Protections
Protections are defenses that Clerk builds and maintains, and that you can turn on for your application. Each one targets a specific kind of abuse, such as password guessing or sign-ups from cloud servers.
How protections work
- Each protection applies to specific steps. Some apply to sign-ups, some to sign-ins, and some to both. A few also apply when a user adds an email address. The Applies to column in Available protections shows which.
- Each protection takes one kind of action. Most block or challenge the attempt. Others lock the account, ask for a second factor, reject an email address, or limit how often something can be tried. The Action column shows which.
- Most are off until you turn them on. These are on by default: Challenge suspicious sign-ups and Lock accounts after failed sign-ins for new applications, and Device Trust for applications created after November 14, 2025. Bulk user enumeration protection is always on.
- Clerk also rate-limits sign-up and sign-in requests on every plan. Each IP address can only start so many sign-ups and sign-ins, and submit so many passwords and codes, in a short time. These limits aren't a protection you manage. See Frontend API requests.
Available protections
Included on every plan
Included in the Business plan
The following protections require the Business plan:
Protections that block or challenge
Protections whose action is Block or Challenge all work the way this section describes. For the other protections, each one's page explains when it applies and what the user sees.
When protections check an attempt
- Sign-ups: most protections act as soon as a sign-up starts. Block risky email domains acts when the email address is entered.
- Sign-ins aren't checked. These protections apply to sign-ups only, so they never stop existing users from signing in.
- Users you create yourself aren't checked. These protections don't apply to users you create with the Backend API, in the Clerk Dashboard, or by importing them.
- Automated tests aren't checked, with one exception. A sign-up that carries a valid Testing Token isn't checked by these protections, so end-to-end tests keep running. Require Device Intelligence checks still checks it.
What blocked users see
When a protection blocks a sign-up, the attempt doesn't go through. What the user sees depends on where it's blocked and which versions of Clerk's SDKs your application runs:
- Prebuilt components with
@clerk/ui1.36.0 or later and ClerkJS 6.34.1 or later show a screen explaining that the user can't continue, with a reference code. Core 3 SDKs load the latest versions automatically. The screen appears when the attempt is blocked on the first step, or when the user returns from a social or SSO provider. - A block at a later step, such as after the user enters a password or a verification code, shows a short error message instead of the full screen. So do older SDK versions.
- In a , the request fails with an error whose code is
action_blocked. See Error handling.
When a protection challenges an attempt instead, the user completes a verification step and then carries on.
When more than one protection matches
If more than one protection matches the same attempt, a block applies before a challenge.
Where decisions appear
Every block and challenge appears as a Protect event in Application Logs, so you can see what a protection is doing once it's on.
If you proxy Clerk's Frontend API
Several of these protections decide based on where an attempt comes from, so Protect needs each visitor's IP address. If you proxy Clerk's Frontend API through your own server, your proxy must send the visitor's IP address in the X-Forwarded-For header, as described in Configure your proxy server. Otherwise every attempt looks like it comes from your proxy, and those protections can block everyone or no one.
Plans
Some protections are included on every plan, and others require the Business plan. Each protection's page lists what it requires. See pricing.
Manage protections in the Dashboard
In the Clerk Dashboard, under Protect, navigate to the Protections page. It lists the protections on your application, each with its Status. To enable a protection, change its settings, or disable it, select the settings icon at the end of its row. Without the Business plan, a protection that requires it shows a lock icon and no status, and its settings icon leads to the upgrade. To test protections before you enable them in production, see Enable protections.
Feedback
Last updated on