[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"$f3OQrWDDPF1MM-jtRwJJzHauuOjtft3SqHajed9PdCiM":3},{"title":4,"date":5,"dateModified":6,"datePublished":7,"dateModifiedISO":7,"image":8,"content":9,"faq":10,"metaTitle":39,"metaDescription":40,"author":41,"authorBio":6,"authorLinkedin":6,"authorTitle":6,"authorPhoto":42,"lastReviewed":6,"noindex":43,"researchBasis":6,"category":44,"readingTime":45,"related":46,"prev":63,"next":6,"toc":64,"takeaways":93},"Cloudflare Turnstile and Web Scraping: What Actually Clears It (2026)","20 Oct 2026",null,"2026-10-20","/img/news/bypass-cloudflare-turnstile-web-scraping-2026.png","\u003Cp>\u003Cstrong>Turnstile is not a puzzle you solve. It is a verdict being displayed to you.\u003C/strong> By the time the widget paints, Cloudflare has already fingerprinted your TLS handshake, checked your IP's reputation and probed the browser for automation traces. The checkbox is the receipt.\u003C/p>\n\u003Cp>That single framing explains most of the frustration around it: teams buy a CAPTCHA solver, wire it in, and nothing changes. The solver answers challenges. Turnstile is grading the client that asked for one.\u003C/p>\n\u003Ch2 id=\"choose-before-you-read\">Choose Before You Read\u003C/h2>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Your situation\u003C/th>\n\u003Cth>Do this\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>You bought a solver and it changed nothing\u003C/td>\n\u003Ctd>Expected — \u003Ca href=\"#what-captcha-solvers-can-and-cannot-do-here\">here is why\u003C/a>\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>You are getting challenged on every single page\u003C/td>\n\u003Ctd>Stop re-clearing. \u003Ca href=\"#solve-once-reuse-the-cookie\">Reuse the cookie\u003C/a>\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>You are on datacentre proxies\u003C/td>\n\u003Ctd>Fix that first. It caps every row in the table below\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>You need to know if it is even Turnstile\u003C/td>\n\u003Ctd>\u003Ca href=\"#how-to-tell-turnstile-from-a-managed-challenge\">Thirty-second check\u003C/a>\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Your crawl schedule is slipping, not failing\u003C/td>\n\u003Ctd>\u003Ca href=\"#the-42-seconds-is-the-real-cost\">The 42 seconds is your problem\u003C/a>, not the pass rate\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>You want the rows, not a challenge pipeline\u003C/td>\n\u003Ctd>\u003Ca href=\"#what-this-costs-to-keep-alive\">Skip to the last section\u003C/a>\u003C/td>\n\u003C/tr>\n\u003C/tbody>\u003C/table>\n\u003Caside class=\"article__usecase-card\">\u003Cdiv class=\"article__usecase-label\">Related use case\u003C/div>\u003Ch3 class=\"article__usecase-title\">Any-site data scraper\u003C/h3>\u003Cp class=\"article__usecase-blurb\">No-code extraction from any website. Managed infrastructure, no anti-bot headaches.\u003C/p>\u003Ca class=\"article__usecase-link\" href=\"/use-cases/data-scraper\">See how it works →\u003C/a>\u003C/aside>\u003Ch2 id=\"turnstile-is-a-score-not-a-puzzle\">Turnstile Is a Score, Not a Puzzle\u003C/h2>\n\u003Cp>\u003Ca href=\"https://developers.cloudflare.com/turnstile/\">Turnstile\u003C/a> is Cloudflare's replacement for the interactive CAPTCHA. It runs a short battery of browser checks — proof-of-work, API surface probing, interaction timing — and hands the result to the same bot-scoring engine that sits in front of the rest of the Cloudflare edge.