# Set up Protect

Clerk Protect runs inside Clerk's authentication flows. Applications that use Clerk's prebuilt components on current Clerk SDKs need no changes to their sign-up flow, though you might need to update your Content Security Policy. Before you enable a system protection, [check the requirements](#requirements). Then [enable the protections you need](#enable-protections) in the Clerk Dashboard and [test them in a development instance](#test-protections-before-production) before enabling them in production.

## Requirements

- **ClerkJS 6.39.0 or later.** Clerk's Core 3 SDKs, such as `@clerk/nextjs` 7 and `@clerk/react` 6, load the latest ClerkJS 6 automatically. Applications on older SDKs load ClerkJS 5 and need to [upgrade to Core 3](https://clerk.com/docs/guides/development/upgrading/upgrade-guides/core-3.md). If your application bundles `@clerk/clerk-js` instead of loading it from Clerk, update the package. To see which version your site runs, open it in a browser and run `window.Clerk.version` in the developer console.
- **A Content Security Policy that allows Protect.** If your application sets a Content Security Policy, add the directives in [Configure Clerk Content-Security-Policy headers](https://clerk.com/docs/guides/secure/best-practices/csp-headers.md). They cover Device Intelligence and challenges.
- **Support for challenges in custom sign-up flows.** If you enable **Challenge suspicious sign-ups** with a custom sign-up flow, your flow must be able to display a challenge. Clerk's prebuilt components do this automatically, but the Dashboard can't verify a custom flow. See [Handle sign-up challenges in your custom flow](https://clerk.com/docs/guides/development/custom-flows/authentication/bot-sign-up-protection.md).

For details on what each protection checks and requires, see [Challenge suspicious sign-ups](https://clerk.com/docs/guides/secure/bot-protection.md) and [Require Device Intelligence checks](https://clerk.com/docs/guides/protect/system-protections/require-device-intelligence.md).

## Enable protections

1. In the Clerk Dashboard, under **Protect**, navigate to the [**Protections**](https://dashboard.clerk.com/~/protect/rules) page.
2. Find the protection's row and check its **Status**.
   - If **Disabled**, select **Enable**. In the dialog, toggle on **Enable**, then select **Save**.
   - If **Enabled**, the protection is already active. To disable it, select **Manage**, toggle off **Enable**, then select **Save**.
   - If **Setup required**, select **Manage** and complete the setup. Clerk loads your application and checks its ClerkJS version and Content Security Policy against the [requirements](#requirements) before you can enable any protection. If the check can't reach your application, such as one running on your machine, confirm the requirements yourself and select **Bypass checks**. This can't be undone.

## Test protections before production

Each instance has separate protection settings. Enable a protection in your [development instance](https://clerk.com/docs/guides/development/managing-environments.md#development-instance), test a sign-up from a browser, and review any Protect events in [Application Logs](https://clerk.com/docs/guides/dashboard/logs/application-logs.md#protect-events) before you enable it in production.

> To test [Challenge suspicious sign-ups](https://clerk.com/docs/guides/secure/bot-protection.md), don't use a [Testing Token](https://clerk.com/docs/guides/development/testing/overview.md#testing-tokens). Testing Tokens skip that protection.

---

## Sitemap

[Overview of all docs pages](https://clerk.com/docs/llms.txt)