Hm, I didn't notice that part and I hadn't thought about ad click fraud and vulnerability scanning. Preventing content scraping for publicly accessible content

Hm, I didn't notice that part and I hadn't thought about ad click fraud and vulnerability scanning. Preventing content scraping for publicly accessible content is kind of dumb and impossible in my view anyway though. For the few that care about making scraping more cumbersome the option should be there to enable the captchas, but I don't think it should be a default. Ad click fraud is a harder problem to figure out, but should be a issue for the ad-networks to deal with and not the sites with the ads. I'm torn about preventing vulnerability scanning. While I do it on my server using mod_security, it's also a form of "security by obscurity", which I'm not that much a fan of. Anyway, disabling captchas completely should be a very visible option. The protections on "dangerous GET requests" are probably only needed for a small minority of CloudFlare sites, so what should be the default setting becomes a question of what's most valued the most - safety for the many (making Tor usage easy and not cumbersome) or security for the few (who rely on the default settings protecting them from "niche" security issues). I think making Tor usage easy by default would be best for the security of the web at large, but I can see why CloudFlare has different priorities.