Cloudflare "Just a moment...": what the page is and why it gets stuck

The page is a waiting room, not a refusal. It has one job, to run a check in the browser, and one header that names it.

In a normal browser the page goes away by itself: the script runs, the check passes and the site loads. When it stays, or comes back in a loop, the check could not finish or its result could not be saved.

• Allow JavaScript and cookies for the site. The check is a script, and its pass is stored in the cf_clearance cookie: without either, the page repeats.
• Disable extensions for a moment, ad blockers above all, then reload once. They may block the scripts the check needs.
• Update the browser, or try a private window, then another browser or device. Old and unsupported browsers fail the check.
• Turn off the VPN or proxy, or switch to another network such as a mobile hotspot. A shared address is challenged more often.
• If a box appears, tick it. If nothing works in a clean browser, the rule of the site is the cause: tell its owner.

A script receives the same page as a 403 with HTML it did not ask for, even on an API call. Four things explain why it never becomes the real page.

• No JavaScript, no pass: requests, cURL and similar clients cannot run the challenge script, so they get the 403 every time.
• The handshake counts first: a client whose TLS and HTTP/2 fingerprint does not match the browser in its User-Agent is challenged more, and harder.
• A copied cookie does not travel: cf_clearance is tied to the visitor and the device it was issued to. Pasted into a script on another machine, it is ignored.
• To detect it, read the header: cf-mitigated: challenge is there on every challenge page, so there is no need to guess from the body.

The whole picture of the system is in the guide: How to Bypass Cloudflare When Scraping. See also Cloudflare Turnstile.

Send the URL to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. If Cloudflare answers with the challenge, a real browser opens the page, waits for the check to clear and returns what it sees.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

For many pages of one site, keep calling from the same account: once a challenge is passed, the next calls reuse that session and come back faster. With mode: "tls" no browser is opened, and a challenged call comes back blocked.

What the answer tells you

In the canary of 11 November 2026, all 9 calls to Cloudflare-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.