What is the _cfuvid cookie?
The _cfuvid cookie is used by Cloudflare's Web Application Firewall (WAF) to distinguish between individual users who share the same IP address for rate-limiting purposes.
Table of Contents
About the _cfuvid cookie
| Vendor | Cloudflare |
|---|---|
| Category Category The functional category of the technology, such as Web Analytics or Social Media. Learn more | Data Management (DMP) |
| Consent Category Consent Category The consent category this cookie most commonly falls under across sites we scan, normalized into four standard categories. Learn more | Strictly Necessary |
| Prevalence | Very Common |
| Popularity Popularity Popularity is calculated from our dataset of 4.5B+ cookies analyzed across hundreds of millions of web pages. Learn more | Found on 23.2% of scanned pages |
| Expiration Type | Session |
| Party Type Party Type Whether the cookie is first-party or third-party. Learn more | Mixed |
| Risk Level Risk Level Rates how sensitive the data stored by this cookie is (High, Medium, or Low) based on data classification and distribution. Learn more | Low |
| Vendor Privacy Policy | https://www.cloudflare.com/privacypolicy/ |
| Vendor Website | https://www.cloudflare.com |
What is the purpose of the _cfuvid cookie?
The _cfuvid cookie is a strictly necessary security cookie set by Cloudflare when a Rate Limiting Rule using the cf.unique_visitor_id field is configured. Its primary function is to allow Cloudflare's Web Application Firewall (WAF) to accurately distinguish between multiple unique visitors who are accessing a website from behind a shared IP address, such as a Network Address Translation (NAT) gateway or a corporate network.
By assigning a unique session identifier to the browser, Cloudflare can track the request rate of individual users rather than aggressively grouping all traffic from the shared IP address. This ensures that rate limits - designed to prevent DDoS attacks, API abuse, or brute-force attempts - are applied fairly to the specific user exceeding the threshold, without inadvertently blocking innocent visitors who happen to share the same public IP. The cookie does not facilitate cross-site tracking or behavioral profiling. In practice, this cookie is very frequently set not by the host website's own Cloudflare configuration but by embedded third-party services that sit behind their own Cloudflare instances, which is why it most often appears as a third-party cookie even though the mechanism itself is identical.
What are the Privacy Risks of the _cfuvid cookie?
Risk Level: Low
The risk level is Low because this cookie functions exclusively as a security and infrastructure tool to support Cloudflare's Web Application Firewall (WAF) rate limiting. It operates as a short-lived session identifier to accurately monitor request rates from users behind shared IP addresses, preventing false-positive blocking of legitimate traffic. It does not track visitors across different domains, nor does it collect data for advertising, behavioral profiling, or third-party data sharing.
How to Remove the _cfuvid cookie from a Website
How this cookie is removed depends on who is actually setting it. If the cookie originates from the website's own Cloudflare instance (the first-party case), the administrator can modify the active Rate Limiting Rules in their Cloudflare dashboard to disable the option that uses the cf.unique_visitor_id field, or remove Cloudflare's proxy/WAF from the site entirely (which also eliminates the cookie but removes the associated performance and security benefits). Note that disabling this option means Cloudflare will group all users behind a shared IP together, which can cause legitimate users to be inadvertently blocked during high traffic. However, in the majority of observed deployments this cookie is set by embedded third-party services that run behind their OWN Cloudflare instances. In those cases the site owner cannot edit the vendor's Cloudflare configuration; the only way to stop the cookie is to remove or reconfigure the third-party embed/script that loads the vendor, since the cookie is mandatory to that vendor's service and cannot be disabled independently from the host site's side.