6 ms·

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the

I can no longer access any website that's "protected" by Cloudflare. As soon a website enables that stuff… "Shoot, another one bites the dust." I wonder if the website owners realise at all how many actual users they lose by this sort of "protection."

tardedmeme 4mo ago
Cloudflare will just tell them that 70% traffic drop is because 70% of their traffic was bots, and everything is working fine, and hey, don't you want to upgrade to a paid plan to block 50% of the remainder? Think about how many bots will be blocked with that upgrade!
- google234123 4mo ago
  Do you really stand by these words?
  - 348752389 4mo ago
    [dead]
gruez 4mo ago
>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?
- binaryturtle 4mo ago
  Well… I know plenty people in my circle affected by this. Just have a slightly outdated system you simply can't afford to update: it's way to easy to get cut off like this. IMHO, a rather systematic discrimination of poorer people.
- benhurmarcel 4mo ago
  I got locked out of some websites by Cloudflare Turnstile on some very standard configurations, like an iPhone on Safari, or a Windows 11 desktop with Firefox or Edge, neither with a VPN on. I never found out why.
  - hatsix 4mo ago
    it's probably because a scraper farm updated their services to latest, and there was a window where fingerprinting was unable to differentiate. We had all of our Devs Pixels get blocked, and after talking to CF, it was because Internet archive was rebooted their scraping farm, all the devices stampeded and overwhelmed the known bot safeguards, and those tags were added across the board. CF gives sites the tools to tune what is getting blocked, we bumped the sensitivity down to 25 and haven't had many complaints (despite having a very vocal community) The most common complaint is users' IP address getting blocked because of compromised devices
- ranger_danger 4mo ago
  There are dozens of us :) In my experience what really makes it loop every single time though is JShelter. CF doesn't like having your fingerprintable data bits messed with. There are legitimate uses for non-instrusive, ethical and legal scraping, but some of us have had to resort to extreme measures: https://roundproxies.com/blog/bypass-bot-detection/ https://roundproxies.com/blog/bypass-bot-detection/
  - Bender 4mo ago
    Do you by chance have that installed? I don't use Cloudflare but I am curious if that code can scrape my silly blog? [1] Trying to pick the appropriate article... I'm guessing it can. I don't do the fancy javascript or TLS fingerprint inspections, just some janky hill-billy protections, silly redirects and Antarctic voodoo. [1] - https://blawg.nochan.net/b/Internet-Crap/20260522-Maybe-AI-Bots-Are-Harmless/ https://blawg.nochan.net/b/Internet-Crap/20260522-Maybe-AI-B...
- p_l 4mo ago
  Does not have to be weird, at least once it happened to me that their strictest settings simply banned something like major portion of internet users in my country - to the point that if you had FTTH you were likely blocked. And no, it wasn't due to a country-based block selected by site operator.
- marticode 4mo ago
  I use a plain Firefox on a plain Windows 11 PC on a plain regular mass market ISP in a developed country and I get completely blocked by websites daily. At least let me complete a "prove you are human" challenge or something, but don't outright ban my IP address?
- KingMob 4mo ago
  Weird? I live in Thailand, use Firefox, and get half a dozen CF challenges per day. It takes very little for CF to consider you "weird".
CrimsonRain 4mo ago
I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amount of bot traffic and corresponding spam is a bigger problem :(
- dotancohen 4mo ago
  > I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then why are you pretending to have a form submission feature at all? Just to frustrate users?
  - coryrc 4mo ago
    > One of the core tenets of system design is Availability. If your service is not available The service won't be available to anybody because of overwhelming unwanted traffic. Now it's available for most potential users. You're speaking econ 101 when everyone else has played out iterated prisoner's dilemmas.
  - epistasis 4mo ago
    > So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? Turns out that people have a tolerance for a non-zero amount of work, but still have a limit. Suggesting "turn off your website" is does not account for the desire to also provide some access. Treat people who host content as humans, just as we must treat users as humans. There are tradeoffs, suggesting "shut down your website unless you provide access everywhere" is worse on all fronts for everyone.
    - 4mo ago
dwedge 4mo ago
I took the time to write to one on LinkedIn and they didn't reply
8bitsrule 4mo ago
>wonder if the website owners realise at all how many actual users they lose by this sort of "protection. Yesterday cloudflare blocked me from visiting the MX-Linux site ... including an old browser with -no- protections ... I have to wonder - assuming these sites are paying CF for this 'service' - are they getting a list of all the fejected IPs?

tardedmeme 4mo ago

Cloudflare will just tell them that 70% traffic drop is because 70% of their traffic was bots, and everything is working fine, and hey, don't you want to upgrade to a paid plan to block 50% of the remainder? Think about how many bots will be blocked with that upgrade!

