Skip to main content
Encypher Logo

Content provenance on Cloudflare Workers Sign every article at the edge.

A Cloudflare Worker adds a signed label to every article as your CDNCDN: Content delivery network: servers around the world that keep copies of a site close to readers so pages load fast. serves it. The label shows who published the text and whether it changed. Deploy it in a few clicks. Signing is free for publishers.

Create a free accountDeploy to Cloudflare
A reader requests a page through a CDN edge worker; the worker fetches the page from your unchanged server, has Encypher sign the text, and serves the signed page, caching the signed copy for the next visit. If anything fails, the original page goes through.
The edge worker adds the label on the way out. Your server stays the same, signed copies are cached, and the page always loads.
A label in every article
Each article gets content provenanceContent provenance: The record of where a piece of content came from and how it changed, carried with the content itself.: a C2PA manifestC2PA manifest: The signed label itself: a small package inside a file that records who signed it, what they declared and how to check it. and invisible provenance markersProvenance markers: Encypher's general name for invisible characters that carry a signed label inside text. in its text, sentence by sentence.
Nothing changes at origin
The edge functionEdge function: A small program that runs on a CDN's servers and can change a page as it passes through to the reader. sits between readers and your origin serverOrigin server: The server where your site's pages are built and stored before a CDN delivers them.. It finds the article on WordPress, Ghost, Substack, Webflow, Hugo and custom HTML.
Never blocks a page
It is fail-openFail open: If signing is down, the page is served unsigned instead of failing, so readers never see an error.: if signing fails for any reason, readers get your original page.
Fast repeat visits
Signed results are cached in Workers KV, so repeat visits skip the signing call.

Set it up

  1. Claim your domain

    Create a free account and claim your domain. You get a worker credentialWorker credential: A secret key, tied to one verified domain, that lets an Encypher edge worker ask for signatures., a secret key tied to that domain.

    Create a free account

  2. Deploy the Worker

    Use Deploy to Cloudflare, set the route to *yourdomain.com/*, and save the credential as a secret.

    Deploy to Cloudflare

  3. Publish as usual

    The next request for each article is signed on its way out. Repeat visits get the cached copy.

  4. Check the label

    Open an article and look for the header X-Encypher-Provenance: active. Then paste a paragraph into the free checker.

    Open the free checker

Copied text keeps the label

Signed text copied into most apps and sites keeps its label; some apps strip the invisible characters and the check then finds no label; editing the words breaks the seal and the check shows the change.
Copy and paste keeps the label in most apps. Some apps strip it, and any edit shows up when the text is checked.

The markers sit between the letters, so they travel when a reader copies a paragraph into a document, a post or an AI prompt.

Some apps strip them. Any edit to the words shows up when the text is checked.

Check a paragraph

For engineers

Show the technical detail
name = "encypher-provenance"
main = "src/worker.js"
compatibility_date = "2026-04-01"

# Route, set in the Cloudflare dashboard: *yourdomain.com/*

[[kv_namespaces]]
binding = "PROVENANCE_CACHE"
id = "<your KV namespace id>"

[vars]
# Optional: point detection at your article body
# ARTICLE_SELECTOR = ".story-body"
Article detection
Eight checks in order: your selector override, the <article> tag, common CMS classes, Schema.org articleBody, <main>, JSON-LD, the densest paragraph cluster, then <body>.
What is sent
Only the visible article text, up to 51,200 characters by default. The API returns an embedding plan, and the worker writes the markers into the HTML at those positions.
Status header
X-Encypher-Provenance is active on a signed page, or skipped:oversized, skipped:empty or skipped:error when the page passes through unchanged.
Rights
Block attributes win over page meta tags, and page tags win over the rights profile in your dashboard. Rights are embedded only on requests that carry the worker credential.
Cache
The PROVENANCE_CACHE KV namespace holds the domain record and each article's embedding plan. The Deploy button provisions it; replace the placeholder id when you deploy by hand.
Source
github.com/encypherai/edge-provenance-worker. The Deploy button clones it into your Cloudflare account.

Keep reading

Create. Mark. Endure.

Sign every article you serve on Cloudflare.

Create a free accountTalk to us