iOS Web Clip login fails in kiosk mode with Web Content Filtering enabledSolved

For iOS Web Clips used in kiosk mode, there are two separate areas to check:

1. Browser availability in kiosk/app restrictions
   – If the Web Clip opens through Safari, Safari must not be blocked by the app allowlist or kiosk configuration applied to the device.
   – If you are using Web App Kiosk, configure the web app under the Web App kiosk section and use the Hexnode browser as the default browser where applicable.
2. Web Content Filtering whitelist
   – Web Content Filtering must allow the main website URL and any dependent authentication or verification domains used by that website.

If the Web Clip works when Web Content Filtering is disabled, but fails only when filtering is enabled, the issue is usually caused by a required secondary domain being blocked. Cloudflare verification, SSO, CAPTCHA, payment,

That matches what I’m seeing. The page itself loads after I allow the browser, but the Cloudflare/human verification part does not show the completed check. Without web filtering, the same login works normally.

In this case, whitelist the Cloudflare challenge domain used by the verification flow: https://challenges.cloudflare.com/.

Add this URL to the Web Content Filtering whitelist, save the policy, and allow the updated policy to reach the iPads. After the device syncs, reopen the Web Clip or restart the browsing session and test the login again. This domain is required for Cloudflare’s human verification challenge. If it is blocked, the main website may still load, but the verification step can remain blank, incomplete, or fail silently.

Adding https://challenges.cloudflare.com/ to the whitelist fixed it for us. The Web Clip now opens in kiosk mode and the Cloudflare verification completes as expected with Web Content Filtering enabled.

One extra note for anyone doing this with kiosk mode: if the device is locked down and loses network access, it will not receive policy changes until it comes back online. If Wi-Fi is manually configured, make sure Auto-Join is enabled before locking the device into kiosk. For managed deployments, pushing a Wi-Fi configuration profile is usually more reliable than manually joining the network on each iPad.