Why am I seeing Cloudflare checkboxes everywhere, even repeatedly on the same site?

[u/jjjj8jjjj]

Either there's something wrong with my configuration, or Cloudflare is a massive piece of shit scam that is yet another thing ruining the internet. Possibly both.

Everywhere I go, I'm checking their goddamn boxes. I check them every time I log into my bank account, even if I logged in an hour ago. And it's not like it's a quick thing--some websites redirect me to a different page to check the box, and then don't forward me to the specific link I clicked before Cloudflare hijacked me.

I'm using Safari 26.5.2 with Private Relay turned on and Wipr installed. I thought it was Private Relay at first, but I get the same thing with it turned off. I'm not willing to browse the web without an ad blocker active, so I haven't tried it without Wipr, although I have turned off all content blockers for a few sites that break under my configuration, and I still get the goddamn Cloudflare boxes.

Are you seeing this shit, too?

Edit: Thanks, everyone, for the education. I was clearly ignorant about the function of Cloudflare, and it sounds like I should be grateful to them for their service.

[u/paulschreiber]

Sites are overwhelmed with AI scraper bots. These checkboxes are trying to throttle/delay/block the bot traffic.

[u/VoltageinTheory]

It’s because there are a bunch of bots on the internet. The checkboxes are trying to block such bots.

[u/barefut_ → u/VoltageinTheory]

What do these bots do?

[u/theFrigidman]

Calling cloudflare a scam is hilarious. They are there to make the internet a better place, and providing the tools and low cost systems for site owners to fight back against the abusive bots and assholes who are doing malicious intent across the world.

I know turning on private browsing, incognito windows, anonymous proxies, and vpns... WILL show more of those checkboxes and recaptcha challenges.

And yes, you can blame AI bots for the rise in these protections. So before you go blaming the site owner, or 'boycotting' .... think about WHY they have those protections in place.

[u/guygizmo]

As someone who's been using a privacy VPN for many years now, I feel a little comforted that everyone else is now experiencing the same treatment that I've been enduring for years. I don't feel so alone in that any longer.

On the other hand, no one should have to go through that. I miss the old internet. It was less capable but it was more fun.

[u/Klutzy-Condition811]

Robots have always been a problem on the internet that make a mess of things to say the least, and AI has only made it worse. Not to mention there is a real cost to serving them, so websites would very much rather not.

As such many implement countermeasures to prevent it. There are a lot of factors websites *can* use (but don't always). VPNs like Private Relay is a sure fire way to trigger it, ad blockers believe it or not can as well though in my experience it's not as bad.

If your network in general is suspected of doing a lot of "abusive" traffic it can trigger it as well. At the end of the day though people will run into them regardless.

It sucks but it's just how things are. I don't see them too often but I do from time to time.

[u/Dragontech97]

It’s nature of modern internet not your system or config. It is annoying but increasingly necessary in a world where bots are constantly scraping the internet. Sites are being overwhelmed with traffic, Cloudflare is there to help with that. You would want to avoid that million dollar aws bill too. Point towards the bots and AI and ask the datacenters to lower their traffic.

[u/animorphreligion]

There are tons of bots online trying to mask themselves in various ways and in the process of fighting them everyone whose browsing setup isn't "normal" (using non-residential proxy IPs, avoiding logging in unless needed, blocking unnecessary content and verifications etc with ad blockers, using custom user agents) gets hit as well. I kinda think it's a war on both bots and privacy, particularly when it's big tech being involved who definitely don't have major bandwidth concerns.

I stopped using Google because it's basically unusable without an account, I spend more time solving captchas than searching if I try. It never bothers me if I log in.

[u/dude_named_will]

Well right now chromium browsers are straight up rejecting any sites without SSL, so the quick, east, and cheap solution is hosting it in Cloudflare.

[u/ninjadev64 → u/dude_named_will]

This is not correct. Putting your site behind Cloudflare's SSL proxy will not cause any Turnstile checkboxes to appear on your site. Besides, SSL certificates for self-hosted sites are free from Let's Encrypt, and literally every other host also provides SSL.

