Blog
What Cloudflare Turnstile, Cloudflare challenge pages and Cloudflare's error pages mean for code that automates sites it is allowed to, how to handle each from Scrapy to Selenium, and how CAPTCHA-solving services compare. Every article cites its sources and is dated.
Written by ZeroCaptcha Engineering. Articles are drafted with AI tools, then checked against the API's code and the primary sources each one cites.
Cloudflare Turnstile solverCloudflare WAF and 5-second challenge solverGuidesGlossaryBlog RSS feed
Explainer
- Cloudflare 5-Second Challenge: What It Is Now and How to Pass ItThe Cloudflare 5-second challenge is the old name for its JavaScript challenge page. What replaced it, how to recognise it, and how to pass it with an API.Updated 3 October 2026
- Cloudflare WAF Bypass: What Gets an Automated Client ThroughLooking for a Cloudflare WAF bypass? What each WAF action does to a scraper, which ones can be passed, which only the site owner can lift, and the request.Updated 3 October 2026
- AI CAPTCHA Solvers and Cloudflare Turnstile: How Solving WorksWhat an AI CAPTCHA solver really does, why image recognition does not apply to Cloudflare Turnstile, and how automated Turnstile solving works, without hype.Updated 1 October 2026
- Choosing Proxies for Cloudflare Turnstile and Challenge SolvingWhen a Cloudflare Turnstile task needs a proxy at all, residential vs datacenter vs mobile, sticky sessions, regions, and the rules a proxy must meet.Updated 1 October 2026
- Cloudflare Managed vs Non-Interactive vs Interactive ChallengeCloudflare's three challenge types, including the one called JS Challenge: what each does, who issues it, which clearance passes which, and what bots meet.Updated 1 October 2026
- Cloudflare Turnstile Ephemeral IDs: What Site Owners SeeWhat a Cloudflare Turnstile ephemeral ID is, who gets it, how it shows in siteverify, how sites use it against fake sign-ups, and what it means for automation.Updated 1 October 2026
- Cloudflare Turnstile Pre-Clearance: How It Issues cf_clearanceCloudflare Turnstile pre-clearance issues a cf_clearance cookie with the token, so later requests skip WAF challenge rules up to the level a site sets.Updated 1 October 2026
- Cloudflare Turnstile Retry and Refresh-Expired Settings ExplainedWhat Cloudflare Turnstile's retry, retry-interval, refresh-expired and refresh-timeout settings do, their defaults, and when to change them.Updated 1 October 2026
- Cloudflare Turnstile Token: What It Is and What It ProvesWhat a Cloudflare Turnstile token is, where the widget puts it, how siteverify checks it, what it proves, and how a solving API produces one.Updated 1 October 2026
- Cloudflare Under Attack Mode: What It Means for Automated ClientsCloudflare's I'm Under Attack mode puts a Managed Challenge in front of every visitor. What it does, how to spot it, and what scrapers and API clients can do.Updated 1 October 2026
- Cloudflare Verified Bots: How a Crawler Gets RecognizedWhat Cloudflare's verified bots are, the rules a crawler must meet, the three ways to prove who it is (Web Bot Auth, IP lists, reverse DNS) and how to apply.Updated 1 October 2026
- Cloudflare WAF Rules Explained: Challenge, Block, Skip, LogCloudflare WAF custom rule actions in Cloudflare's words, terminating vs non-terminating, plan limits, rule order, and what each action means for a bot.Updated 1 October 2026
- Cloudflare Waiting Room vs a Challenge Page: What Crawlers SeeA Cloudflare Waiting Room is a queue, not a bot check. How to tell it from a challenge page, how its cookie and JSON mode work, and how to wait your turn.Updated 1 October 2026
- Cloudflare's Challenge Platform and cf_chl Parameters ExplainedWhat /cdn-cgi/challenge-platform, window._cf_chl_opt, the cf_chl cookies and the __cf_chl_ URL parameters are, and what an automated client should do.Updated 1 October 2026
- The __cf_bm Cookie vs cf_clearance: Cloudflare's Bot CookiesWhat Cloudflare's __cf_bm cookie holds, when it is set and when it expires, how it differs from cf_clearance, and how an automated client should handle both.Updated 1 October 2026
- TLS Fingerprints, JA3 and JA4: Why Cloudflare Challenges curlHow JA3 and JA4 fingerprint a TLS handshake, what Cloudflare shows Bot Management customers, and why Python with Chrome's user agent still stands out.Updated 1 October 2026
