Cloudflare's “checking your browser” page runs API, quirk and proof-of-work tests on top of TLS and IP reputation. Here's why real visitors get stuck in a loop.
You click a link, and instead of the page you get a holding screen: "Checking your browser before accessing…" on older Cloudflare pages, or "Verifying you are human" on newer ones, sometimes with a checkbox. You didn't fail a login or type anything wrong. It's one of the most common interruptions on the web, and the page explains almost nothing. Here's what it actually checks, what Cloudflare already knows about you before it starts, and why an ordinary visitor can end up stuck in a loop.
Key Takeaways
- The screen is a Cloudflare challenge. A short script runs non-interactive tests in your browser (probing web APIs, looking for engine-specific quirks, small proof-of-work tasks) and reports the results before the site loads. Cloudflare says this takes about one second on average.
- That's only half the picture. Cloudflare has already scored your connection: your TLS/HTTP-2 handshake signature, your IP's reputation, and the network (ASN) that IP belongs to. That score largely decides whether you're challenged at all.
- Loops are usually caused by your setup, not by anything suspicious you did: a blocked clearance cookie, a system clock that's way off, an extension that tampers with browser APIs, a shared VPN/datacenter/CGNAT IP, an in-app browser, or a heavily hardened browser.
- Cloudflare has largely retired visual CAPTCHAs. It says it cut the CAPTCHAs it serves by 91%, and it replaced the CAPTCHA on its challenge pages with Turnstile's checkbox.
- A challenge is a gate: a pass/fail verdict on one request. Fingerprint and bot-detection checkers are mirrors. They show you your signals without deciding anything.
What the page is actually doing
When a site's Cloudflare security settings decide a request needs a closer look before it reaches the origin server, Cloudflare returns a challenge page instead of the page you asked for. Cloudflare says this flow (called "Managed Challenge") first runs "a series of small non-interactive JavaScript challenges gathering more signals about the visitor." Per Cloudflare, those challenges "include, but are not limited to, proof-of-work, proof-of-space, probing for web APIs, and various challenges for detecting browser-quirks." You only get something to click if those results, and how the browser behaved while running them, don't settle the question.
Cloudflare doesn't publish the exact list of tests (that would be a how-to guide for evading them), but the inputs fall into two distinct groups:
-
Signals the script collects inside your browser.
- Proof-of-work and proof-of-space tasks make the browser spend a small, measurable amount of real computing power and memory.
- API probing checks whether the features a browser claims to support really exist and behave the way that browser's engine does.
- Quirk detection looks for small, engine-specific oddities that a real Chrome, Firefox, or Safari has, but a script faking its User-Agent usually doesn't.
These are the same kinds of signals this site's fingerprint check shows you, and the same consistency logic described in Headless Browser Detection: automated and spoofed browsers tend to contradict themselves in ways real ones don't.
-
Signals from the connection itself, which no page script can see. Your browser's TLS handshake and HTTP/2 settings form a signature of their own, separate from anything JavaScript reports. TLS Fingerprinting Explained covers how that signature is built. Cloudflare also looks at the reputation of the IP address you're connecting from and the network (ASN) that owns it. All of this is evaluated before any challenge script runs. A home IP with a clean history starts in a much better position than a datacenter IP that has been reported for scraping.
No single signal decides the outcome. Like the layered detection described in Bot Detection Techniques, a challenge combines many weak signals into one verdict.
Why real people get stuck in a loop
If you're the one watching the spinner, this is the useful part. None of these means you did anything wrong. They're just situations a challenge can't read clearly:
- Blocked or cleared cookies. When you pass, Cloudflare sets a clearance cookie (
cf_clearance) so your next requests skip the check. If your browser settings or an extension block cookies for that site, or clear them on every load, the pass never sticks and every request looks brand new. - A system clock that's way off. A clearance only lasts for a limited time. If your device's clock is wrong by enough, a clearance you just received can look expired or not yet valid, and you're sent back to the check.
- An extension that tampers with browser APIs. Some anti-fingerprinting extensions spoof or block browser APIs, or add random noise to them (Canvas noise injectors are a common example). That doesn't just hide you. It can make your browser contradict itself, which looks very different from an ordinary browser that simply reveals less.
- A shared VPN, datacenter, or CGNAT IP. Many VPN exit nodes and most datacenter IP ranges have been used for abusive traffic by someone at some point. Carrier-grade NAT (CGNAT) puts many mobile or home-internet customers behind a single address. That reputation belongs to the IP, not to you, which is why VPN users see challenges far more often than average.
- An in-app browser. Links you open inside a social media or messaging app load in a built-in browser (a WebView). It often exposes fewer APIs, and less consistent ones, than a regular browser.
- An outdated or heavily hardened browser. Quirk and API checks expect your browser to behave like a known, current engine. A very old version can look like automation rather than a person. So can privacy settings that disable APIs and minimize your fingerprint. A challenge can't easily tell "a person who hardened their browser" from "a script pretending to be a browser."
