A cloudflare verification bypass script for webscraping
A cloudflare verification bypass script for webscraping
⭐ Thank you for 1,800+ stars! Introducing Version 2.0 with enhanced request mirroring, improved caching and better reliability for bypassing Cloudflare protection.
Bypass Cloudflare protection with ease. Supports cookie generation and request mirroring for any HTTP method.
Need Reliable Proxies? IPcook Has Got You Covered
Start with a FREE 100MB Trial
Use code WELCOME20 for 20% OFF
Scrape.do is the ultimate toolkit for collecting public data at scale. Unmatched speed, unbeatable prices, unblocked access.
One line of code. Instant data access
BirdProxies — Hey, we built BirdProxies because proxies shouldn't be complicated or overpriced. Fast residential and ISP proxies in 195+ locations, fair pricing, and real support. Try our FlappyBird game on the landing page for free data!
RapidProxy – Power Your Data with Premium Proxies
Try proxies for free + Use code RAPID10 for 10% OFF
** Built for Growth** — Whether you're scaling scraping operations, running automation, or accessing global content, RapidProxy delivers the speed, stability, and flexibility you need to grow without limits.
docker run -p 8000:8000 ghcr.io/sarperavci/cloudflarebypassforscraping:latest
Then point your scraper at the server and add an x-hostname header:
curl "http://localhost:8000/api/data" -H "x-hostname: cf-protected-website.com"
Two ways to get past Cloudflare, both powered by a real stealth browser (a patched Chromium via CloakBrowser).
/cookiesAsk the server for clearance cookies for a URL and use them however you like:
curl "http://localhost:8000/cookies?url=https://protected-site.com"
{
"cookies": {
"cf_clearance": "SJHuYhHrTZpXDUe8iMuzEUpJxocmOW8ougQVS0.aK5g-1723665177-1.0.1.1-5_NOoP19LQ..."
},
"user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
}
Route the bypass through a proxy with the proxy query param:
curl "http://localhost:8000/cookies?url=https://protected-site.com&proxy=http://user:pass@host:port"
It launches a stealth browser, navigates to the URL, and solves the Cloudflare
challenge — non-interactive challenges resolve on their own, and interactive
Turnstile checkboxes are located inside their shadow DOM and clicked natively.
Once cleared, it returns the cf_clearance cookie and the exact
user-agent that earned it — you must send both together or Cloudflare rejects
the cookie. The pair is cached, so repeat calls are instant.
Use this when you drive your own HTTP client and just need valid cookies.
x-hostnamePoint your scraper's base URL at the server and add an x-hostname header; the
server transparently proxies the request to the real site with Cloudflare
already bypassed. Add x-proxy to route through your own proxy:
curl -X POST "http://localhost:8000/api/submit" \
-H "x-hostname: protected-site.com" \
-H "x-proxy: http://user:pass@host:port" \
-H "Content-Type: application/json" \
-d '{"key":"value"}'
It generates (or reuses cached) clearance cookies for the host, then replays your exact request — method, path, query, headers, body — to the real site using an HTTP client that mimics Chrome's TLS/JA3 fingerprint, with the Cloudflare cookies merged in. You get the real response back unchanged. This clears both obstacles at once: the JavaScript challenge and TLS fingerprinting — with no browser needed on your side.
Use this when you want a drop-in proxy that "just works" for any HTTP method.
See docs/USAGE.md for control headers, the /html
endpoint, and more.
/cookies and /html endpoints, control headers.Contributions welcome! Submit PRs against the main codebase.
No open issues yet, or sync has not completed.