Cloudflare Turnstile: the "Verify you are human" check explained

Turnstile is one technology in two places. On a challenge page it stands in front of the content. On a form it guards one action. What you see depends on the mode the site chose.

For most people Turnstile is a spinner that turns into a success mark. When it asks, the whole task is to tick one box. When it fails or keeps coming back, Cloudflare's own troubleshooting page names the causes: an unstable network, a setting or an extension that blocks its scripts, an unsupported browser, JavaScript turned off, or signals that look automated.

• Update the browser. Turnstile supports all major browsers; an old one gets the "outdated or unsupported browser" state.
• Disable extensions for a moment, ad blockers above all, and reload. They may block the scripts Turnstile needs.
• Make sure JavaScript is enabled: Turnstile cannot run without it.
• Try a private window, then another browser or device, to rule out cached data and your own setup.
• Turn off the VPN or proxy, or switch to another network such as a mobile hotspot.
• If the box sat unticked for a long time, or you waited long before sending the form, reload the page. The check times out and has to be issued again.
• If it still fails, tell the site. Its administrator can read the error and report it to Cloudflare.

For code, Turnstile is two different things, and only one of them stands between a script and a public page.

• On a challenge page, Turnstile is the gate. An HTTP client cannot run it and stays on the 403. A real browser runs the checks, receives the cf_clearance cookie and then the page.
• On a form, Turnstile guards the submission, not the page. The page loads without it; what needs the token is the login, the sign-up or the message someone would send.
• What it reads is the browser and how it behaves. A browser driven by an automation tool leaves marks that the checks look for, which is why a box that clears for a person may ask a script to click, or loop.
• A pass does not travel. The clearance cookie is tied to the visitor and the device that earned it, so one copied from another machine is ignored.

The whole picture of the system is in the guide: How to Bypass Cloudflare When Scraping. See also "Just a moment...".

Send the URL of the page to the REST endpoint. With mode: "auto", the default, the first attempt is a browser-grade request from a residential IP. When Cloudflare answers with a challenge page, the browser tier opens the page, waits for the check to clear, and returns the page behind it.

curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/", "country": "us"}'

import requests

r = requests.post(
    "https://app.quanticdata.io/api/v1/scraper/unlock",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"url": "https://example.com/", "country": "us"},
    timeout=130,
)
page = r.json()["payload"]
print(page["status"], page["blocked"], page["latency_ms"], page["cost"])
print(page["body"][:500])

const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", {
  method: "POST",
  headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://example.com/", country: "us" }),
});
const { payload: page } = await res.json();
console.log(page.status, page.blocked, page.latency_ms, page.cost);
console.log(page.body.slice(0, 500));

The call fetches pages; it does not send forms. For many pages of one site, keep calling from the same account: after a pass the session is reused, and the next calls come back faster.

What the answer tells you

In the canary of 11 November 2026, all 9 calls to Cloudflare-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s.

A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the Web Unlocker status page.

• It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles.
• Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with blocked: true and blockClass: "captcha", so your code can skip the page or try later.
• When the check does not clear, the answer comes back with blocked: true and its block class, never the challenge page passed off as content.
• It does not fill or submit forms protected by Turnstile.
• It does not log in for you and it does not create accounts. Pages behind a login stay behind it.
• Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction.