How the fix works
On a paid Cloudflare plan you host your own HTML template for the challenge page and point Cloudflare at it. The snippet below reads the real referrer on the challenge page, before it is lost, and stores it in a short-lived first-party cookie named ezrefcap. Ezoic reads that cookie and attributes the visit to the correct source. The cookie expires after 30 minutes, so it never affects a later genuine direct visit.
-
Design and host your custom challenge-page template
- On a paid plan, design a complete HTML challenge page and host it where Cloudflare can fetch it — on your own web server or a Cloudflare Snippet. The template must include the
::CF_WIDGET_BOX::placeholder exactly once inside the<body>— that is where Cloudflare injects the challenge widget. (On the Error Pages flow the managed-challenge interstitial historically uses::CAPTCHA_BOX::;::CF_WIDGET_BOX::is the current token and works for all challenge types — include just one of them, not both.)
- On a paid plan, design a complete HTML challenge page and host it where Cloudflare can fetch it — on your own web server or a Cloudflare Snippet. The template must include the
-
Add the capture snippet to that template
- Add the snippet anywhere inside the
<body>of your hosted challenge-page template, next to the required::CF_WIDGET_BOX::placeholder. Keep the whole template to 1.5 MB (1,500,000 bytes) or less. Do not add areferrermeta tag or a custom Content-Security-Policy / Referrer-Policy, do not define your ownwindow._cf_chl_opt, and do not block/cdn-cgi/challenge-platform/— any of these will break the Cloudflare challenge. -
<script> (function () { try { var ref = document.referrer; if (!ref) return; var refHost = ""; try { refHost = new URL(ref).hostname.toLowerCase(); } catch (e) { return; } var here = (location.hostname || "").toLowerCase(); if (!refHost || refHost === here) return; // ignore internal / challenge-reload if (!/(?:^|;\s*)ezrefcap=/.test(document.cookie)) { // first-touch within the visit window document.cookie = "ezrefcap=" + encodeURIComponent(ref) + "; path=/; max-age=1800; samesite=lax; secure"; } } catch (e) {} })(); </script>
- Add the snippet anywhere inside the
-
Point Cloudflare at the page and publish
-
In the Cloudflare dashboard, open your domain and go to Rules → Error Pages (the “Custom Errors” feature). Edit the Managed Challenge / I’m Under Attack Mode page type, choose Custom page, and enter the URL of the template you hosted. Cloudflare fetches the page and inlines its CSS and JavaScript, then serves it during challenges. Newly challenged visits start preserving their real referrer right away — no changes are needed in your Ezoic settings. For Cloudflare’s own reference, see Custom Challenge Pages.
-
