How to Unblock Cloudflare: Why Cloudflare Thinks You Are a Bot

Reload the page after each step. Steps 1 to 7 are on your side; step 8 is the site owner's.

1. Reload once and wait a few seconds. A challenge page often clears on its own. Do not keep refreshing or switching networks while it runs: each new attempt starts the check again (our advice, not a Cloudflare quote).
2. Update the browser to the latest stable Chrome, Edge, Firefox or Safari. Cloudflare's troubleshooting page: "Ensure your web browser is updated to the latest stable version". Cloudflare gives limited support to browsers "more than five years old" or without security updates "in over two years" (Cloudflare: Supported browsers).
3. Allow JavaScript and cookies for the site. The check stores its result in a cookie; without it, you start over on every page.
4. Pause extensions for the site: ad blockers, script blockers, privacy tools, VPN or proxy extensions, user-agent switchers. Cloudflare's troubleshooting page: "Temporarily disable browser extensions, such as ad blockers or privacy tools". Or test in a private window, which rules out "extensions or cached data".
5. Clear that site's cookies and cached data. In Chrome: the icon left of the address, Site settings, Delete data. A stale or broken pass cookie then cannot be reused (our advice).
6. Turn off your VPN or proxy, or switch once from Wi-Fi to mobile data. Cloudflare's challenge-solve page: "Some virtual private networks (VPN) or proxies may interfere with Turnstile. Disable them temporarily to test", and "Try switching to another network, such as a mobile hotspot." If that fixes it, the network was the cause.
7. Use the full browser, or another browser or device. In-app browsers and WebViews "often have restricted JavaScript capabilities", and email preview windows usually cannot finish a check. Cloudflare's own test: "Switch to a different browser or device to see if the issue is specific to your current setup" (Cloudflare: Challenge solve issues, last updated Sep 8, 2026).
8. Still blocked? Send the Ray ID to the site owner, with the details in the box below. Only the owner can see which rule acted and change it; Cloudflare tells visitors to "contact the website administrator with the error code and Ray ID."

What to send the site owner when steps 1 to 7 do not help:

• the Ray ID from the bottom of the Cloudflare page (also the cf-ray response header);
• the date, time and time zone of the block;
• your public IP (open https://api.ipify.org in another tab) and whether a VPN was on;
• the error number (such as 1015 or 1020) or the page's words ("Verify you are human");
• the full URL, your browser and its version;
• for a check that keeps looping: a HAR file recorded with Preserve log on, and the browser console log from the same session.

With the Ray ID and the time, the owner can find the exact event in the Cloudflare dashboard and see which rule acted.

Selenium, Puppeteer, Playwright and curl are not supported for solving Cloudflare's challenges. If the error has a number, the error pages explain it: Cloudflare 403 Forbidden and Cloudflare Access Denied errors, such as 1020.

Cloudflare sits in front of the website and checks each request before the site sees it. The site owner decides how strict the checks are; Cloudflare supplies the signals. The "Challenges on Cloudflare-protected sites" part of Cloudflare's troubleshooting page names six reasons a visitor gets an unexpected or repeated challenge (Cloudflare: Challenges troubleshooting, last updated May 5, 2026). The same page also covers site-side issues (proxied hostnames, deprecated browsers, the Referer header and CORS preflight requests), which are in If you run the site.

A changing IP and rapid reloads make it worse. The pass cookie "is securely tied to the specific visitor and device it was issued to, preventing reuse across machines" (Cloudflare: Clearance). A connection that changes IP in the middle of a check (a VPN that reconnects, a rotating proxy, a phone moving between Wi-Fi and mobile data) or a burst of reloads looks less like one steady visitor, so hold one network until the check finishes (our advice, not on Cloudflare's list).

The symptoms point to the cause:

Error titles as in Cloudflare's 1xxx errors list; every code is explained in Cloudflare error codes.

How to unblock Cloudflare on Chrome

In Chrome, the usual causes are an extension or a site setting:

1. Open the site in an Incognito window (extensions are off there by default). If it works, an extension is the cause: open chrome://extensions and turn them off one at a time.
2. Check the site's permissions: click the icon left of the address, open Site settings, and set JavaScript and Third-party cookies (or Cookies) to allowed for the site.
3. Update Chrome from Settings > About Chrome and relaunch.
4. Turn off any proxy or VPN set in Chrome or in an extension, then retry.

Extensions that promise to skip the check are not the fix; see Cloudflare human verification bypass extensions.

A challenge that reloads itself again and again has one of five causes, in Cloudflare's own list (Cloudflare: Challenge solve issues):

1. Network issues: a poor or unstable connection stops the challenge from finishing.
2. Browser configuration: settings or extensions block the challenge's scripts.
3. An unsupported browser.
4. JavaScript disabled: the challenge needs it.
5. Detection errors: traffic that looks like a bot gets repeated challenges.