What to try when you're stuck
- Allow cookies for the site (or turn off the extension or setting that clears them), then reload.
- Set your device's date, time, and time zone to update automatically.
- Turn off privacy or ad-blocking extensions for that one site, or try a fresh browser profile.
- If the link opened inside an app, open it in your regular browser instead.
- Switch networks (mobile data instead of Wi-Fi, or a different VPN server) so you get an IP with a different reputation.
- If nothing works, contact the site and include the Ray ID shown at the bottom of the challenge page. Each site sets its own security level, and the Ray ID lets the site's operators find your request.
From CAPTCHA to an invisible check
A traditional CAPTCHA makes you actively prove something, like reading distorted text or picking out traffic lights. It interrupts every visitor it's shown to, real people included. Cloudflare explained why it moved away from that in The end of the road for Cloudflare CAPTCHAs. Managed Challenge "defers the decision about whether to serve a visual puzzle" until the browser has provided more information. Cloudflare says that let it cut the CAPTCHAs it serves by 91%, and cut the time visitors spend on a challenge "from an average of 32 seconds to an average of just one second."
The same approach led to Turnstile. Cloudflare describes it as running "a series of in-browser tests, checking browser characteristics, native browser APIs, and asking the browser to pass lightweight tests (ex: proof-of-work tests, proof-of-space tests)." In Cloudflare is free of CAPTCHAs; Turnstile is free for everyone, Cloudflare says it "replaced the CAPTCHA challenge with our own checkbox solution." So the checkbox you sometimes see isn't a puzzle. It's a quick final step for cases where the background tests didn't settle the question. "Prove you're human" no longer means "solve something for us." It means "let us watch your browser for a second."
A gate, not a mirror
A Cloudflare challenge is a gate. It gives a pass/fail verdict on one specific request, and that verdict has a real consequence: you get through, or you don't.
Tools like CreepJS, BrowserLeaks, and the anonymity scores compared in Why Fingerprint Test Tools Disagree About You are mirrors. They show you your own signals, broadly the same kinds a challenge looks at, but with no verdict and no consequence. Running your browser through one won't tell you whether a particular site's challenge will let you in. That also depends on the site's settings and on connection data those tools can't see. What they do show is what a challenge could notice.
Where to go from here
To see which automation-related signals your browser gives off, use BrowserInsight's bot detection tool. It checks navigator.webdriver, headless flags, and traces of Selenium, Puppeteer, and Playwright one by one, rather than giving you a single verdict. If it flags something on your everyday browser, that's a likely reason a challenge is reacting to you.
If you think your IP is the trigger, the IP check shows the ASN and blacklist status of the address you're using. The VPN and proxy check shows whether that address looks like a VPN, proxy, or datacenter. If you aren't using a VPN at all but still get treated like you are, Flagged as a VPN When You Aren't explains how CGNAT, outdated IP databases, and wrongly labeled networks (ASNs) cause that.
Frequently Asked Questions
Is "checking your browser" the same as a CAPTCHA?
No. A CAPTCHA asks you to solve something. A "checking your browser" page runs automatic tests you don't interact with and reports the results. On Cloudflare, you're only asked to click a checkbox when those tests are inconclusive, and even then there's no puzzle.
Why do I keep getting the same challenge on every page load?
Almost always because the challenge can't remember that you already passed. Usually that's because cookies are blocked or cleared, you're browsing in private/incognito mode, or an extension clears site data. Without that memory, every request starts from scratch. If cookies look fine, check your system clock next.
Does using a VPN make this happen more often?
Yes, and it's usually because of the VPN's exit IP, not anything about you. VPN and datacenter addresses are shared by many people. If abusive traffic has come from that address before, its bad reputation carries over to your visit. Switching to a different server often helps.
Can a fingerprint or anonymity checker tell me if I'll pass a specific site's challenge?
Not directly. Those tools are mirrors: they show the signals a challenge could read, without giving a verdict. A challenge is a gate. It combines those signals with the site's own security settings and with connection data (TLS, IP reputation, ASN) that a page-level tool never sees. Only the challenge itself can tell you whether you pass.
Is a hardened, privacy-focused browser more likely to get challenged?
It can be. That's not because privacy tools are suspicious. It's because heavily spoofed or blocked signals can look like a script trying to hide that it's automated. Two very different intentions happen to look alike. It doesn't mean privacy-focused users are being targeted on purpose.
Recommended Reading
- Bot Detection Techniques: How to Identify Bots and Crawlers
- Headless Browser Detection: How Selenium & Playwright Are Caught
- Behavioral Bot Detection: How Sites Spot Inhuman Mouse Moves
- TLS Fingerprinting Explained: How JA3/JA4 Identify Your Client
- Flagged as a VPN When You Aren't: Why It Happens
- Why Fingerprint Test Tools Disagree About You