\u003C/p>\n\u003Cp>That engine assigns every request a \u003Ca href=\"https://developers.cloudflare.com/bots/concepts/bot-score/\">bot score\u003C/a> from 1 to 99, where 1 means almost certainly automated and 99 means almost certainly a person. The widget does not compute that score from scratch. It contributes to a verdict that was already most of the way formed from:\u003C/p>\n\u003Col>\n\u003Cli>\u003Cstrong>The TLS handshake\u003C/strong> — your \u003Ca href=\"https://github.com/FoxIO-LLC/ja4\">JA3/JA4\u003C/a> fingerprint, read before any JavaScript runs\u003C/li>\n\u003Cli>\u003Cstrong>IP reputation\u003C/strong> — ASN, abuse history, whether the range belongs to a cloud provider\u003C/li>\n\u003Cli>\u003Cstrong>HTTP/2 frame ordering\u003C/strong> — settings, window sizes, header order, all of which differ between a real browser and a library\u003C/li>\n\u003Cli>\u003Cstrong>Browser internals\u003C/strong> — the properties and quirks that a patched or instrumented runtime cannot fully hide\u003C/li>\n\u003C/ol>\n\u003Cp>Three of those four are decided before the widget exists. This is why the \u003Ca href=\"https://developers.cloudflare.com/turnstile/concepts/widget/\">managed challenge\u003C/a> sometimes passes you through in under a second with no interaction at all, and sometimes loops forever on the same code: nothing about your script changed, your score did.\u003C/p>\n\u003Cp>The practical consequence: \u003Cstrong>you do not get past Turnstile by getting better at Turnstile.\u003C/strong> You get past it by presenting a client that scores well enough never to be seriously challenged.\u003C/p>\n\u003Cp>The clearest expression of that idea is \u003Ca href=\"https://github.com/mandatoryprogrammer/thermoptic\">thermoptic\u003C/a>, a proxy that describes its own job as cloaking requests "as the Chrome browser across all layers of the stack." It does not answer a challenge at any point; its \u003Ca href=\"https://github.com/mandatoryprogrammer/thermoptic/blob/main/tutorials/turnstile/cloudflare-turnstile-bypass.md\">Turnstile tutorial\u003C/a> and the \u003Ca href=\"https://news.ycombinator.com/item?id=45339216\">Hacker News thread about it\u003C/a> are both worth reading for what they do not contain.\u003C/p>\n\u003Ch2 id=\"how-to-tell-turnstile-from-a-managed-challenge\">How to Tell Turnstile From a Managed Challenge\u003C/h2>\n\u003Cp>Worth thirty seconds, because the fixes differ and the symptoms look identical from a failing scraper's logs.\u003C/p>\n\u003Cul>\n\u003Cli>\u003Cstrong>A \u003Ccode>cf-turnstile-response\u003C/code> field in a form, or a \u003Ccode>challenges.cloudflare.com\u003C/code> iframe\u003C/strong> — the Turnstile widget proper, usually guarding a login or a signup\u003C/li>\n\u003Cli>\u003Cstrong>An interstitial page with \u003Ccode>cf_clearance\u003C/code> set on exit\u003C/strong> — the managed challenge, which is what most catalogue and price pages run\u003C/li>\n\u003Cli>\u003Cstrong>\u003Ccode>__cf_bm\u003C/code> with no interstitial at all\u003C/strong> — bot management is on, but you are passing. Do not touch anything\u003C/li>\n\u003Cli>\u003Cstrong>A \u003Ccode>cf-ray\u003C/code> header with a 403\u003C/strong> — you are being refused outright, which is an IP-reputation problem, not a challenge problem\u003C/li>\n\u003C/ul>\n\u003Cp>If instead you see \u003Ccode>_abck\u003C/code> and \u003Ccode>sensor_data\u003C/code>, that is \u003Ca href=\"/blogs/bypass-akamai-bot-manager-web-scraping-2026\">Akamai Bot Manager\u003C/a> and the correct fix is almost the opposite one. \u003Ccode>_px\u003C/code> cookies mean \u003Ca href=\"/blogs/bypass-perimeterx-human-web-scraping-2026\">PerimeterX\u003C/a>. \u003Ccode>__ddg\u003C/code> means \u003Ca href=\"/blogs/bypass-datadome-web-scraping-2026\">DataDome\u003C/a>.\u003C/p>\n\u003Cdiv class=\"video-embed\">\u003Ciframe src=\"https://www.youtube-nocookie.com/embed/f2HUIBK3QrA\" title=\"Bypassing Cloudflare Turnstile with a few lines of Python\" loading=\"lazy\" allowfullscreen>\u003C/iframe>\u003C/div>\n\n\u003Cp>Michael Mintz, who maintains \u003Ca href=\"https://github.com/seleniumbase/SeleniumBase\">SeleniumBase\u003C/a>, demonstrating the widget being cleared by a driver that simply scores well enough to be allowed to click. Note what is absent from that clip: there is no puzzle being answered.