Cloudscraper Not Working in 2026? Here's Why, and the Fix

Peak Administrator

— 2 min read

You pip-installed cloudscraper, pointed it at a Cloudflare site, and got a 403, a 503, or an endless "Just a moment…" page instead of your data. It's not your code. cloudscraper stopped being able to solve most Cloudflare sites a while ago, and here's the precise reason, plus a fix that keeps your existing requests-style code.

The 40-word version

cloudscraper only ever solved Cloudflare's old JavaScript-math challenge. Modern sites use Turnstile or the managed 5-second challenge, which run real browser JavaScript. cloudscraper has no browser and no JS engine, so it can't solve them. It just hands you the challenge page.

Why cloudscraper breaks now

  • It solved one specific thing: the legacy IUAM challenge. cloudscraper reads Cloudflare's old "I'm Under Attack" page, extracts a JavaScript math problem, and evaluates it. That's the whole mechanism.
  • It has no browser. Turnstile and the managed challenge execute obfuscated JavaScript and collect behavioral and fingerprint signals. There's nothing for a regex-and-eval tool to compute, so the request stays on the challenge page.
  • Its "Turnstile support" was always a hand-off. cloudscraper never solved Turnstile itself. It added hooks to pass the job to a paid CAPTCHA API and inject the returned token. Without one wired up, that does nothing.
  • It's effectively unmaintained. The last real release was in 2023. Cloudflare has shipped a lot of detection changes since.

How to confirm that's what's happening

Look at the body you're getting back, not just the status code:

resp = scraper.get("https://protected.example/")
print(resp.status_code)          # 403 / 503
print("cf-turnstile" in resp.text or "Just a moment" in resp.text)  # True -> it's the challenge

If that's True, you received the challenge page, not a block. You don't need better headers or a new user-agent. You need something that can actually pass Turnstile.

The fix: change one import

We built cloudscraper-turnstile for exactly this. It subclasses requests.Session the same way cloudscraper does and mirrors its API, so migration is one line. When it hits a Turnstile or 5s challenge, it solves it through Peak and retries the request transparently.

pip install cloudscraper-turnstile
export PEAK_API_KEY=pk_your_key
import cloudscraper_turnstile as cloudscraper   # the only line that changes

scraper = cloudscraper.create_scraper()
resp = scraper.get("https://protected.example/")   # Turnstile solved, real page returned
print(resp.status_code)   # 200

Your existing create_scraper keyword arguments (browser, delay, sess, and the rest) are accepted and don't raise, so you don't have to rewrite the rest of your call. Cookies from the solve, including cf_clearance, persist on the session for every later request.

Use your own proxy

Cloudflare ties clearance to the requesting IP, so pass a proxy and it's used for the solve too:

scraper = cloudscraper.create_scraper(
    api_key="pk_your_key",
    proxy="http://user:pass@ip:port",
)

What it costs

You pay only for solves that land (failed solves are free), starting at $0.90 per 1,000 and dropping to $0.35 at volume. New accounts get 1,000 free solves with no card, so you can run it against your own target before deciding.

If you're not on cloudscraper

Same idea, different library: scrapy-turnstile, selenium-turnstile, playwright-turnstile, and turnstile-curl for curl_cffi. All of them wrap the same one-call Peak API.

Get a free key · Docs · Source on GitHub

Use this for automation, QA, and scraping public data you're allowed to access. Respect each site's Terms of Service and robots.txt, and rate-limit yourself.

Read more