3 ms·

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captc

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.

viraptor 4y ago
Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site. If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.
- grepfru_it 4y ago
  As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are
decide1000 4y ago
That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.
r1ch 4y ago
I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.
- comex 4y ago
  Do you have any more details about what sort of requests are being blocked? I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…
  - r1ch 4y ago
    It's a tiny amount compared to the traffic that does get through, but enough that affected users make it to our support channels. I think a good amount are due to VPNs used by users, the rest seemed like standard residential IPs that I didn't see a reason for being blocked.

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.

viraptor 4y ago

Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site. If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.

grepfru_it 4y ago
As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are

decide1000 4y ago

That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.

r1ch 4y ago

I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.

comex 4y ago
Do you have any more details about what sort of requests are being blocked? I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…
- r1ch 4y ago
  It's a tiny amount compared to the traffic that does get through, but enough that affected users make it to our support channels. I think a good amount are due to VPNs used by users, the rest seemed like standard residential IPs that I didn't see a reason for being blocked.