Challenge residential proxies

Residential proxies route traffic through ordinary home internet connections, so automated sign-ups look like they come from real households. The people whose connections are used often don't know: a free app or a smart device on their network has enrolled them in a proxy network. Blocking that traffic would also turn away some of those people, so this protection challenges it instead. The challenge is an automatic check in the visitor's browser, so a real person has nothing to solve. Every automated sign-up through one of these proxies has to complete it too, and each one costs whoever is renting the proxy.

What it challenges

A sign-up is challenged when it comes from an IP address that's a known residential proxy, or that was used as a proxy recently. You choose how recently with the Proxy activity window setting.

This protection applies to sign-ups only. It never affects a sign-in.

What happens when a sign-up is challenged

The visitor's browser completes an automatic check, and the sign-up then continues. There's nothing for the visitor to solve. The check takes from a few seconds on a fast connection to a minute or more on a slow one, and if it doesn't finish, the account isn't created. See Challenges.

Each challenged sign-up appears as a protect.sign_up.challenged event in Application Logs.

Settings

How it works with other protections

Block sign-ups from suspicious network types doesn't target residential proxies, so this protection is usually what decides what happens to them. A residential proxy on a hosting network is blocked if you block hosting and data center networks.

Before you enable it

• Make sure challenges can run. See the challenge integration requirements.
• Check that Protect sees your visitors' IP addresses. See If you proxy Clerk's Frontend API.
• Some real people are checked too. People whose home connections are part of a proxy network get the check like anyone else. It takes longer on a slow connection, and a sign-up whose check doesn't finish isn't created.
• Expect a cost, not a wall. Residential proxy networks change constantly, and the challenge makes automated sign-ups through them more expensive rather than stopping all of them. Use it alongside other protections.
• Native apps aren't challenged. A sign-up from one of Clerk's native SDKs is let through. See Native apps.