# Cloudflare Just a Moment: Stuck, Loop and 403 > Cloudflare Just a moment, Verifying you are human: what the challenge page checks, why it loops or stays stuck, and how a script gets the page behind it. [Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / Just a moment Block pages · Cloudflare # Cloudflare "Just a moment...": what the page is and why it gets stuck "Just a moment..." with "Verifying you are human" is Cloudflare's challenge page. It holds the request while a script checks that a real browser is asking, then lets it through, usually within a few seconds. It gets stuck when that script cannot finish. A script that meets it gets the page with one Web Unlocker call. [Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=cloudflare-just-a-moment-start-1) · [The Cloudflare guide](https://quanticdata.io/web-unlocker/bypass-cloudflare/) - **9 of 9**: calls to Cloudflare-protected pages answered with the real page, canary of 11 November 2026 - **88.9%**: across all 27 protected targets of the same run - **4.1 s**: median response across the run - [What you are looking at](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#seen) - [If you are a visitor](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#visitor) - [If your script gets it](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#script) - [Get the page](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#call) - [Measured](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#measured) - [Limits](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#limits) - [FAQ](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/#faq) ## What you are looking at The page is a waiting room, not a refusal. It has one job, to run a check in the browser, and one header that names it. | Where to look | What it shows | | --- | --- | | Status code | `403` on the challenge page. `503` on older JavaScript challenges. | | Text on the page | "Just a moment..." as the title, with "Verifying you are human. This may take a few seconds." or "Checking your browser before accessing". | | Response header | `cf-mitigated: challenge`. Cloudflare sets it on every type of challenge page, and the content type is HTML whatever you asked for. | | Script | Loaded from `/cdn-cgi/challenge-platform/` on the site's own domain. | | What it may ask | Nothing, when the check clears by itself. Otherwise a box to tick: "Verify you are human". The check inside the page is Cloudflare Turnstile. | | Cookie after a pass | `cf_clearance`. It is tied to the visitor and the device it was issued to, and valid for the time the site set. | | Which system | Cloudflare, on a rule of the site: its firewall, its bot management or its rate limiting can all send a challenge. | ![How to read the Cloudflare Just a moment page: first the words Just a moment, Verifying you are human, with a 403 status, then a block page with three marked zones (status, words, the cf-mitigated header), last a card that names the system as Cloudflare, the kind of block as a challenge and not a refusal, the cf-mitigated: challenge header, and what to do next: let the script finish.](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/diagram.webp?v=20261111b1) *What the page shows, which system sent it, and what to do next.* ## If you are a visitor In a normal browser the page goes away by itself: the script runs, the check passes and the site loads. When it stays, or comes back in a loop, the check could not finish or its result could not be saved. - Allow JavaScript and cookies for the site. The check is a script, and its pass is stored in the `cf_clearance` cookie: without either, the page repeats. - Disable extensions for a moment, ad blockers above all, then reload once. They may block the scripts the check needs. - Update the browser, or try a private window, then another browser or device. Old and unsupported browsers fail the check. - Turn off the VPN or proxy, or switch to another network such as a mobile hotspot. A shared address is challenged more often. - If a box appears, tick it. If nothing works in a clean browser, the rule of the site is the cause: tell its owner. ## If your script gets it A script receives the same page as a `403` with HTML it did not ask for, even on an API call. Four things explain why it never becomes the real page. - No JavaScript, no pass: `requests`, cURL and similar clients cannot run the challenge script, so they get the `403` every time. - The handshake counts first: a client whose TLS and HTTP/2 fingerprint does not match the browser in its `User-Agent` is challenged more, and harder. - A copied cookie does not travel: `cf_clearance` is tied to the visitor and the device it was issued to. Pasted into a script on another machine, it is ignored. - To detect it, read the header: `cf-mitigated: challenge` is there on every challenge page, so there is no need to guess from the body. The whole picture of the system is in the guide: [How to Bypass Cloudflare When Scraping](https://quanticdata.io/web-unlocker/bypass-cloudflare/). See also [Cloudflare Turnstile](https://quanticdata.io/web-unlocker/cloudflare-turnstile/). ## Get the page with one call Send the URL to the REST endpoint. With `mode: "auto"`, the default, the first attempt is a browser-grade request from a residential IP. If Cloudflare answers with the challenge, a real browser opens the page, waits for the check to clear and returns what it sees. cURL: ```bash curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com/", "country": "us"}' ``` Python: ```python import requests r = requests.post( "https://app.quanticdata.io/api/v1/scraper/unlock", headers={"Authorization": "Bearer YOUR_API_KEY"}, json={"url": "https://example.com/", "country": "us"}, timeout=130, ) page = r.json()["payload"] print(page["status"], page["blocked"], page["latency_ms"], page["cost"]) print(page["body"][:500]) ``` Node.js: ```javascript const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", { method: "POST", headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" }, body: JSON.stringify({ url: "https://example.com/", country: "us" }), }); const { payload: page } = await res.json(); console.log(page.status, page.blocked, page.latency_ms, page.cost); console.log(page.body.slice(0, 500)); ``` For many pages of one site, keep calling from the same account: once a challenge is