite/issues) | Android _Not Tor_ |
| [Tor Browser](https://www.torproject.org/download/) | Tor Project | [Link](https://support.torproject.org/) | PC (Win, Mac, Linux) _Tor_|
| [Tor Browser Android](https://www.torproject.org/download/) | Tor Project | [Link](https://support.torproject.org/) | Android _Tor_|
| [Onion Browser](https://itunes.apple.com/us/app/onion-browser/id519296448?mt=8) | Mike Tigas | [Link](https://github.com/OnionBrowser/OnionBrowser/issues) | Apple iOS _Tor_|
| [GNU/Icecat](https://www.gnu.org/software/gnuzilla/) | GNU | [Link](https://www.gnu.org/software/gnuzilla/) | PC (Linux) |
| [IceCatMobile](https://f-droid.org/en/packages/org.gnu.icecat/) | GNU | [Link](https://lists.gnu.org/mailman/listinfo/bug-gnuzilla) | Android |
| [Iridium Browser](https://iridiumbrowser.de/about/) | Iridium | [Link](https://github.com/iridium-browser/iridium-browser/) | PC (Win, Mac, Linux, OpenBSD) |
Other software's privacy is imperfect. This doesn't mean Tor browser is "_perfect_".
There is no 100% secure nor 100% private on the internet and technology.
- Don't want to use "Tor"? You can use _any browser_ with [Tor daemon](https://packages.debian.org/search?searchon=names&keywords=tor).
- Note that the Tor project [don't like this](https://support.torproject.org/tbb/tbb-9/). Use `Tor Browser` if you are able to do so.
- [How to use Chromium with Tor](subfiles/chromium_tor.md)
Let's talk about _other software's privacy_...
- **If you really need to use Firefox, pick "[Firefox ESR](https://www.mozilla.org/en-US/firefox/organizations/)"**. ESR is developed for company and organizations, thus _some_ spyware code is disabled by default. Portable version is [here](https://portableapps.com/apps/internet/firefox-portable-esr). But we tell you, Firefox is [horrible for privacy](https://www.reddit.com/r/privacytoolsIO/comments/81om92/what_are_the_differences_between_privacytoolsio/dv4orve/) in many ways.
- [Firefox - Spyware Watchdog](https://spyware.neocities.org/articles/firefox.html)
- [Firefox rejects free speech, bans free speech](https://web.archive.org/web/20200423010026/https://reclaimthenet.org/firefox-rejects-free-speech-bans-free-speech-commenting-plugin-dissenter-from-its-extensions-gallery/)
- ["100+ downvotes. It seems like asking a software company to stick to... software is just too much these days."](https://old.reddit.com/r/firefox/comments/gutdiw/weve_got_work_to_do_the_mozilla_blog/fslbbb6/)
- [Uh, why is Firefox showing me sponsored links in my URL bar?](https://www.reddit.com/r/firefox/comments/jybx2w/uh_why_is_firefox_showing_me_sponsored_links_in/)
- Remember, Mozilla is [using Cloudflare service](https://www.robtex.com/dns-lookup/www.mozilla.org). They're also using [Cloudflare's DNS service](https://www.theregister.co.uk/2018/03/21/mozilla_testing_dns_encryption/) on their product D'oh!
- Mozilla officially [rejected this ticket](https://bugzilla.mozilla.org/show_bug.cgi?id=1426618) and they [have](https://www.reddit.com/r/linux/comments/9hh3gc/to_unsuspecting_admins_firefox_continues_to_send/) / [too](https://mashable.com/2017/12/16/mr-robot-looking-glass-mozilla-firefox-backlash/) / [many](https://ungleich.ch/en-us/cms/blog/2018/08/04/mozillas-new-dns-resolution-is-dangerous/) / [problems](https://blog.mozilla.org/addons/2019/05/04/update-regarding-add-ons-in-firefox/comment-page-6/#comment-226187). Want more? [Mozilla - Devil Incarnate](https://digdeeper.neocities.org/ghost/mozilla.html).
- Firefox Focus(Firefox Klar) [is a joke](https://github.com/mozilla-mobile/focus-android/issues/1743). They promised to turn off telemetry but they [changed it](https://github.com/mozilla-mobile/focus-android/issues/4210).
- PaleMoon/Basilisk developer [loves Cloudflare](https://github.com/mozilla-mobile/focus-android/issues/1743#issuecomment-345993097). Pale Moon's Archive Server [hacked and spread malware for 18 Months](https://www.reddit.com/r/privacytoolsIO/comments/cc808y/pale_moons_archive_server_hacked_and_spread/). He also hate Tor users - "[Let it be hostile towards Tor. I think most sites should be hostile towards Tor considering its extremely high abuse factor.](https://github.com/yacy/yacy_search_server/issues/314#issuecomment-565932097)". (abuse rate over Tor is NOT "extremely high". there's a study about it)
- Waterfox have [severe "phones home" problem](https://spyware.neocities.org/articles/waterfox.html).
- Google Chrome is a [spyware](https://www.gnu.org/proprietary/malware-google.en.html). Google [profiles your activity](https://spyware.neocities.org/articles/chrome.html).
- SRWare Iron make too many [phones home connection](https://spyware.neocities.org/articles/iron.html). It also connect to google domains.
- Brave Browser [whitelist Facebook/Twitter trackers](https://www.bleepingcomputer.com/news/security/facebook-twitter-trackers-whitelisted-by-brave-browser/). Here's [more issues](https://spyware.neocities.org/articles/brave.html).
