The documented WARP check also accepts the consumer client.
\nCloudflare’s Require WARP documentation says that this posture attribute checks all versions of WARP, including the consumer version. Administrators must enable the WARP posture check and add the corresponding selector to an Access policy before the application evaluates it. The setup also requires the documented Gateway proxy setting and a supported deployed client. The resulting check establishes that the client is running; it should not be interpreted as a statement that the device belongs to a particular organization’s managed fleet.
\nSource: Cloudflare — Require WARP.
\nThis applies specifically to the Access WARP posture selector. Other Cloudflare posture checks, enrollment controls, and organization-specific signals have separate definitions and prerequisites.
\nDSE recommends naming posture requirements according to the evidence they actually provide. If an application requires a company-managed endpoint, document that requirement separately and choose appropriate organization or management signals after reviewing their vendor documentation. Avoid a policy description such as “corporate devices only” when its sole device condition is this WARP attribute. Review whether the selector belongs in Include or Require alongside identity conditions, and keep the intended admission matrix with the application owner’s approval.
\nIn a controlled test, compare the intended organization client with other eligible client states where permitted. Record the actual policy outcome without assuming a running client proves asset ownership. Review the complete Access policy and verify that every required management condition is represented by an appropriate check.
\nCloudflare — Require WARP. Reviewed October 15, 2026.
", "content_text": "The documented WARP check also accepts the consumer client.\nSource facts\nCloudflare’s Require WARP documentation says that this posture attribute checks all versions of WARP, including the consumer version. Administrators must enable the WARP posture check and add the corresponding selector to an Access policy before the application evaluates it. The setup also requires the documented Gateway proxy setting and a supported deployed client. The resulting check establishes that the client is running; it should not be interpreted as a statement that the device belongs to a particular organization’s managed fleet.\nSource: Cloudflare — Require WARP.\nApplicability\nThis applies specifically to the Access WARP posture selector. Other Cloudflare posture checks, enrollment controls, and organization-specific signals have separate definitions and prerequisites.\nDSE recommendation\nDSE recommends naming posture requirements according to the evidence they actually provide. If an application requires a company-managed endpoint, document that requirement separately and choose appropriate organization or management signals after reviewing their vendor documentation. Avoid a policy description such as “corporate devices only” when its sole device condition is this WARP attribute. Review whether the selector belongs in Include or Require alongside identity conditions, and keep the intended admission matrix with the application owner’s approval.\nVerification\nIn a controlled test, compare the intended organization client with other eligible client states where permitted. Record the actual policy outcome without assuming a running client proves asset ownership. Review the complete Access policy and verify that every required management condition is represented by an appropriate check.\nOfficial reference\nCloudflare — Require WARP. Reviewed October 15, 2026.", "content_markdown": "The documented WARP check also accepts the consumer client.\n\n## Source facts\n\nCloudflare’s Require WARP documentation says that this posture attribute checks all versions of WARP, including the consumer version. Administrators must enable the WARP posture check and add the corresponding selector to an Access policy before the application evaluates it. The setup also requires the documented Gateway proxy setting and a supported deployed client. The resulting check establishes that the client is running; it should not be interpreted as a statement that the device belongs to a particular organization’s managed fleet.\n\nSource: [Cloudflare — Require WARP](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/require-warp/).\n\n## Applicability\n\nThis applies specifically to the Access WARP posture selector. Other Cloudflare posture checks, enrollment controls, and organization-specific signals have separate definitions and prerequisites.\n\n## DSE recommendation\n\nDSE recommends naming posture requirements according to the evidence they actually provide. If an application requires a company-managed endpoint, document that requirement separately and choose appropriate organization or management signals after reviewing their vendor documentation. Avoid a policy description such as “corporate devices only” when its sole device condition is this WARP attribute. Review whether the selector belongs in Include or Require alongside identity conditions, and keep the intended admission matrix with the application owner’s approval.\n\n## Verification\n\nIn a controlled test, compare the intended organization client with other eligible client states where permitted. Record the actual policy outcome without assuming a running client proves asset ownership. Review the complete Access policy and verify that every required management condition is represented by an appropriate check.\n\n## Official reference\n\n[Cloudflare — Require WARP](https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/require-warp/). Reviewed October 15, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/", "url": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-15" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not equate Cloudflare’s WARP posture check with enrollment in your organization", "item": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/#article", "identifier": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/", "url": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/", "headline": "Do not equate Cloudflare’s WARP posture check with enrollment in your organization", "description": "The documented WARP check also accepts the consumer client.", "abstract": "The documented WARP check also accepts the consumer client.", "articleBody": "The documented WARP check also accepts the consumer client.\nSource facts\nCloudflare’s Require WARP documentation says that this posture attribute checks all versions of WARP, including the consumer version. Administrators must enable the WARP posture check and add the corresponding selector to an Access policy before the application evaluates it. The setup also requires the documented Gateway proxy setting and a supported deployed client. The resulting check establishes that the client is running; it should not be interpreted as a statement that the device belongs to a particular organization’s managed fleet.\nSource: Cloudflare — Require WARP.\nApplicability\nThis applies specifically to the Access WARP posture selector. Other Cloudflare posture checks, enrollment controls, and organization-specific signals have separate definitions and prerequisites.\nDSE recommendation\nDSE recommends naming posture requirements according to the evidence they actually provide. If an application requires a company-managed endpoint, document that requirement separately and choose appropriate organization or management signals after reviewing their vendor documentation. Avoid a policy description such as “corporate devices only” when its sole device condition is this WARP attribute. Review whether the selector belongs in Include or Require alongside identity conditions, and keep the intended admission matrix with the application owner’s approval.\nVerification\nIn a controlled test, compare the intended organization client with other eligible client states where permitted. Record the actual policy outcome without assuming a running client proves asset ownership. Review the complete Access policy and verify that every required management condition is represented by an appropriate check.\nOfficial reference\nCloudflare — Require WARP. Reviewed October 15, 2026.", "datePublished": "2026-10-15T13:33:29+00:00", "dateModified": "2026-10-15T13:36:17+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/cloudflare-warp-check-consumer-client-boundary/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not equate Cloudflare’s WARP posture check with enrollment in your organization" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 255, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Require WARP", "url": "https://developers.cloudflare.com/cloudflare-one/reusable-components/posture-checks/client-checks/require-warp/" } } ] } }