- What Is a WAF? And What a Cloudflare WAF Challenge MeansA web application firewall filters HTTP traffic by rules. How Cloudflare's WAF is built, and what a scraper sees when one of its rules blocks or challenges it.Updated 1 October 2026
Tutorial
- CAPTCHA Solver MCP Server: ZeroCaptcha in Claude Code and CursorSet up the ZeroCaptcha MCP server in Claude Code and Cursor: its four tools, the settings, keeping the key out of your repository, and when to use it.Updated 1 October 2026
- Cloudflare Turnstile in Chrome Extensions and Content ScriptsWhy a Cloudflare Turnstile widget can't live in a Manifest V3 extension page, what to do instead, and how a content script fills a Turnstile form on a page.Updated 1 October 2026
- Cloudflare Turnstile in React, Vue and Next.js FormsHow React, Vue, Nuxt and Next.js apps render Cloudflare Turnstile and send its token, how to verify it on the server, and how automation submits these forms.Updated 1 October 2026
- Crawlee and Cloudflare Turnstile: A PlaywrightCrawler TutorialHandle Cloudflare Turnstile forms in a Crawlee PlaywrightCrawler: read the sitekey, get a token from an API, fill the form, and set timeouts that fit.Updated 1 October 2026
- Crawlee for Python and Cloudflare Turnstile: A Crawler TutorialHandle Cloudflare Turnstile forms in Crawlee for Python's PlaywrightCrawler: read the widget, solve the token, fill and submit, with timeouts that fit.Updated 1 October 2026
- Cypress and Cloudflare Turnstile: Test Your Own Forms End to EndWhy Cypress can't pass a live Cloudflare Turnstile widget, and how to test your forms with Cloudflare's testing sitekeys and secrets, per environment, in CI.Updated 1 October 2026
- Go Colly and Cloudflare Turnstile: A Scraper TutorialA Go Colly collector that finds a Cloudflare Turnstile sitekey with OnHTML, gets a token from a solving API over net/http, and posts the form.Updated 1 October 2026
- got-scraping and Cloudflare Turnstile: A Node.js Form TutorialPost a Cloudflare Turnstile form from Node.js with got-scraping: consistent browser headers, a cookie jar, a token from an API, and what replaces it now.Updated 1 October 2026
- Hand Off a CAPTCHA API Integration to an AI Coding AssistantA walkthrough: give Claude Code, Cursor, Copilot or Codex ZeroCaptcha's integration brief and rule files, then check its work against the brief's checklist.Updated 1 October 2026
- n8n and Cloudflare Turnstile: Solve a Form in a WorkflowBuild an n8n workflow that reads a Cloudflare Turnstile sitekey, gets a token from a solving API with HTTP Request nodes, waits in a loop, and submits the form.Updated 1 October 2026
- nodriver and zendriver With Cloudflare Turnstile: A TutorialHandle a Cloudflare Turnstile form in nodriver or zendriver: read the widget, get a token from an API, fill the field, call the callback and submit, all async.Updated 1 October 2026
- Playwright and Cloudflare "Just a Moment": Using cf_clearanceWhy Playwright gets stuck on Cloudflare's "Just a moment..." page, how to detect it, and how to load a cf_clearance cookie with its user agent and proxy.Updated 1 October 2026
- Puppeteer Stealth and Cloudflare Turnstile: What It Can't FixWhat puppeteer-extra-plugin-stealth changes, why Cloudflare Turnstile can still refuse a stealthy browser, and a Puppeteer fallback that gets the token.Updated 1 October 2026
- Python httpx and requests: Solve Cloudflare Turnstile at ScaleGet Cloudflare Turnstile tokens from Python with requests for one form, or httpx and asyncio for hundreds at once, with retries that never pay twice.Updated 1 October 2026
- Scrapy and Cloudflare Turnstile: Submit Forms Without a BrowserA Scrapy spider that reads a Cloudflare Turnstile sitekey from the HTML, gets a token from an API without blocking the crawl, and posts the form.Updated 1 October 2026
- scrapy-playwright and Cloudflare Turnstile: JS-Rendered FormsWhen the Cloudflare Turnstile widget only exists after JavaScript runs, let scrapy-playwright render the page, then solve the token, fill the form and parse.Updated 1 October 2026
- Selenium and Cloudflare Turnstile: undetected-chromedriver vs APIWhat undetected-chromedriver and SeleniumBase UC Mode do about Cloudflare Turnstile, where they stop, and a Selenium fallback that gets a token from an API.Updated 1 October 2026
- Simple Cloudflare Turnstile on WordPress: Solving and TestingHow WordPress sites add Cloudflare Turnstile with the Simple Cloudflare Turnstile plugin, Contact Form 7, WPForms or Gravity Forms, and how to automate them.Updated 1 October 2026
