# Cloudflare challenge page

> Get past Cloudflare's "Just a moment..." challenge page with YesCaptcha and receive cf_clearance and other cookies plus the User-Agent. CloudFlareTaskS2 and CloudFlareTaskS3 (not recommended), proxy requirements and how to use the result.

Source: https://docs.yescaptcha.com/en/tasks/cloudflare-challenge/ · Last verified: 2026-10-15

The Cloudflare challenge page replaces a whole site with “Just a moment…” / “Checking your browser” before letting you in. YesCaptcha opens the page through the proxy you provide, passes the check, and returns the cookies (such as `cf_clearance`) and the User-Agent it used. `CloudFlareTaskS3` costs 20 points (¥0.02) per task and is asynchronous. Failed and timed-out tasks are refunded automatically.

> **Not recommended:** Cloudflare updates its checks frequently, and some sites may not pass or may not return `cf_clearance`. Test with a small batch first, and contact support if you run into problems.

- POST `https://api.yescaptcha.com/createTask` (Global endpoint)
- POST `https://cn.yescaptcha.com/createTask` (China endpoint)

## When to use

-   The page source contains `__cf_chl_rt_tk` or `cdn-cgi/challenge-platform`, and the title is `Just a moment...`: this is the challenge page.
-   If only a Cloudflare widget is embedded in a form, it is [Turnstile](https://docs.yescaptcha.com/en/tasks/turnstile/) instead.
-   If your HTTP library gets a 403 with “Just a moment…” but a browser opens the page directly, you are probably only being blocked by TLS fingerprinting. A library that imitates a browser’s TLS fingerprint (such as curl\_cffi) usually fixes it without solving anything.

## Task types and pricing

| Task type | Price | Mode | Notes |
| --- | --- | --- | --- |
| `CloudFlareTaskS2` | 25 points (¥0.025) | Asynchronous | Not recommendedOwn proxy |
| `CloudFlareTaskS3` | 20 points (¥0.02) | Asynchronous | Not recommendedOwn proxy |

## Request parameters

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `type` | string | Yes | Task type; see "Task types and pricing" on this page |
| `websiteURL` | string | Yes | Full URL of the page that shows the captcha. Use the site you see the captcha on, not the captcha vendor's domain |
| `proxy` | string | Yes | Proxy as one string, e.g. `http://user:pass@proxy.example.com:8080` or `socks5://proxy.example.com:1080`. SOCKS5 with a password is not supported; local or private addresses will not work |
| `waitLoad` | boolean | No | Wait until the page has fully loaded before returning. Set to true if you need the full page content; it takes longer |
| `requiredCookies` | array | No | Cookie names you want returned, default `["cf_clearance"]`. You can list several, but they are not guaranteed |
| `blockImage` | boolean | No | Skip loading images to save proxy traffic |
| `postData` | object | No | If set, the target URL is opened with a POST request carrying this object, e.g. `{"name": "hi"}` |

> **Proxy:** `proxy` is required. Cloudflare is strict about proxies, so use a good-quality proxy outside mainland China; on `ERROR_CAPTCHA_UNSOLVABLE`, change the proxy and try again. Local or private addresses (`127.0.0.1`, `192.168.x.x`) won’t work because our servers cannot reach them, and SOCKS5 proxies with a password are not supported.

Don’t send a custom User-Agent; use the `user_agent` the API returns for later requests.

## Request example

POST https://api.yescaptcha.com/createTask

```json
{
  "clientKey": "YOUR_CLIENT_KEY",
  "task": {
    "type": "CloudFlareTaskS3",
    "websiteURL": "https://example.com/",
    "proxy": "http://user:pass@proxy.example.com:8080",
    "waitLoad": false,
    "requiredCookies": [
      "cf_clearance"
    ]
  }
}
```

Then call `getTaskResult` every 5 seconds as for any asynchronous task; see [getTaskResult](https://docs.yescaptcha.com/en/api/get-task-result/).

## Result

```json
{
  "errorId": 0,
  "status": "ready",
  "solution": {
    "cookies": { "cf_clearance": "zqKrlel6E6_SM2707VdArsu2c5.bYqLKU3DOl4tlkCE-1691687641-0-1-8d7f630c..." },
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
    "request_headers": { "accept-language": "en-US,en;q=0.9", "user-agent": "Mozilla/5.0 ..." },
    "headers": { "server": "cloudflare" },
    "content": "<!DOCTYPE html>..."
  }
}
```

| Field | Type | Description |
| --- | --- | --- |
| `cookies` | object | Cookies obtained after passing the check, usually including `cf_clearance`. Use them together with the returned `user_agent` and the proxy you supplied |
| `user_agent` | string | The User-Agent used to pass the check; use it for all follow-up requests |
| `request_headers` | object | Request headers sent when passing the check; reuse them in follow-up requests |
| `headers` | object | Response headers from the target site |
| `content` | string | HTML source of the target page |

## Using the result

1.  Make later requests with the returned cookies, the returned `user_agent` **and** the same proxy you used for the task. Cloudflare expects all three to match.
2.  Send the `request_headers` too where possible, and use a browser-like TLS fingerprint (for example curl\_cffi’s `impersonate` option).
3.  `cf_clearance` stays valid for a while (up to an hour on some sites), so you don’t need to solve again within that time, but sending requests too fast may get the IP blocked by Cloudflare.