\u003C/p>\n\u003Caside class=\"article__inline-cta\">\u003Cp class=\"article__inline-cta-text\">Try ScrapeWise on your own URL. \u003Cstrong>Your first 5 requests are free.\u003C/strong>\u003C/p>\u003Ca class=\"article__inline-cta-btn\" href=\"https://portal.scrapewise.ai/register\" target=\"_blank\" rel=\"noopener\">Start Free →\u003C/a>\u003C/aside>\u003Ch2 id=\"what-cleared-it-in-our-april-2026-run\">What Cleared It in Our April 2026 Run\u003C/h2>\n\u003Cp>Six approaches, 500 requests each, spread over six hours against production Cloudflare-protected sites. Full method in \u003Ca href=\"/blogs/bypass-cloudflare-akamai-perimeterx-web-scraping-2026\">bypassing Cloudflare, Akamai and PerimeterX\u003C/a>; the Cloudflare slice is below.\u003C/p>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Approach\u003C/th>\n\u003Cth>Cloudflare Std\u003C/th>\n\u003Cth>Cloudflare Enterprise\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>Requests library + datacentre proxies\u003C/td>\n\u003Ctd>19%\u003C/td>\n\u003Ctd>4%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>curl-cffi + datacentre proxies\u003C/td>\n\u003Ctd>61%\u003C/td>\n\u003Ctd>38%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Camoufox + datacentre proxies\u003C/td>\n\u003Ctd>72%\u003C/td>\n\u003Ctd>44%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>curl-cffi + residential proxies\u003C/td>\n\u003Ctd>79%\u003C/td>\n\u003Ctd>52%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Patchright + residential proxies\u003C/td>\n\u003Ctd>83%\u003C/td>\n\u003Ctd>69%\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>\u003Cstrong>Camoufox + residential proxies\u003C/strong>\u003C/td>\n\u003Ctd>\u003Cstrong>91%\u003C/strong>\u003C/td>\n\u003Ctd>\u003Cstrong>78%\u003C/strong>\u003C/td>\n\u003C/tr>\n\u003C/tbody>\u003C/table>\n\u003Cp>Two things to read out of this.\u003C/p>\n\u003Cp>\u003Cstrong>The proxy tier moves the numbers more than the tool does.\u003C/strong> Camoufox loses nineteen points by being put behind datacentre IPs — more than the gap between Camoufox and a plain HTTP client on good IPs. If you are on shared datacentre proxies, every hour spent on stealth libraries is being spent on the wrong layer.\u003C/p>\n\u003Cp>\u003Cstrong>Firefox beats Chromium here, and only here.\u003C/strong> \u003Ca href=\"https://github.com/daijro/camoufox\">Camoufox\u003C/a> patches a Firefox build at the C++ level, and Cloudflare's fingerprinting treats Firefox TLS signatures differently from the Chromium family that nearly every automation tool descends from. On \u003Ca href=\"/blogs/playwright-akamai-bot-manager-2026\">Akamai the ranking inverts\u003C/a> and a browser-free HTTP client wins outright. There is no tool that is simply best.\u003C/p>\n\u003Ch2 id=\"the-42-seconds-is-the-real-cost\">The 42 Seconds Is the Real Cost\u003C/h2>\n\u003Cp>Pass rate is the number everyone quotes and the wrong one to plan against.\u003C/p>\n\u003Cp>A cleared Turnstile challenge in Camoufox takes an average of \u003Cstrong>42.49 seconds\u003C/strong> — that is the figure behind the \u003Ca href=\"/blogs/camoufox-vs-patchright-2026\">Camoufox vs Patchright comparison\u003C/a>, and it works out to roughly \u003Cstrong>85 challenged pages per hour per worker\u003C/strong>.\u003C/p>\n\u003Cp>Run that against a real brief. Four competitors, 5,000 SKUs each, refreshed daily is 20,000 pages. If even a fifth of them get challenged, that is 4,000 challenges, which is 47 worker-hours. You do not have a bypass problem at that point. You have a fleet-sizing problem, and it arrived without anything failing.\u003C/p>\n\u003Cp>This is the failure mode that does not page anyone: the scraper is not broken, it is late. Prices land in the afternoon instead of before the morning repricing run, and the only visible symptom is somebody noticing the dashboard looks stale.