- Switch Captcha Provider in 10 Minutes: 2Captcha and createTaskMove Cloudflare Turnstile solving from 2Captcha or a createTask-style service by changing two settings, then check six details before full traffic.Updated 1 October 2026
Comparison
- Captcha Solver Extensions vs a Solving API: When Each WorksBrowser extensions like Buster and NopeCHA vs a CAPTCHA-solving API: what each solves, why extensions struggle with Cloudflare Turnstile at scale, and costs.Updated 1 October 2026
- Cloudflare Bot Management vs Turnstile vs Challenge PagesWhat an automated client meets on a Cloudflare site: Bot Management scores, Bot Fight Mode, Turnstile widgets and challenge pages, and what each one needs.Updated 1 October 2026
- Cloudflare Turnstile vs reCAPTCHA vs hCaptcha: Full ComparisonCloudflare Turnstile, Google reCAPTCHA and hCaptcha side by side: how each checks visitors, tokens, siteverify, prices and limits, and what automation meets.Updated 1 October 2026
- WAF Challenges Across Vendors: AWS, Akamai, Fastly, SafeLineHow Cloudflare, AWS WAF, Akamai Bot Manager, Fastly Next-Gen WAF and SafeLine challenge a request: status codes, headers, cookies and lifetimes, side by side.Updated 1 October 2026
Troubleshooting
- Cloudflare "Just a Moment" and "Checking Your Browser" PagesWhat Cloudflare's "Just a moment..." and "Checking your browser" pages are, why they appear, what visitors can do, and how automation passes them.Updated 3 October 2026
- Cloudflare 403 Forbidden When Scraping: Which Cause Is It?A Cloudflare 403 has five usual causes: a challenge page, a WAF block, a browser-signature ban, an IP or country ban, or the origin. How to tell them apart.Updated 1 October 2026
- Cloudflare Challenge Loop: Why 'Just a moment...' RepeatsWhy a Cloudflare 'Just a moment...' page keeps coming back: the documented causes, IP changes mid-solve, lost cookies, clocks, and fixes for code.Updated 1 October 2026
- Cloudflare Challenges in Electron and Desktop Apps: FixesWhy an Electron app's requests hit Cloudflare challenge pages, and the fixes: Chromium's network stack, one session, a steady user agent, and cf_clearance.Updated 1 October 2026
- Cloudflare Error 1006/1007/1008: Your IP Address Has Been BannedCloudflare errors 1006, 1007, 1008 and 1106 mean the site owner banned your IP address. What the docs say, who can lift it, and why not to rotate IPs.Updated 1 October 2026
- Cloudflare Error 1009: Country or Region Banned, ExplainedCloudflare error 1009 means the site owner banned the country or region of your IP address. Why it happens, who can lift it, and when a proxy region is fine.Updated 1 October 2026
- Cloudflare Error 1010: Banned Based on Your Browser's SignatureCloudflare error 1010 comes from Browser Integrity Check. What it looks for, what an HTTP client should send, and what only the site owner can change.Updated 1 October 2026
- Cloudflare Error 1015 Rate Limited: Causes and Backoff in CodeCloudflare error 1015 means a site's rate limiting rule blocked you. How the rules count, the 429 status, and Python backoff that stops the retries.Updated 1 October 2026
- Cloudflare Error 1020 Access Denied: What It Means for AutomationCloudflare error 1020 means a site owner's firewall rule blocked your request: what the page shows, why no token lifts it, and what to do next.Updated 1 October 2026
- Cloudflare Turnstile Error Codes: 110200, 300xxx, 600xxxWhat each Cloudflare Turnstile widget error code means, from 110100 to 600xxx: Cloudflare's current table, which errors to retry, and how to fix each one.Updated 1 October 2026
- Cloudflare Turnstile in Headless Browsers: Why It Fails and FixesWhy Cloudflare Turnstile fails in headless Chrome, Playwright and Puppeteer, what Cloudflare says about automated browsers, and a fix that uses an API token.Updated 1 October 2026
- Cloudflare Turnstile Siteverify Errors: Why a Token Is RejectedEvery Cloudflare Turnstile siteverify error code with Cloudflare's meaning and fix, and why a site rejects a token when you automate a form.Updated 1 October 2026
- Please Unblock challenges.cloudflare.com to Proceed: FixesWhy a Cloudflare page says to unblock challenges.cloudflare.com, how to fix it in a browser or network, and what it means for automated clients.Updated 1 October 2026