How to fix Cloudflare captcha loop
If Cloudflare keeps sending you back to the CAPTCHA screen, the problem is usually a browser, cookie, network, or site configuration issue rather than a single broken page.
This guide explains what causes the loop and how to fix it quickly without guesswork.
What is a Cloudflare CAPTCHA loop?
A Cloudflare CAPTCHA loop happens when a visitor completes the verification challenge, but the page reloads and presents the challenge again.
Cloudflare uses challenge pages, managed challenges, Turnstile, and bot checks to protect websites from abuse, but a misread signal can cause repeated prompts for legitimate users.
The loop often appears on websites that rely on Cloudflare CDN, WAF, Bot Management, or rate limiting.
It can happen on desktop browsers, mobile browsers, or app webviews when the verification token is not accepted, stored, or returned correctly.
Why the CAPTCHA keeps repeating
Several technical factors can trigger the loop.
In many cases, more than one issue is involved.
- Blocked cookies: Cloudflare challenges usually require first-party and challenge cookies to persist.
- Disabled JavaScript: Challenge flows often depend on JavaScript execution.
- VPN or proxy use: Shared or flagged IP addresses may trigger repeated verification.
- Browser extensions: Ad blockers, privacy tools, and script blockers can break challenge scripts.
- Corrupted cache: Old challenge data or stale site assets can interfere with validation.
- Incorrect time or date: A device clock that is too far off can affect token validation.
- Strict security rules: The site may be over-filtering traffic through WAF or bot rules.
- Cross-site tracking restrictions: Some browsers or privacy settings can limit how challenge data is stored.
How to fix Cloudflare CAPTCHA loop as a visitor
1. Refresh the page and complete the challenge once
Start with a simple reload.
If the challenge page partially loaded or timed out, a fresh request may resolve it.
Complete the CAPTCHA carefully and wait for the redirect to finish before clicking anything else.
2. Enable cookies and JavaScript
Cloudflare verification depends on browser functionality.
Make sure cookies are allowed for the site and that JavaScript is enabled in your browser settings.
If you use a privacy-focused browser mode, try a normal profile first.
3. Disable extensions temporarily
Ad blockers, anti-tracking extensions, script blockers, and privacy add-ons can interrupt Cloudflare challenge scripts.
Disable them for the site or test in a clean browser profile.
If the loop stops, re-enable extensions one by one to find the culprit.
4. Clear site data and cache
Delete cookies, cache, and stored site data for the affected domain.
A stale challenge cookie or broken local storage entry can cause the browser to replay the verification sequence.
After clearing data, close the tab fully and open the site again.
5. Try a different browser or private window
Testing in Chrome, Firefox, Edge, or Safari can help isolate browser-specific problems.
A private window is useful because it starts with a cleaner session.
If the CAPTCHA works there, the issue is likely tied to saved cookies, extensions, or browser configuration.
6. Turn off VPN, proxy, or Tor
Cloudflare may challenge traffic from anonymized or heavily shared IP ranges more aggressively.
Disconnect from your VPN or proxy and retry.
If you are on a corporate network, another exit IP or mobile hotspot may behave differently.
7. Check your device clock
Set your operating system to automatic time and time zone synchronization.
A mismatched clock can break security token validation, especially on devices that have been offline or manually adjusted.
8. Switch networks
If the loop continues, test another network such as mobile data, a different Wi-Fi connection, or a hotspot.
Network-level filtering, captive portals, DNS issues, or IP reputation can all influence Cloudflare’s risk score.
How to fix Cloudflare CAPTCHA loop as a site owner
If you manage the website behind Cloudflare, the issue may not be on the visitor side.
Site-side misconfiguration can make legitimate users appear suspicious or prevent the challenge result from being stored correctly.
Review Firewall rules and Bot settings
Examine Cloudflare Firewall Rules, WAF custom rules, Bot Fight Mode, and Super Bot Fight Mode if enabled.
Overly aggressive rules can send the same visitor into repeated challenges.
Check whether a rule is matching normal browser traffic, specific regions, or mobile users.
Inspect challenge sensitivity
Managed Challenge and Turnstile settings should match the risk level of the site.
If the threshold is too strict, returning visitors may keep getting flagged.
For many sites, the safest approach is to challenge only high-risk patterns instead of broad traffic segments.
Confirm cookies are not being stripped
Application code, reverse proxies, security headers, or privacy plugins may remove or block challenge cookies.
Verify that no middleware is rewriting headers in a way that breaks Cloudflare validation.
This is especially important on WordPress, Magento, and custom single-page applications.
Check cache and page rules
Improper caching can serve stale challenge pages or invalidate the flow.
Review Cache Rules, Page Rules, and origin cache behavior.
If the site caches HTML too aggressively, users may see old challenge states instead of the completed request.
Test behind a reverse proxy or load balancer
When Cloudflare sits in front of another proxy, such as Nginx, AWS ALB, or a security appliance, forwarding headers must be correct.
Mistaken IP forwarding or session handling can make Cloudflare or the origin treat the visitor as a new client every time.
Advanced checks for persistent loops
If the problem survives basic troubleshooting, narrow it down with a structured test process.
- Test with a clean browser profile: This removes extensions and stored site data from the equation.
- Check the browser console: Look for blocked scripts, CSP errors, or failed requests on the challenge page.
- Review Cloudflare Security Events: Confirm whether the same IP or ASN is being challenged repeatedly.
- Inspect response headers: Verify that cookies and redirects are delivered correctly.
- Try another account or device: This helps determine whether the issue is tied to a user session or a broader network pattern.
Common mistakes that keep the loop going
Some fixes appear to work briefly but do not address the root cause.
Avoid these common mistakes when troubleshooting Cloudflare CAPTCHA loops.
- Clicking the CAPTCHA multiple times before the redirect finishes
- Using several privacy extensions at once without testing individually
- Leaving browser cookies blocked for the entire site
- Keeping a VPN enabled while testing site access
- Ignoring site-side Cloudflare rules after clearing local browser data
- Assuming the problem is only Cloudflare when the origin app or proxy may be involved
When the issue is likely on Cloudflare’s or the website’s side
If multiple users report the same loop, the issue is probably not isolated to one browser.
Look for recent security changes, rule edits, or infrastructure updates.
A sudden increase in challenge frequency can also indicate an IP reputation issue, an origin connectivity problem, or a misfiring bot rule.
For website operators, the fastest path is to compare challenged requests with successful ones in Cloudflare logs and security analytics.
That comparison often reveals whether the visitor is being flagged by geography, user agent, cookie behavior, ASN, or a specific URL pattern.
Best-practice settings to prevent future CAPTCHA loops
Once the immediate issue is fixed, a few preventive steps can reduce repeat incidents.
- Allow challenge cookies and preserve browser sessions for logged-in users.
- Use targeted security rules instead of broad challenge policies.
- Keep Cloudflare and origin proxy settings aligned.
- Document any extension, browser, or network environments that fail testing.
- Recheck custom rules after major site changes, especially login, checkout, and API endpoints.
For most users, the fastest fix is clearing cookies, disabling conflicting extensions, and avoiding VPNs.
For site owners, the key is to reduce false positives by tuning Cloudflare security settings and preserving challenge state correctly.