\u003C/p>\n\u003Ch2 id=\"solve-once-reuse-the-cookie\">Solve Once, Reuse the Cookie\u003C/h2>\n\u003Cp>The highest-leverage change available on Cloudflare, and the one most teams skip because it is not a library.\u003C/p>\n\u003Cp>When a challenge is cleared, Cloudflare issues a \u003Cstrong>\u003Ccode>cf_clearance\u003C/code>\u003C/strong> cookie. It is bound to your IP and your user agent, and for its lifetime it carries the verdict you just paid 42 seconds for. Clearing a challenge per page throws that away every time.\u003C/p>\n\u003Cp>The pattern that works:\u003C/p>\n\u003Col>\n\u003Cli>Clear one challenge in a real stealth browser, on a \u003Cstrong>sticky\u003C/strong> residential session\u003C/li>\n\u003Cli>Export \u003Ccode>cf_clearance\u003C/code> and \u003Ccode>__cf_bm\u003C/code>\u003C/li>\n\u003Cli>Run the rest of the crawl through a TLS-impersonating HTTP client such as \u003Ca href=\"https://pypi.org/project/curl-cffi/\">curl_cffi\u003C/a>, on \u003Cstrong>the same IP\u003C/strong> and \u003Cstrong>the same user-agent string\u003C/strong>\u003C/li>\n\u003Cli>Fall back to the browser only when a request starts getting challenged again\u003C/li>\n\u003C/ol>\n\u003Cdiv class=\"code-block\">\u003Cbutton type=\"button\" class=\"code-block__copy\" data-copy-code aria-label=\"Copy code\">Copy\u003C/button>\u003Cpre>\u003Ccode class=\"language-python\">from curl_cffi import requests\n\n# cf_clearance is bound to the IP and the UA that earned it.\n# Change either one and it is worthless.\nsession = requests.Session(impersonate="chrome124", proxies=STICKY_PROXY)\nsession.cookies.update({"cf_clearance": CLEARANCE, "__cf_bm": BM})\nsession.headers["User-Agent"] = UA_THAT_EARNED_THE_COOKIE\n\nr = session.get(url)\nif "challenges.cloudflare.com" in r.text or r.status_code == 403:\n    refresh_clearance_in_browser()   # pay the 42 seconds, once\n\u003C/code>\u003C/pre>\u003C/div>\n\u003Cp>The two failures that make people conclude this does not work: rotating the proxy per request, which invalidates the cookie immediately, and sending a different user agent than the browser that earned it. Both are defaults in most scraping stacks. The mechanics of the impersonation layer are in \u003Ca href=\"/blogs/curl-cffi-tls-fingerprint-web-scraping-2026\">curl_cffi and TLS fingerprint impersonation\u003C/a>.\u003C/p>\n\u003Ch2 id=\"what-captcha-solvers-can-and-cannot-do-here\">What CAPTCHA Solvers Can and Cannot Do Here\u003C/h2>\n\u003Cp>Solver services do have a place, and it is narrower than their marketing suggests.\u003C/p>\n\u003Cp>\u003Cstrong>They work when\u003C/strong> a human-answerable challenge is genuinely presented — reCAPTCHA v2 image grids, hCaptcha, an explicit interactive Turnstile widget on a form you are submitting once.\u003C/p>\n\u003Cp>\u003Cstrong>They do not work when\u003C/strong> your client is being scored down before the widget loads. You can buy a valid token and still be refused, because the token is checked against the session that requested it. A good token presented by a badly-scoring client is not a pass; it is evidence.\u003C/p>\n\u003Cp>So the order of operations matters: fix the TLS fingerprint and the IP tier first, and only then consider whether anything is left for a solver to do. Usually there is not. If you are comparing services anyway, we \u003Ca href=\"/blogs/best-captcha-solving-service-web-scraping-2026\">tested four of them\u003C/a>.