Anti-Bot

What is Cloudflare?

Cloudflare is a CDN and security company whose reverse proxy sits in front of a large share of public websites. Traffic to a protected domain reaches Cloudflare's network first, where caching, DDoS filtering, WAF rules and bot scoring run before anything reaches the origin server. The edge challenges or blocks whatever it judges automated.

You can recognise it from the response. Cloudflare-fronted sites return a Server: cloudflare header and a cf-ray identifier on every response, and cached assets carry cf-cache-status. DNS for the domain points at Cloudflare's anycast addresses instead of the origin, which is why an origin address discovered by other means often serves the same site with none of the protection. Site owners choose what runs at the edge: cache rules, firewall rules, rate limiting, managed WAF rule sets, and bot management on paid plans.

Bot scoring uses much more than the address. Cloudflare compares the TLS ClientHello fingerprint, which is what JA3 and JA4 summarise, against the browser the request claims to be, and does the same for HTTP/2 settings and pseudo-header ordering. A curl request wearing a Chrome user agent is contradicted by its own handshake before the first byte of HTML is served. Address reputation and ASN feed in as well, which is where datacenter ranges struggle and residential or mobile carrier space does better.

A poor score produces a managed challenge, an interstitial page that runs a JavaScript check and, on success, sets a cf_clearance cookie for the domain. That cookie is bound to the address and browser that earned it, so rotating to a new exit mid-session discards it and drops you back at the interstitial. Cloudflare's numeric error codes narrow the cause, with 1020 pointing at a firewall rule you tripped and 1015 at rate limiting. They appear in the block page body rather than in the status line.

Passing cleanly is mostly consistency work. The TLS fingerprint, HTTP/2 settings, user agent, header order and advertised language have to describe one browser on one platform, which is why teams run real browser engines or fingerprint-matched HTTP clients instead of default library stacks. Hold a single address for the life of a session so the clearance cookie stays valid. None of this defeats a decision already made, and a site that has chosen to refuse automated traffic will keep refusing it.

Where you meet it

Most people meet Cloudflare as an interstitial where they expected HTML, or as a 403 page carrying a four-digit code. Reading that code and the response headers beats switching proxies as a first move. 1015 points at your pace and 1020 at a rule the site owner wrote, while a challenge loop that never resolves usually points at a client whose handshake and user agent describe different browsers.

Common questions

Do mobile proxies get past Cloudflare?

They improve the address half of the score. Mobile carrier ranges are shared with real subscribers, so blanket bans are expensive for the site and reputation tends to beat datacenter space. The handshake, header order and JavaScript environment are still scored, and a mismatched client fails on those no matter how clean the address is.

What is the cf_clearance cookie?

The token Cloudflare sets once a challenge is passed, letting later requests skip the interstitial. It is scoped to the domain and tied to the address and browser that solved the challenge, so it stops working when you rotate exits or change your user agent. It also expires on a schedule the site owner configures.

What does Cloudflare error 1020 mean?

Access denied by a firewall rule the site owner configured, such as a country block, an ASN block, a path rule or a custom expression. It is not a general bot verdict, so retrying with the same request returns the same page. Work out which attribute of your request the rule targets before changing anything else.

Related terms

Bot Detection
Bot detection is the practice of separating automated traffic from human traffic. Systems score each request against network signals, transport-layer fingerprints, browser characteristics and behaviour over time, then allow, challenge or block it. Vendors including Cloudflare, DataDome, Akamai and HUMAN sell this as a service running in front of the origin server.
WAF
A web application firewall inspects HTTP requests and responses at the application layer and blocks those matching rules for attacks such as SQL injection, cross-site scripting and path traversal. It runs in front of the application as a reverse proxy, a server module or a cloud service, and most deployments add IP reputation feeds and rate-based rules alongside signature matching.
CAPTCHA
A CAPTCHA is a challenge a site serves to decide whether a visitor is a person or a script. Modern versions rarely show distorted text; they score behaviour, browser fingerprint and IP reputation in the background, and only show a puzzle when confidence is low. reCAPTCHA, hCaptcha and Cloudflare Turnstile dominate deployment.
Rate Limiting
Rate limiting is a server-side control that caps how many requests one client may send in a time window. The server counts requests against a key such as an IP address, API token or account, then refuses anything above the ceiling, most often with HTTP 429 and a Retry-After header saying when to come back.
Throttling
Throttling is a deliberate slowdown applied to traffic a server treats as excessive or low priority. Rather than refusing the request, the system queues it or caps the bandwidth it gets, so the client sees rising latency instead of an error. APIs, origin servers and anti-bot systems all use it, and mobile carriers apply it past a data cap.

Real 4G/5G mobile and residential IPs

PROXIES.SX runs carrier IPs in 100+ countries with HTTP and SOCKS5 on every endpoint. $4/GB down to $2.40/GB at volume, free endpoints and rotation, and your GB never expire.

View pricing Browse the glossary