- [binance affiliate ID](https://twitter.com/cryptonator1337/status/1269594587716374528)
- Microsoft Edge lets Facebook [run Flash code behind users' backs](https://www.zdnet.com/article/microsoft-edge-lets-facebook-run-flash-code-behind-users-backs/).
- Vivaldi [does not respect your privacy](https://spyware.neocities.org/articles/vivaldi.html).
- Opera spyware level: [Extremely High](https://spyware.neocities.org/articles/opera.html)
- Apple iOS: you shouldn't be using iOS at all, mainly because it is [malware](https://www.gnu.org/proprietary/malware-apple.html).
Therefore we recommend above table only. _Nothing else_.
------
_click me_
## "Mozilla Firefox" user
- Don't use Firefox *Nightly*. It will send debug-level information to Mozilla servers without opt-out method. Mozilla servers are [behing Cloudflare](https://www.digwebinterface.com/?hostnames=www.mozilla.org%0D%0Amozilla.cloudflare-dns.com&type=&ns=resolver&useresolver=8.8.4.4&nameservers=).
- It is possible to prohibit Firefox to connect to Mozilla servers. Create a file "`/distribution/policies.json`". Mozilla's [policy-templates guide](https://github.com/mozilla/policy-templates/blob/master/README.md). Keep in mind this trick might stop working in later version because Mozilla likes to whitelist themselves. Use firewall and DNS filter to block them completely.
> "WebsiteFilter": {
> "Block": [
> "*://*.mozilla.com/*",
> "*://*.mozilla.net/*",
> "*://*.mozilla.org/*",
> "*://webcompat.com/*",
> "*://*.firefox.com/*",
> "*://*.thunderbird.net/*",
> "*://*.cloudflare.com/*"
> ]
> },
- ~~Report a bug on mozilla's tracker, telling them not to use Cloudflare/TRR.~~ There was a bug report on bugzilla. Many people were posted their concern, however the bug was hidden by the admin in 2018.
- To disable DoH, enter *about:config?filter=network.trr* in the address bar then set "*network.trr.mode*" to 5 to completely disable it. The value "5" [means "Off by choice"](https://gist.github.com/bagder/5e29101079e9ac78920ba2fc718aceec).
- [Change default DNS provider of firefox](subfiles/change-firefox-dns.md)
- If you would like to use non-ISP DNS, consider using [OpenNIC Tier2 DNS service](https://wiki.opennic.org/start)
 or any of non-Cloudflare DNS services.
- You can use Tor as DNS resolver. If you're not Tor expert, [ask question here](https://tor.stackexchange.com/).
> **How?**
> 1. Download [Tor](https://www.torproject.org/) and install it on your computer.
> 2. Add this line to "torrc" file. [DNSPort description](https://www.torproject.org/docs/tor-manual.html.en).
> DNSPort 127.0.0.1:53
> 3. Restart Tor.
> 4. Set your computer's DNS server to "127.0.0.1".
------
_click me_
## Action
- Tell others around you about the dangers of Cloudflare.
- Help improve this repository, both the lists, the arguments against it and the details.
- Document and make very public where things go wrong with Cloudflare (and similar companies), making sure to mention this repository when you do so ;)
- Get more people using Tor by default so they can experience the web from the perspective of different parts of the world.
- Start groups, in social media and meatspace, dedicated to liberating the world from Cloudflare.
- Where appropriate, link to these groups on this repository - this can be a place for coordinating working together as groups.
- Start a coop that can provide a meaningful non corporate alternative to Cloudflare.
- Let us know of any alternatives to help at least provide multiple layered defence against Cloudflare.
- If you are a Cloudflare customer, set your privacy settings, and wait for them to violate them. Then bring them under [anti-spam / privacy violation charges](https://twitter.com/thexpaw/status/1108424723233419264).
- If you are in the **United States of America** and the website in question is a bank or an accountant, try to bring legal pressure under the [Gramm–Leach–Bliley Act](https://en.wikipedia.org/wiki/Gramm%E2%80%93Leach%E2%80%93Bliley_Act), or the [Americans with DIsabilities Act](https://www.ada.gov/cguide.htm) and report back to us how far you get.
- If the website is a government site, try to bring legal pressure under the [1st Amendment of the US Constitution](https://en.wikipedia.org/wiki/First_Amendment_to_the_United_States_Constitution).
- If you are EU citizen, contact the website to send your personal information under the [General Data Protection Regulation](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation). If they refuse to give you your information, that's a violation of the law.
- For companies that claim to _offer service on their website_ try reporting them as "_false advertising_" to consumer protection organizations and BBB. Cloudflare websites are served by Cloudflare servers.
- The [ITU](https://www.itu.int/en/ITU-T/Workshops-and-Seminars/20181218/Documents/Geoff_Huston_Presentation.pdf) suggest in the US context that Cloudflare is starting to get big enough that antitrust law might be brought down upon them.
- It's conceivable that the GNU GPL v4 could include a provision against storing source code behind such a service, requiring for all GPLv4 and later programs that at least the source code is accessible via a medium that does not discriminate against tor users (or any other class of users or something?)
------
### Comments
```
There is always hope in resistance.
Resistance is fertile.
Even some of the darker outcomes (unfriendly AI takeover, coopting of the www, NSA MiTMing everything)
comes to be, the very act of resistance trains us to continue to destabilize the
dystopic status quo that results.
Resist!
```
```
Someday, you'll know why we wrote this.
```
```
There isn't anything futuristic about this. We have already lost.
```
### Now, what did you do today?