\u003C/p>\n\u003Ch2 id=\"what-this-costs-to-keep-alive\">What This Costs to Keep Alive\u003C/h2>\n\u003Ctable>\n\u003Cthead>\n\u003Ctr>\n\u003Cth>Approach\u003C/th>\n\u003Cth>Monthly infra at 10k pages/day\u003C/th>\n\u003Cth>Engineering maintenance\u003C/th>\n\u003C/tr>\n\u003C/thead>\n\u003Ctbody>\u003Ctr>\n\u003Ctd>curl-cffi + residential + cookie reuse\u003C/td>\n\u003Ctd>~$140–200\u003C/td>\n\u003Ctd>4–6 hrs/month\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Patchright + residential proxies\u003C/td>\n\u003Ctd>~$380–520\u003C/td>\n\u003Ctd>8–12 hrs/month\u003C/td>\n\u003C/tr>\n\u003Ctr>\n\u003Ctd>Camoufox + residential proxies\u003C/td>\n\u003Ctd>~$440–600\u003C/td>\n\u003Ctd>10–15 hrs/month\u003C/td>\n\u003C/tr>\n\u003C/tbody>\u003C/table>\n\u003Cp>Cloudflare ships changes continuously and does not announce them. A pass rate that held for three months can drop twenty points in a week, and the first signal is usually a quieter one than an error: fewer rows than yesterday.\u003C/p>\n\u003Cp>If what you need is \u003Cstrong>competitor prices and stock levels arriving on a schedule\u003C/strong> rather than a challenge pipeline to keep alive, the Turnstile question is the wrong one to be answering. \u003Ca href=\"/\">ScrapeWise\u003C/a> runs the browsers, the proxies and the challenge handling and delivers structured rows. No plan and no compute units: a balance you top up, and a published charge per delivered page — EUR 0.15 per 1,000 for plain requests, EUR 0.75 with rendering, EUR 1.50 through the residential tier and EUR 3.75 for render plus residential. New accounts get 5 free requests and the balance never expires.\u003C/p>\n\u003Cp>You can also call \u003Ca href=\"/scrapers\">ready-made scraping API endpoints\u003C/a> directly, or see how this feeds \u003Ca href=\"/use-cases/competitor-price-tracking\">competitor price tracking\u003C/a>.\u003C/p>\n\u003Ch2 id=\"so-what-should-you-run\">So What Should You Run?\u003C/h2>\n\u003Cul>\n\u003Cli>\u003Cstrong>Camoufox on residential IPs\u003C/strong> — the target is Cloudflare Enterprise and the pages are high-value. 78% at Enterprise, and plan for 85 challenged pages per hour per worker.\u003C/li>\n\u003Cli>\u003Cstrong>\u003Ca href=\"/blogs/what-is-patchright-guide-2026\">Patchright\u003C/a> on residential IPs\u003C/strong> — you are on Node.js or unwilling to adopt Firefox. Three points behind on standard, nine behind on Enterprise, meaningfully faster.\u003C/li>\n\u003Cli>\u003Cstrong>Browser once, then curl_cffi on the cookie\u003C/strong> — the highest throughput per euro available on Cloudflare, and the one most teams have not tried.\u003C/li>\n\u003Cli>\u003Cstrong>A solver\u003C/strong> — only for a genuine interactive widget on a form, after the fingerprint and the IP tier are already right.\u003C/li>\n\u003Cli>\u003Cstrong>None of the above\u003C/strong> — you want delivered rows on a schedule and would rather not maintain a challenge pipeline.\u003C/li>\n\u003C/ul>\n\u003Cp>\u003Ca href=\"/pricing\">See pricing\u003C/a>.\u003C/p>\n",{"title":11,"description":12,"badge":13,"benefits":14},"Frequently asked questions","What Cloudflare Turnstile actually measures, the measured pass rates for stealth browsers against plain HTTP clients, and why cookie reuse beats buying a solver","FAQ",[15,18,21,24,27,30,33,36],{"title":16,"description":17},"Can you bypass Cloudflare Turnstile when web scraping?","Not by solving it, which is the framing that causes most of the wasted effort. Turnstile runs a short battery of browser checks and feeds the result into Cloudflare's bot score, which was already mostly determined by your TLS handshake, your IP reputation and your HTTP/2 frame ordering before the widget loaded. You get past it by presenting a client that scores well enough never to be seriously challenged. In our April 2026 run of 500 requests per approach, Camoufox on residential proxies passed 91% of Cloudflare standard tiers and 78% of Enterprise, the highest of six approaches tested.",{"title":19,"description":20},"Why did buying a CAPTCHA solver not help with Turnstile?","Because solvers answer challenges and Turnstile is grading the client that asked for one. A solver service can return a valid token and you can still be refused, because the token is validated against the session