How to solve cloudflare turnstile captcha: best captcha solver

5 min readJul 16, 2024

Cloudflare Turnstile is a security feature designed to protect websites from automated abuse by requiring users to solve a challenge before accessing the site. While this tool is essential for maintaining the integrity and security of websites, it can pose a significant obstacle for those involved in legitimate web scraping or automation tasks. In this article, we will explore the best solutions for solving Cloudflare Turnstile, ensuring your operations remain uninterrupted and efficient.

Bonus Code

Claim your Bonus Code for top captcha solutions; CapSolver: WEBS. After redeeming it, you will get an extra 5% bonus after each recharge, Unlimited

Understanding Cloudflare Turnstile

Before diving into solutions, it’s essential to understand what Cloudflare Turnstile is and how it works.
Let’s look at the background first, Turnstile is a feature provided by Cloudflare, a company known for its web performance and online security services, which are very mainstream at the moment. And Turnstile is a tool that blocks user access for different reasons, covering all automated traffic. It’s a huge new sexually challenging challenge for web crawling activities because Cloudflare has introduced an advanced web security system which is currently used by a quarter of websites I estimate.

How Cloudflare Turnstile Works

Turnstile is part of Cloudflare’s CDN (Content Delivery Network) and acts as a reverse proxy. This means that users have to access web content through Cloudflare’s servers, which act as gatekeepers, deciding who can and cannot enter. When Turnstile wants to restrict web access, it presents the visitor with a challenge in the form of a CAPTCHA. If the challenge is successfully resolved, Turnstile may allow you to access the content of the page you are trying to access.

Cloudflare Turnstile uses a variety of techniques to detect and mitigate automated tools or bots. Here are some key methods and technologies it employs:

Behavioral Analysis

Turnstile analyzes user interactions with the website, such as mouse movements, keystrokes, and touch events. Human users have unique patterns in their interactions that are difficult for bots to mimic accurately.

2. Browser Fingerprinting

Turnstile collects information about the browser and device characteristics, including user agent strings, screen resolution, installed plugins, and more. This data helps to create a unique fingerprint for each user, making it easier to identify and block bots.

3. Anomaly Detection

Turnstile uses machine learning models to detect anomalies in user behavior and requests. These models are trained on large datasets to distinguish between legitimate users and bots based on patterns and deviations from normal behavior.

4. Challenge-Response Tests

Turnstile can deploy various types of challenge-response tests, such as CAPTCHA, to verify if the user is a human. These tests are designed to be easy for humans but challenging for bots to solve.

5. Rate Limiting

Turnstile monitors the rate of requests from a single IP address or user session. High-frequency requests are often indicative of bot activity, and Turnstile can apply rate limiting or block the requests accordingly.

6. IP Reputation

Turnstile checks the IP address of incoming requests against a database of known malicious IP addresses. Requests from IPs with a history of malicious activity are more likely to be flagged as bots.

7. JavaScript Challenges

Turnstile can issue JavaScript challenges that require the browser to execute certain scripts. Bots often fail these challenges because they do not execute JavaScript in the same way as a human-operated browser.

8. Honeypot Fields

Turnstile may include hidden form fields that are invisible to human users but can be filled by bots. If these fields are filled out, it is a strong indicator of bot activity.

9. Cross-Verification

Turnstile can cross-verify user information and behavior with third-party services and databases to enhance the accuracy of its bot detection.

10. Machine Learning

Turnstile continuously learns and adapts to new bot behaviors by updating its machine learning models and detection techniques. This helps it stay ahead of evolving bot tactics.

These techniques work together to create a robust system for detecting and mitigating automated tools and bots, ensuring that only legitimate users can access the protected resources.For more detailed information, you can visit Cloudflare’s official documentation and blog posts on Turnstile:

How to Solve Cloudflare Turnstile

1. How to Determine if You Encounter CloudFlare

If accessing with a GUI environment, you can see

If using other non-GUI methods to access, you can check the request response content
Response Status Code is 403,
Response HTML contains window._cf_chl_opt code_challenge content

2. Get the Site Key Value

Extract the siteKey of the site through the CapSolver Extension, refer to blog post

3. How to Use Capsolver to Solve Turnstile Verification

According to the official Capsolver createTask and getTaskResult API, create an AntiTurnstileTaskProxyLess type task to automatically solve Turnstile. The complete code example is as follows:

Use the call_capsolver() method for Capsolver to automatically solve Turnstile and obtain the token and userAgent from the result.
Call the login() method to construct the request parameters and complete the login.

Note: If you get the correct result but still cannot pass, check whether the current network environment is abnormal and switch IP to test.

import time
import requests
import tls_client

CAPSOLVER_API_KEY = "CAI-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
PAGE_URL = "https://dash.cloudflare.com/login"
SITE_KEY = "0x4AAAAAAAJel0iaAR3mgkjp"def call_capsolver():
    data = {
        "clientKey": CAPSOLVER_API_KEY,
        "task": {
            "type": "AntiTurnstileTaskProxyLess",
            "websiteURL": PAGE_URL,
            "websiteKey": SITE_KEY,
            "metadata": {"action": "login"}
        }
    }
    uri = 'https://api.capsolver.com/createTask'
    res = requests.post(uri, json=data)
    resp = res.json()
    task_id = resp.get('taskId')
    if not task_id:
        print("no get taskId:", res.text)
        return
    print('created taskId:', task_id)    while True:
        time.sleep(1)
        data = {
            "clientKey": CAPSOLVER_API_KEY,
            "taskId": task_id
        }
        response = requests.post('https://api.capsolver.com/getTaskResult', json=data)
        resp = response.json()
        status = resp.get('status', '')
        if status == "ready":
            print("successfully => ", response.text)
            return resp.get('solution')
        if status == "failed" or resp.get("errorId"):
            print("failed! => ", response.text)
            return Nonedef login(token, userAgent):
    headers = {
        'Cookie': f'cf_clearance={token}',
        'Host': 'dash.cloudflare.com',
        'User-Agent': userAgent
    }
    session = tls_client.Session(
        client_identifier="chrome_120",
        random_tls_extension_order=True
    )    response = session.post(
        url='https://dash.cloudflare.com/api/v4/login',
        headers=headers,
        data={
            "cf_challenge_response": token,
            "email": "1111111@gmail.com",
            "password": "123456"
        }
    )
    print("Login Resp Status Code:", response.status_code)
    if response.status_code != 403:
        print('Login Resp', response.text)def run():
    solution = call_capsolver()
    token = solution.get("token")
    userAgent = solution.get("userAgent")    login(token, userAgent)if __name__ == "__main__":
    run()

Conclusion

Cloudflare Turnstile is a sophisticated security measure designed to protect websites from automated abuse, but it can present challenges for legitimate web scraping and automation tasks. By understanding how Turnstile works and employing the right tools and techniques, you can effectively solve these barriers and maintain your operations. CapSolver provides a reliable solution for solving Turnstile challenges with its AntiTurnstileTaskProxyLess task type. By integrating CapSolver into your workflow, you can automate the process of solving Turnstile CAPTCHAs, ensuring a smooth and uninterrupted experience. Remember to monitor your network environment and adjust as necessary to optimize your results.