Cloudflare uses a wide variety of data sources, including Project Honeypot, to challenge potentially problematic visitors by IP before they hit your site or your server. The challenge page is designed to provide a layer of security to your website, and the challenge page also thwarts a number of things like spam bots and other threats that may be trying to attack your site. The Cloudflare Web Application Firewall (WAF) will also generate a challenge page for other potential attack signatures.
As the IP data can have some false positives, because of things like dynamic IPs, Cloudflare is including some helpful tips below for dealing with Access Restricted pages as a site owner or visitor.
A site visitor to a website that Cloudflare is protecting can see a captcha for the following reasons:
1.The IP address you are on has shown problematic activity online recently in one of our data sources. If you would like to look your IP up, then please look your IP up at Project Honeypot. If the IP address shows data for malicious activity, you can see why there. You can also attempt to whitelist your IP directly on that page by connecting from that IP. If no bad activity is seen from the IP address after a two-week period, then the challenge behavior will stop against that IP address.
2. The site owner decided to block the country you are visiting from.
3. Your actions are triggering a Web Application Firewall rule that the website owner has turned on.
What to do:
2. If you are interested in turning down the security level settings for your site, you can do so by going to the Cloudflare Basic Security Level settings and changing your security level (Low, Medium, High).
3. If your IP is showing that you are distributing malware or spam, your computer may have an infection and we would recommend running an anti-virus scan.
Note: Cloudflare employees can not remove the captcha. The captcha is showing specifically because of security settings the site owner has turned on.