If the loop survives steps 1 to 7 above, report it to the site with the error code and the Ray ID. Cloudflare also asks for a HAR file recorded with Preserve log on and the browser console log from the same session, collected "before contacting the website administrator or Cloudflare Support".

Only the site owner can stop a block that keeps hitting real people or tools you trust. Cloudflare documents two ways in the WAF:

Cloudflare's own example of the expression route is a rule that blocks traffic from Amazon Web Services and Google Cloud Platform while still letting known bots through (Cloudflare: Challenges troubleshooting, "Allowlisting mitigation actions", last updated May 5, 2026).

Three cases catch site owners out. After a visitor solves a Challenge Page, your page's JavaScript "may read the value of document.referer, but it will not be accurate": it shows your own domain, not the site the visitor came from, so referral analytics that read it in the browser go wrong. A CORS preflight (OPTIONS) request carries no cookies, so it never sends cf_clearance and cannot pass a challenge page: do not challenge the paths your front end calls cross-origin. And for automated tests of your own pages, Cloudflare points to Turnstile test keys, because automated browsers are not supported for solving production challenges.

Cloudflare Bot Management gives every request a bot score from 1 to 99: "a score of 1 means Cloudflare is quite certain the request was automated", while 99 means it is quite certain a human sent it. The site owner then sets what happens at each score: allow, challenge or block (Cloudflare: Bot scores).

The score comes from several detection engines:

• Heuristics: matches requests against a database of known malicious fingerprints.
• Machine learning: analyzes request features across Cloudflare's traffic and produces most scores.
• JavaScript detections: lightweight scripts in the browser that identify headless browsers and other automation tools.
• Anomaly detection: compares traffic with the site's own baseline; Cloudflare says it "is deprecating the Anomaly Detection engine and is not onboarding new customers."

Two more inputs matter for scrapers: the TLS fingerprint (JA3 and JA4, for Enterprise Bot Management; see TLS and TCP fingerprinting) and IP reputation. Good bots that identify themselves, such as search engine crawlers, are grouped as verified bots and treated separately. On plans without Bot Management, the simpler Bot Fight Mode and the site's own rules do the same job with less detail.

The __cf_bm cookie is the cookie Cloudflare's bot products set to work: Cloudflare says it "is necessary for these bot solutions to function properly", that it "expires after 30 minutes of continuous inactivity", and that its contents, apart from time-related information, are encrypted so only Cloudflare can read them (Cloudflare cookies).

A second cookie, cf_clearance, "stores the proof of challenge passed". Together they explain two common experiences: a browser that blocks cookies is checked again and again, and a scraper that drops cookies between requests looks like a new visitor every time.

Cloudflare's own pages say "Verify you are human", "Just a moment..." or show an error number with a Ray ID. The message "Our systems have detected unusual traffic from your computer network" is Google's, not Cloudflare's: Google shows it when a network sends many automated searches. The causes overlap, a shared VPN or a script on your network, but the fixes are separate: on Cloudflare sites, follow the steps above; for Google, see how to avoid and solve CAPTCHAs.

Cloudflare states plainly that browser automation frameworks "such as Selenium, Puppeteer, Playwright, and Cypress, are not supported" for solving production challenges, and that curl and wget cannot solve them because they "lack JavaScript execution capabilities" (Cloudflare: Supported browsers). Scrapers also get flagged for reasons a person in a browser never hits:

• The client gives itself away. An HTTP library's TLS handshake and header order differ from a browser's, whatever User-Agent it sends.
• No JavaScript. The client never runs the challenge scripts, so it never gets the cookies a browser would.
• Automation traces. Headless Chrome and WebDriver differ from a normal Chrome in ways the JavaScript detections test.
• Data center IPs. Cloud and hosting networks carry more automated traffic, so their IPs start with less trust.
• Volume and rhythm. Hundreds of pages per minute, at fixed intervals, from one session.
• Dropped cookies. Every request starts a new session, with no history.

Each one has its own fix, and a proxy changes only the IP: how to bypass Cloudflare when scraping walks through them. Where a site allows collection of its public pages, ProxyField's sticky sessions keep one residential IP for 30 s to 36 h, so a session keeps its cookies and its IP together; the IP is not guaranteed if its exit node drops, so a scraper should expect an occasional change. Public pages only, follow the site's terms.

Where Cloudflare is a network that sites route all their traffic through, DataDome is a dedicated bot product that sites add to their own setup, with its own datadome cookie, JavaScript tag and slider CAPTCHA (DataDome: Cookies and stored data). The same habits help with both: a consistent, up-to-date browser, a trusted IP and a human pace. DataDome, PerimeterX and hCaptcha CAPTCHAs covers DataDome in detail.

Flagged because of a shared VPN or data center IP? ProxyField residential proxies give you IPs from real home internet providers, with country, region and city targeting and sticky sessions up to 36 h. From $1.95/GB, no subscription; start with the Easy Trial: 1 GB for $2.95. Traffic never expires, and all purchases are final.