The challenges are configurable by cloudflare’s customers. The challenge can either be from turnstile, which is a captcha replacement service that websites use

The challenges are configurable by cloudflare’s customers. The challenge can either be from turnstile, which is a captcha replacement service that websites use on their own pages, or a cloudflare CDN security setting that will block access to pages until a challenge is passed. It is not clear which one the original poster means. Cloudflare’s customers can largely disable these and rely on other means of detecting bots. In the case of turnstile, it has three modes, two of which are entirely automatic and work by interrogating the web browser, with the other requiring a client: https://developers.cloudflare.com/turnstile/concepts/widget/ https://developers.cloudflare.com/turnstile/concepts/widget/ Cloudflare CDN’s security setting on its free tier also has an essentially off setting that will basically eliminate challenges when browsers accessing pages protected by cloudflare unless there are exceptional circumstances. I believe it can be fully turned off for the enterprise tier. Whenever I configure cloudflare for a website, I always turn off challenges since they are annoying to users. There is an interesting write up about how cloudflare’s bot detection works here: https://blog.capmonster.cloud/en/blog/web-scraping1/how-cloudflare-bot-challenge-and-turnstile-protect-web-traffic https://blog.capmonster.cloud/en/blog/web-scraping1/how-clou... Note that I have yet to use turnstile, so I am speaking from documentation I read rather than from actual experience with it. I have used cloudflare’s CDN and I am speaking from experience with it. Anyway, the website author is the one that should be blamed here.