passed, the next calls reuse that session and come back faster. With `mode: "tls"` no browser is opened, and a challenged call comes back blocked. ### What the answer tells you | Field | What it says | | --- | --- | | `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. | | `vendor` | The system the engine recognised on a blocked attempt. For this page: `cloudflare`. | | `blockClass` | `js_challenge` when the check did not clear in time, `captcha` when the page that came back still asks a person. | | `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. | | `attempts`, `latency_ms` | How many tries the call took and how long it lasted. | | `cost` | The bytes this call moved and what it was charged. | ## Measured, with a date In the canary of 11 November 2026, all 9 calls to Cloudflare-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s. A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/). ## What it is for, and what it does not do - It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles. - Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later. - It does not log in for you and it does not create accounts. Pages behind a login stay behind it. - Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction. ## Just a moment: questions people ask ### What is the Cloudflare "Just a moment..." page? It is a challenge page. The site sits behind Cloudflare, and one of its rules asked Cloudflare to verify the visitor before passing the request on. The page runs a script in your browser, and when the script finishes the site loads. Most people never have to click anything. ### Why am I stuck on "Verifying you are human"? Because the check cannot finish or cannot save its result. The usual causes are JavaScript or cookies turned off, an extension that blocks the check script, an outdated or in-app browser, or a VPN address that keeps being challenged. Fix those in that order and reload the page once. ### Why does the page loop after I pass the check? A pass is stored in the cf_clearance cookie, which is tied to the visitor and the device that earned it. If the browser refuses the cookie, or the address changes between requests as on some VPNs and mobile networks, Cloudflare sees a new visitor each time and asks again. ### Why does cURL or Python get 403 with "Just a moment..."? The challenge is a script, and an HTTP client cannot run it, so the 403 never turns into the page. Changing the User-Agent does not help, because the handshake still shows what the client is. Send the URL to the Web Unlocker: a real browser passes the check and the answer carries the page. ### How can my code tell a challenge from a real answer? Look at the response headers. Cloudflare sets cf-mitigated: challenge on every type of challenge page, and the content type is HTML even when you asked for JSON. The Web Unlocker does this reading for you: its answer says blocked, blockClass and vendor, so you never parse a challenge as data. ### What does the Web Unlocker return when the check does not clear? The answer says so, instead of handing you the challenge page as if it were content: blocked: true, with blockClass js_challenge or captcha and vendor cloudflare. The call has already been retried from a fresh exit, and a new call starts from another one, so your code can simply retry or skip the page. ## Send the URL that shows you this page Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call. [Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=cloudflare-just-a-moment-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/) Block pages: - [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/) - ["Please enable JS and disable any ad blocker"](https://quanticdata.io/web-unlocker/please-enable-js-and-disable-any-ad-blocker/) - ["Access Denied ... on this server"](https://quanticdata.io/web-unlocker/access-denied-on-this-server/) - [Error 1015](https://quanticdata.io/web-unlocker/cloudflare-error-1015/) - [Error 1020](https://quanticdata.io/web-unlocker/cloudflare-error-1020/) - ["Pardon Our Interruption"](https://quanticdata.io/web-unlocker/pardon-our-interruption/) - [Press and hold CAPTCHA](https://quanticdata.io/web-unlocker/press-and-hold-captcha/) - ["The requested URL was rejected"](https://quanticdata.io/web-unlocker/request-rejected-support-id/) - [Cloudflare Turnstile](https://quanticdata.io/web-unlocker/cloudflare-turnstile/) - [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/) Guides: - [Cloudflare guide](https://quanticdata.io/web-unlocker/bypass-cloudflare/) - [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/) - [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/) - [PerimeterX (HUMAN)](https://quanticdata.io/web-unlocker/bypass-perimeterx/) - [Kasada](https://quanticdata.io/web-unlocker/bypass-kasada/) - [Imperva (Incapsula)](https://quanticdata.io/web-unlocker/bypass-imperva/) - [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/) - [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/) Also: - [Web Unlocker](https://quanticdata.io/web-unlocker/) - [Status and canary](https://quanticdata.io/web-unlocker/status/) - [Residential proxies](https://quanticdata.io/residential-proxies/) - [Mobile proxies](https://quanticdata.io/mobile-proxies/) ## References By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/index.md) - [Cloudflare docs: interstitial challenge pages](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/) - [Cloudflare docs: detect a challenge page response (the cf-mitigated header)](https://developers.cloudflare.com/cloudflare-challenges/challenge-types/challenge-pages/detect-response/) - [Cloudflare docs: clearance and the cf_clearance cookie](https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/) - [Cloudflare docs: challenge solve issues (loops, causes and the troubleshooting steps for visitors)](https://developers.cloudflare.com/cloudflare-challenges/troubleshooting/challenge-solve-issues/) - [RFC 9110, section 15.5.4: 403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.4) - [Web Unlocker in the QuanticData API docs: request, answer, errors and how to read a block (vendor and blockClass)](https://quanticdata.io/docs/#tag/Web-Unlocker) - [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/) --- Source: https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/ · Site index for AI: https://quanticdata.io/llms.txt