Verifying You Are Human: Cloudflare's Check Explained
What Cloudflare's "Verifying you are human" page checks, why it loops, how to fix it as a visitor, and why automated browsers get stuck there.
"Verifying you are human. This may take a few seconds" is Cloudflare's interstitial challenge page. The site you are visiting asked Cloudflare to check your browser before letting the request through, and for most people it clears on its own in under five seconds. When it loops instead, something in your browser, network or automation setup is failing the check. This guide explains what the page is actually testing, why it gets stuck, and what to do about it — whether you are a person stuck on a login screen or a developer whose scraper has stopped at the gate.
What "Verifying you are human" actually means
It means the website is protected by a Cloudflare rule that issues a challenge page instead of serving the content straight away. Cloudflare's documentation describes it as a full-page screen that holds the request while it evaluates the browser for signs of automation, then lets the original request continue if the check passes.
Site owners choose between three kinds of challenge, according to Cloudflare's challenge-page documentation:
- Non-interactive: JavaScript runs in your browser and decides. You only wait; Cloudflare says this "typically takes less than five seconds".
- Managed: Cloudflare picks the challenge based on what it sees. Most visitors pass automatically and see "Successful"; some get a checkbox.
- Interactive: you always have to click. Cloudflare recommends managed challenges instead for most sites.
The checkbox you sometimes see is the same technology as Cloudflare Turnstile: Cloudflare says challenge pages run on the same platform, and the same troubleshooting applies to both.
What happens when you pass
Passing sets a cf_clearance cookie, and that cookie is what lets you browse without being challenged again. Cloudflare's Challenge Passage page gives the default lifetime as 30 minutes, with 15 to 45 minutes recommended; the site owner can change it.
Three details from Cloudflare's clearance documentation explain most of the confusing behaviour people report:
- The cookie is tied to the visitor and device it was issued to. Copying it to another machine does not carry the pass with it.
- Clearance has levels. Passing a non-interactive check does not clear you for a stricter managed or interactive one later on the same site.
- It can be revoked early. If the site uses Cloudflare's behavioural session checks, a session that starts looking automated can be re-challenged before the cookie expires.
Why it keeps looping
A loop means the check keeps failing or the clearance cookie is not being kept. Cloudflare lists the causes in its challenge troubleshooting guide: unstable network connections, browser settings or extensions that block the challenge scripts, unsupported browsers, JavaScript turned off, and genuine detection of bot-like signals.
Two causes come up in almost every forum thread about this screen. The first is cookies: if your browser blocks or clears cookies for the site, the cf_clearance cookie never sticks and every page load starts the check again. Cloudflare's own help page notes that visitors must enable JavaScript and cookies to pass any challenge. The second is network reputation: VPNs, shared proxies and some corporate networks carry traffic from many users, and the check is stricter for addresses that have recently sent automated traffic.
Browser-specific loops happen too. In a widely viewed Brave community thread from January 2025, a user reported the checkbox spinning and resetting in Brave while the same site passed in Firefox and Chrome — a reminder that privacy hardening which changes what the browser reports can look like automation to the check.
How to fix it as a visitor
Work through Cloudflare's own checklist in order, testing the page after each step:
- Update your browser. Cloudflare supports all major browsers except Internet Explorer and runs a compatibility check at debug.challenges.cloudflare.com.
- Disable extensions, especially ad blockers and script blockers, then reload.
- Make sure JavaScript and cookies are allowed for the site.
- Try a private window to rule out stale cookies and cached data.
- Try another browser or device.
- Turn off your VPN or proxy.
- Switch networks, for example to a phone hotspot.
