Cloudflare

The Cloudflare 5-Second Challenge, Explained

The Cloudflare 5-second challenge is a full-page JS interstitial that returns a cf_clearance cookie. What it checks, why retrying fails, and how to pass it.

Peak Administrator

— 3 min read

You request a page and Cloudflare hands you a spinner instead. "Checking your browser before you access the site." A few seconds later it either lets you through or loops you back to the spinner forever. That interstitial is the Cloudflare 5-second challenge, and whether you clear it comes down to what your client looks like, not how long you wait.

The 5-second challenge (Cloudflare calls it a managed challenge, or the older JS challenge) is a full-page interstitial that runs JavaScript in your browser to score whether you're a real visitor. Pass it and Cloudflare sets a cf_clearance cookie so it stops re-challenging you. Fail it and you never reach the actual site.

How it's different from Turnstile

People mix these up constantly, so it's worth being precise. Turnstile is a widget embedded in a form; it returns a token you submit. The 5-second challenge is a full-page gate in front of the whole site; it returns a cookie you reuse on later requests. Different mechanism, different output, different handling.

 Turnstile widget5-second challenge
Where it appearsInside a form (login, signup)Full page, before you see the site
What it returnsA cf-turnstile-response tokenA cf_clearance cookie
How you use itSubmit the token with the formSend the cookie on subsequent requests
LifetimeSingle-use, ~300sSession-length, tuned per site

If it's the widget you're facing, go to what is Cloudflare Turnstile instead. This page is about the interstitial.

What the challenge actually checks

During those seconds, Cloudflare runs a JavaScript workload that probes your environment: the browser's fingerprint, whether APIs behave like a real browser, TLS characteristics of the connection, and the reputation of your IP. A plain HTTP client with no JavaScript engine can't run the workload at all, so it fails instantly. A headless browser can run it but often trips fingerprint checks. This is why raw requests or curl gets stuck in the loop no matter how many times you retry.

How to pass it

Two options, same as with Turnstile. Drive a real browser hardened against detection, or call an API that returns the clearance. With Peak the cloudflare5stask hands back the cookie, the matching user-agent, and the supporting headers in one response:

import requests

sol = requests.post(
    "https://api.peak.fo/solve",
    headers={"X-API-Key": "pk_your_api_key"},
    json={
        "task_type": "cloudflare5stask",
        "url": "https://target.com/",
        "proxy": "http://user:pass@ip:port",
    },
    timeout=30,
).json()["data"]

session = requests.Session()
session.headers["User-Agent"] = sol["headers"]["user-agent"]
for name, value in sol["cookies"].items():
    session.cookies.set(name, value)
# keep using the same proxy IP that earned the clearance
page = session.get("https://target.com/data",
                   proxies={"https": "http://user:pass@ip:port"})

The one rule people forget: the clearance is bound to the IP and user-agent that earned it. Reuse it from a different IP or with a different user-agent and Cloudflare throws it out. That's the whole reason to send it on a sticky proxy with the returned user-agent. The mechanics of reusing the cookie correctly are in the cf_clearance cookie, explained.

Why retrying never helps

The instinct when you hit the loop is to retry harder. It doesn't work, because nothing about the retry changes what Cloudflare is scoring. Same client, same fingerprint, same verdict. You either change what your client looks like or you get a valid clearance from something that can pass the check. Hammering the endpoint just gets your IP rate-limited faster.

FAQ

What is the Cloudflare 5-second challenge?

It's a full-page interstitial that runs a JavaScript workload to decide whether you're a real browser. Pass it and Cloudflare sets a cf_clearance cookie so it stops challenging you. Fail and you can't reach the site.

Why do I keep getting the 5-second loop?

Because your client can't pass the check, so Cloudflare never issues clearance. A plain HTTP client has no JavaScript engine; a headless browser often fails fingerprinting. Retrying with the same client changes nothing. Use a hardened browser or an API that returns the clearance.

How long does clearance last?

Cloudflare tunes it per site, so treat it as a session token: use it until a request gets challenged again, then refresh. Because Peak bills only on success, a refresh costs about a tenth of a cent and a miss costs nothing. See pricing.

Stuck in the 5-second loop? Grab a key free at peak.fo.

Read more