google234123 4mo ago
Do you really stand by these words?
- 348752389 4mo ago
  [dead]

gruez 4mo ago

>I wonder if the website owners realise at all how many actual users they lose by this sort of "protection." How many people do you think are browsing with a weird enough config (eg. custom browser like OP, or some weird config like firefox with fingerprinting protection on a raspeberry pi) to trip cloudflare's protection?

binaryturtle 4mo ago
Well… I know plenty people in my circle affected by this. Just have a slightly outdated system you simply can't afford to update: it's way to easy to get cut off like this. IMHO, a rather systematic discrimination of poorer people.
benhurmarcel 4mo ago
I got locked out of some websites by Cloudflare Turnstile on some very standard configurations, like an iPhone on Safari, or a Windows 11 desktop with Firefox or Edge, neither with a VPN on. I never found out why.
- hatsix 4mo ago
  it's probably because a scraper farm updated their services to latest, and there was a window where fingerprinting was unable to differentiate. We had all of our Devs Pixels get blocked, and after talking to CF, it was because Internet archive was rebooted their scraping farm, all the devices stampeded and overwhelmed the known bot safeguards, and those tags were added across the board. CF gives sites the tools to tune what is getting blocked, we bumped the sensitivity down to 25 and haven't had many complaints (despite having a very vocal community) The most common complaint is users' IP address getting blocked because of compromised devices
ranger_danger 4mo ago
There are dozens of us :) In my experience what really makes it loop every single time though is JShelter. CF doesn't like having your fingerprintable data bits messed with. There are legitimate uses for non-instrusive, ethical and legal scraping, but some of us have had to resort to extreme measures: https://roundproxies.com/blog/bypass-bot-detection/ https://roundproxies.com/blog/bypass-bot-detection/
- Bender 4mo ago
  Do you by chance have that installed? I don't use Cloudflare but I am curious if that code can scrape my silly blog? [1] Trying to pick the appropriate article... I'm guessing it can. I don't do the fancy javascript or TLS fingerprint inspections, just some janky hill-billy protections, silly redirects and Antarctic voodoo. [1] - https://blawg.nochan.net/b/Internet-Crap/20260522-Maybe-AI-Bots-Are-Harmless/ https://blawg.nochan.net/b/Internet-Crap/20260522-Maybe-AI-B...
p_l 4mo ago
Does not have to be weird, at least once it happened to me that their strictest settings simply banned something like major portion of internet users in my country - to the point that if you had FTTH you were likely blocked. And no, it wasn't due to a country-based block selected by site operator.
marticode 4mo ago
I use a plain Firefox on a plain Windows 11 PC on a plain regular mass market ISP in a developed country and I get completely blocked by websites daily. At least let me complete a "prove you are human" challenge or something, but don't outright ban my IP address?
KingMob 4mo ago
Weird? I live in Thailand, use Firefox, and get half a dozen CF challenges per day. It takes very little for CF to consider you "weird".

CrimsonRain 4mo ago

I'm one of those who have enabled cloudflare on all of the sites I maintain. Additionally, Added turnstile on every form. I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. Recently I also hard blocked all IPs from china Singapore India Pakistan Russia and whole of africa. Do I want to do it? No. But the amount of bot traffic and corresponding spam is a bigger problem :(

dotancohen 4mo ago
> I know some actual users get blocked. But the amount of spam we get without it, the amount of bot traffic simply overwhelming the server... It is just too much. So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? One of the core tenets of system design is Availability. If your service is not available - if your forms are blocking legitimate users - then why are you pretending to have a form submission feature at all? Just to frustrate users?
- coryrc 4mo ago
  > One of the core tenets of system design is Availability. If your service is not available The service won't be available to anybody because of overwhelming unwanted traffic. Now it's available for most potential users. You're speaking econ 101 when everyone else has played out iterated prisoner's dilemmas.
- epistasis 4mo ago
  > So why not just shut down the website? Or remove the form entirely? That will ensure that you get no spam, right? Turns out that people have a tolerance for a non-zero amount of work, but still have a limit. Suggesting "turn off your website" is does not account for the desire to also provide some access. Treat people who host content as humans, just as we must treat users as humans. There are tradeoffs, suggesting "shut down your website unless you provide access everywhere" is worse on all fronts for everyone.
  - 4mo ago

dwedge 4mo ago

I took the time to write to one on LinkedIn and they didn't reply

8bitsrule 4mo ago

>wonder if the website owners realise at all how many actual users they lose by this sort of "protection. Yesterday cloudflare blocked me from visiting the MX-Linux site ... including an old browser with -no- protections ... I have to wonder - assuming these sites are paying CF for this 'service' - are they getting a list of all the fejected IPs?