If none of that helps, the block is probably on the site's side. Cloudflare is explicit that its staff cannot remove a challenge for you; only the website owner can. Contact the site's support and include the Ray ID shown at the bottom of the challenge page — it identifies your exact request in their logs.
| What you see | Most likely cause | First thing to try |
|---|---|---|
| Spinner, then the same page again | Clearance cookie not stored | Allow cookies for the site; try a private window |
| Checkbox resets after clicking | Extension or hardened browser blocking scripts | Disable extensions or switch browser |
| Fails only on one network | VPN, proxy or shared IP reputation | Turn off the VPN or use another network |
| Fails everywhere, every browser | Site rule targets your IP range | Contact the site with your Ray ID |
Why automation gets stuck on this page
Automated browsers fail the same check for the same reasons, only more consistently. A fresh headless browser starts with no cookies, often runs from a datacenter IP, and may report a user agent that changes between runs. Each of those makes the session look new and untrusted, so every run meets the challenge from scratch.
Before reaching for a solver, check what the request is actually getting back. Cloudflare marks every challenge response with a cf-mitigated: challenge header and a text/html body, as documented in its detection guide. If your HTTP client sees that header, you did not get the page you asked for — and retrying faster only makes the next request look worse.
The fixes that hold up in practice are about session consistency rather than tricks:
- Persist the cookie jar between runs (for example Playwright's storage state) so a passed check is not thrown away.
- Keep the user agent and exit IP stable for the life of the session. The clearance is bound to the visitor that earned it.
- Slow down. Rate limits feed the same rules that issue challenges.
- For your own sites and staging environments, ask for an allowlist rule or use Turnstile's test keys instead of fighting your own protection.
When a solver helps, and when it does not
A solver helps when the page shows a Turnstile widget — the checkbox embedded in a form — on automation you are authorised to run. The widget produces a token your request submits, and that token can be generated for you if you pass the page's sitekey and URL. Our Turnstile solver takes those, plus the action, cData and pageData values that challenge pages use, and returns the token with the user agent it was minted for.
It does not help if the underlying session is wrong. A valid token submitted from a different IP or user agent than the one it was solved for is the classic cause of rejected tokens, so pass your own proxy and replay the returned user agent exactly. And no solver should be used to get past protection on sites you are not allowed to automate; our acceptable use policy spells out where the line is.
How CaptchaNo handles this
CaptchaNo solves Turnstile, reCAPTCHA and DataDome through one request shape on our own solving infrastructure. You send the type, page URL, sitekey and your proxy; you get back a token plus the user agent to replay, billed only when the solve succeeds. The full request format is in the API reference, and working browser examples for Playwright, Selenium and Puppeteer are in the docs.
Frequently Asked Questions
Is "Verifying you are human" a virus or a scam?
No. It is a standard Cloudflare security page that many sites use to filter automated traffic before serving content. The real page comes from the site's own address and usually clears within a few seconds. Be suspicious only if the page asks you to paste commands, download files or enter passwords, which a genuine Cloudflare challenge never does.
How long should "Verifying you are human" take?
Cloudflare's documentation says the non-interactive check typically takes less than five seconds. Managed challenges usually pass automatically too, occasionally asking for a single click. If the page is still spinning after ten or fifteen seconds, the check is failing rather than slow, and refreshing repeatedly will not fix it.
Why do I keep getting "Verifying you are human" on every page?
The clearance cookie that proves you passed is not being kept, or it keeps getting invalidated. Browsers set to block or clear cookies, privacy extensions and some hardened browsers cause this. The cookie lasts thirty minutes by default, so seeing the check on every single page load points to a cookie problem rather than normal expiry.
Does a VPN cause Cloudflare verification loops?
It often does. VPN and proxy addresses are shared by many users, and some of that traffic is automated, so Cloudflare scores those addresses more cautiously. Turning the VPN off or switching to another server is one of the troubleshooting steps Cloudflare itself recommends when a challenge keeps failing.
Can a website owner turn off the check for me?
Yes, and only they can. Cloudflare states that its own staff cannot remove a challenge from a site they do not control. The site owner can adjust the rule or allowlist your address. Send them the Ray ID from the bottom of the challenge page so they can find the exact request.
Keep your automation past the check
If your authorised automation stops at a Turnstile widget, start a free CaptchaNo trial and solve it with the same proxy and user agent your session already uses. Rates for every challenge type are on the pricing page.