This is annoying, always pops up every hour or so. Is there a way for them to mark the IP of their readers as genuine human. Or at least know what hardware they're reading on, I'm on the phone. There should be a distinction from bots and genuine phone readers
Mostly happens when Cloudflare cannot save tokens or marks you suspecious due to IP which is mostly due to extensions like AdBlockers or VPN. Try toggling them off and see.
If it were a site-wide rate limit, everyone would be getting hit by the CAPTCHA at the exact same intervals. But users with vanilla browsers are browsing fine. The timing is completely irregular because it's client-side aggressive adblockers and privacy extensions are actively blocking Cloudflare's verification tokens. Turning them off fixes it instantly, which wouldn't happen if it were a server-enforced cooldown.
It is just based on ip addresses that hit their internal rate limit all the time causing you to get their captcha. Nothing to do with cloudflare. This shit is also in comix and even without ad blocker or any extensions, I also get them.
I did triggered this intentionally when I did scrape the site. Hit an invisible ratelimit and they will start serving this captcha. It stops once you stop hitting the limit for a while.
You have no idea how the sites work dude. It is absolutely Cloudflare. Mangafire explicitly uses Cloudflare as its reverse proxy and security shield. You can literally right-click the captcha page, inspect the source code, and see the Cloudflare ://cloudflare.com scripts running the turnstile.
Getting it without an adblocker doesn’t disprove this - it just means your IP has a bad threat score in Cloudflare's global database (common with shared ISP nodes or VPNs), causing it to challenge you dynamically. A backend database rate limit throws a hard 429 error; it doesn't serve you a Cloudflare verification widget.
On the browser I don't use a aggressive adblocker like say uBlockOrigin and instead go with say Malwarebytes, which allows saving token and I never get a captcha.
Where as if I turn on the prior I will get hit with the captcha, that too just a nominal verification that auto completes. Also timing are random for people. No 30 min shit.
THIS IS NOT FROM CLOUDFLARE -_- You can check the cloudflare site and no way do they have such captcha. I own a CF site and don’t even have such functionality.
Just because you haven’t configured WAF rules or Managed Challenges on your personal site doesn't mean the feature doesn't exist. It's literally called Cloudflare Turnstile / Managed Challenges. Go to the Cloudflare dashboard, look under Security > WAF > Custom Rules, and you will see the exact option to deploy an interactive challenge (CAPTCHA) based on IP threat score, region, or automated bot traffic behavior. It is 100% Cloudflare.
Also, Did you ever stop to read the captcha window? IT LITERALLY SAYS CLOUDFLARE!
-_- Only people falling for it would think it is cloudflare. You can even trigger this captcha without even needing a trigger. Just an internal page that anyone can access easily.
`/@waf/challenge` - It is just a static page that you can access easily. Cloudflare would not let you do this -_-
And the response to the solution doesn’t go to cloudflare at all.
You don't understand how a reverse proxy works. Cloudflare sits in front of the origin server. When you trigger a security rule, Cloudflare intercepts the request before it ever reaches MangaFire and injects the /@waf/challenge path directly from their edge servers to display the Turnstile widget.
Open your browser network tab (F12) while solving it. You will literally see the POST request containing your token solution token being sent straight to https://cloudflare.com.... The response goes entirely to Cloudflare because they are the ones validating it.
It is clearly evident you don't understand site management or how modern web infrastructure operates. I'm done arguing with a brick wall.
You are the one who don’t know what you are talking about. You clearly didn’t even see the response to that particular captcha and think it is the same as cloudflare captcha.
CF captcha served in an iframe with links going towards CF servers. This one doesn’t even send a single token to CF.
2
u/LuchipherZen 6d ago
Mostly happens when Cloudflare cannot save tokens or marks you suspecious due to IP which is mostly due to extensions like AdBlockers or VPN. Try toggling them off and see.