that requested it. A good token presented by a badly scoring client is not a pass, it is evidence. Solvers earn their place on genuinely interactive challenges such as reCAPTCHA v2 image grids or a one-off Turnstile widget on a form you submit manually. For catalogue scraping, fix the TLS fingerprint and the proxy tier first and there is usually nothing left for a solver to do.",{"title":22,"description":23},"What is the cf_clearance cookie and how do you reuse it?","When a Cloudflare challenge is cleared, the edge issues a cf_clearance cookie that carries that verdict for its lifetime. It is bound to the IP address and the user-agent string that earned it. The highest-leverage pattern available on Cloudflare is to clear one challenge in a stealth browser on a sticky residential session, export cf_clearance and __cf_bm, then run the rest of the crawl through a TLS-impersonating HTTP client such as curl_cffi on the same IP and the same user agent. The two mistakes that make teams conclude this does not work are rotating the proxy per request, which invalidates the cookie immediately, and sending a different user agent than the browser that earned it.",{"title":25,"description":26},"How long does it take to clear one Turnstile challenge?","About 42.49 seconds on average in Camoufox, which works out to roughly 85 challenged pages per hour per worker. That number matters more than the pass rate for anyone running a schedule. Four competitors at 5,000 SKUs each refreshed daily is 20,000 pages; if a fifth of them are challenged that is 4,000 challenges and 47 worker-hours a day. The resulting failure mode is quiet. The scraper is not broken, it is late, and prices land after the morning repricing run instead of before it.",{"title":28,"description":29},"Is Camoufox or Patchright better against Cloudflare?","Camoufox, by eight to nine points. On residential proxies we measured Camoufox at 91% on Cloudflare standard and 78% on Enterprise, against Patchright at 83% and 69%. The reason is that Camoufox patches a Firefox build at the C++ engine level and Cloudflare's fingerprinting treats Firefox TLS signatures differently from the Chromium family that almost every automation tool descends from. That advantage is vendor-specific: on Akamai Bot Manager the ranking inverts and a browser-free HTTP client with TLS impersonation beat both stealth browsers at 87%.",{"title":31,"description":32},"How do I tell Turnstile apart from a Cloudflare managed challenge?","Look at what the response contains. A cf-turnstile-response form field or a challenges.cloudflare.com iframe is the Turnstile widget proper, usually guarding a login or a signup. An interstitial page that sets cf_clearance on exit is the managed challenge, which is what most catalogue and price pages run. A __cf_bm cookie with no interstitial means bot management is active and you are passing, so change nothing. A cf-ray header with a 403 is an outright refusal, which is an IP reputation problem rather than a challenge problem and will not be fixed by any stealth library.",{"title":34,"description":35},"Do datacentre proxies work against Cloudflare?","They cap your ceiling on every tier. In our benchmark Camoufox lost nineteen points simply by being moved from residential to datacentre IPs, dropping from 91% to 72% on standard Cloudflare and from 78% to 44% on Enterprise. That nineteen-point penalty is larger than the gap between Camoufox and a plain HTTP client on good IPs. If you are on shared datacentre proxies, every hour spent evaluating stealth libraries is being spent on the wrong layer, and the proxy tier should be fixed before anything else is changed.",{"title":37,"description":38},"What does it cost to keep a Cloudflare bypass working?","At around 10,000 pages a day, a curl-cffi stack on residential proxies with cookie reuse runs roughly 140 to 200 dollars a month in