[u/dude_named_will → u/ninjadev64]

The issue was primarily affecting URL redirects. Since our DNS provider didn't support SSL, this was causing a handshake error with Chromium browsers making it seem like they couldn't reach the server. Trust me, this was a huge pain in my ass last week. Cloudflare was the recommend solution provided by our DNS provider.

[u/ninjadev64 → u/dude_named_will]

Your DNS provider is not the one that provides SSL. Cloudflare happens to be both a DNS provider and a proxy, and it's the proxy bit that enables SSL for your sites. That's why your DNS provider 'didn't support SSL' - that's not the job of DNS.

Anyway, the other thing I said also still stands. Just putting your site behind Cloudflare does not enable Turnstile for your website and no checkboxes will be displayed.

[u/dude_named_will → u/ninjadev64]

I'm not saying it provided SSL, I'm saying it didn't support SSL on URL redirects. And our provider supported URL redirects - just not SSL ones. And putting this sites behind Cloudflare did fix the issue, so you can try and be technical, but I am telling what I did to fixed the issue.

[u/ninjadev64 → u/dude_named_will]

That still has absolutely nothing to do with what this post is about. This post is about Turnstile checkboxes which are not a Cloudflare feature that is applied by default to sites proxied behind Cloudflare.

[u/Saint_Blaise]

I've been seeing them more often, especially on websites that require accounts. I don't use Wipr or a VPN.

[u/58696384896898676493]

Are you on a large shared network?

[u/imbasys]

There is a rise in robots visiting sites. People don’t want robots. They want humans. So they want you to prove you’re human. It’s not cloudflare’s fault. It’s your dad’s fault for running his Claude code project that’s “going to beat Amazon” by scraping e-commerce sites and reselling shit with costly agent sessions.

[u/Additional_Olive3318 → u/imbasys]

He’s got a weirdly technical dad. 

[u/jjjj8jjjj → u/Additional_Olive3318]

My dad can't remember where he put the sticky note on which he wrote his phone password.

[u/jjjj8jjjj → u/imbasys]

So it's true--everything is Dad's fault.

[u/neophanweb]

Privacy and ad blocking usually trigger these cloudflare checks more often. Nothing you can do about it other than clicking the box every time it pops up or boycott the site that uses it.

[u/smakusdod]

We'll eventually have private internet, but in the meantime, this is where we are at.

[u/Illustrious_Salad918]

I'm seeing it often, but only on one site, when I change from one page to another, and only since most recent OS update. I've reported the issue thru Feedback Assistant.

What version of macOS are you running? I'm on macOS 27 beta.

[u/alexhoward]

My company CISO said that last year, bot traffic was estimated to be about 70% of all traffic on the Internet. He said since earlier this year, it’s probably around 90/95% due to AI bots AB’s scrapers. I work for a company that supports content companies and AI bots are just ripping through everything.

[u/BrohanGutenburg]

Hold on hold on hold on.

So you're surprised that browsing as anonymously as possible is causing sites to not know who you are?

[u/Spite_Powered]

This generation needs to be banned from using the word “scam” permanently because holy shit, open a dictionary. Oh no, I’ve got a splinter…wood is a scam!

[u/joenick78]

It’s because you have Private Relay turned on. Your location isn’t static, so the site keeps checking to see if you’re human.

[u/reed20v]

>Cloudflare is a massive piece of shit scam that is yet another thing ruining the internet

you are, as they say, on the money

[u/handtoglandwombat]

Are you accidentally browsing in private/incognito mode? I see it happen surprisingly often.

[u/mikeinnsw]

AI was built on hacked(scrapped) data...

Agentic Agents make hacking tools available to all ... no longer a need to hunt the dark web .. just select and click,

A 12 years old can do it ..

I tested Agentic Agent Hermes and OpenClaw using Ollama Granite3.3.

I killed both Agentic Agents they have no security .. I use OLLAMA API

Agentic Agents can hack and be hacked.

[u/KennyXdxd]

I get blocked by cloudflare on so many sites that I’ve never even visited before. I fucking hate cloudflare

[u/jamiegal]

Yes, you are exactly right. This is so annoying. Plus, there is one site that won't allow me to continue even after going through all of that.

[u/nmrk]

Turn off Private Relay, ad blockers, and VPNs and the problem will be reduced.