infrastructure plus four to six engineering hours; Patchright on residential proxies is roughly 380 to 520 dollars and eight to twelve hours; Camoufox is roughly 440 to 600 dollars and ten to fifteen hours. The maintenance column is the one teams underestimate. Cloudflare ships changes continuously and does not announce them, so a pass rate that held for three months can drop twenty points in a week, and the first signal is usually fewer rows rather than an error.","Bypass Cloudflare Turnstile When Scraping: 2026 Numbers","Turnstile is a score you earn before the widget renders, not a puzzle. Measured pass rates, the 42-second cost, and why cookie reuse beats a solver.","Siim Brazier","/img/team/siim.jpg",false,"Scraping",8,[47,52,58],{"slug":48,"title":49,"image":50,"date":5,"category":44,"excerpt":51},"bypass-kasada-bot-protection-2026","Bypassing Kasada in 2026: The Token Economics Nobody Prices In","/img/news/bypass-kasada-bot-protection-2026.png","Kasada mints x-kpsdk-ct once per session, but x-kpsdk-cd is single-use, per request. That asymmetry is why solve-once-and-fan-out fails here.",{"slug":53,"title":54,"image":55,"date":56,"category":44,"excerpt":57},"curl-cffi-tls-fingerprint-web-scraping-2026","curl_cffi and TLS Fingerprint Impersonation for Web Scraping (2026)","/img/news/curl-cffi-tls-fingerprint-web-scraping-2026.png","13 Oct 2026","Your requests call is blocked before any JavaScript runs, because its TLS handshake is not a browser's. What JA3/JA4 is, how curl_cffi fixes it, measured pass rates, and the four cases where it cannot help.",{"slug":59,"title":60,"image":61,"date":56,"category":44,"excerpt":62},"playwright-akamai-bot-manager-2026","Playwright vs Akamai Bot Manager: Why the Browser Is the Wrong Layer (2026)","/img/news/playwright-akamai-bot-manager-2026.png","Vanilla Playwright does not clear Akamai Bot Manager v4. Patched Playwright reaches 74% on residential proxies. A plain HTTP client reaches 87% for a quarter of the compute. The measurements and the reason.",{"slug":48,"title":49},[65,69,72,75,78,81,84,87,90],{"level":66,"text":67,"id":68},2,"Choose Before You Read","choose-before-you-read",{"level":66,"text":70,"id":71},"Turnstile Is a Score, Not a Puzzle","turnstile-is-a-score-not-a-puzzle",{"level":66,"text":73,"id":74},"How to Tell Turnstile From a Managed Challenge","how-to-tell-turnstile-from-a-managed-challenge",{"level":66,"text":76,"id":77},"What Cleared It in Our April 2026 Run","what-cleared-it-in-our-april-2026-run",{"level":66,"text":79,"id":80},"The 42 Seconds Is the Real Cost","the-42-seconds-is-the-real-cost",{"level":66,"text":82,"id":83},"Solve Once, Reuse the Cookie","solve-once-reuse-the-cookie",{"level":66,"text":85,"id":86},"What CAPTCHA Solvers Can and Cannot Do Here","what-captcha-solvers-can-and-cannot-do-here",{"level":66,"text":88,"id":89},"What This Costs to Keep Alive","what-this-costs-to-keep-alive",{"level":66,"text":91,"id":92},"So What Should You Run?","so-what-should-you-run",[94,95,96,97,98],"Turnstile is not a CAPTCHA you solve. By the time the widget renders, Cloudflare has already scored your TLS handshake, your IP and your browser internals — the checkbox only reports the verdict.","That is why CAPTCHA solving services mostly do not help on Turnstile. They answer a challenge; Turnstile is grading the client that asked for one.","Camoufox on residential IPs passed 91% of Cloudflare standard and 78% of Enterprise in our April 2026 run — the highest of six approaches, and the slowest.","The measured cost of a cleared challenge is about 42.5 seconds, roughly 85 challenged pages per hour per worker. That number, not the pass rate, is what breaks price-monitoring schedules.","The real leverage is the cf_clearance cookie: clear once in a browser on a sticky session, then run the rest of the crawl over a TLS-impersonating HTTP client until it expires.",1792524068768]