"Please unblock challenges.cloudflare.com to proceed": how to fix it

02What is challenges.cloudflare.com, and is it safe to allow?

challenges.cloudflare.com is the domain Cloudflare uses for its challenge platform and its Turnstile widget, which is why Cloudflare's own instructions for site owners tell them to allow https://challenges.cloudflare.com in their Content Security Policy for scripts and frames. Allowing it in a blocker lets that check run in the page, with the same browser protections as any other web content; it does not grant access to your files or install anything.

Allowing the domain is a narrow change. You permit one service, not every tracker or advert your blocker stops, and you can remove the rule at any time.

03Find the culprit in ten seconds

Three quick tests tell you which layer is blocking the check, so you change only that one.

• Open the same page in a private window. Most browsers run extensions there only if you allowed it, so if the page now works, an extension is the cause. Built-in protection such as Brave Shields or Firefox tracking protection stays on in private windows; test it with its per-site switch.
• Still failing? Load the page on the same device over mobile data, or on another network. If it works there, a DNS filter, VPN or proxy on your usual network is the cause.
• Look the domain up, with dig or the DNS lookup tool. An answer of 0.0.0.0, ::, or the address of a block page means a DNS filter is refusing it; public addresses mean DNS is fine.
• Optional: open https://challenges.cloudflare.com/turnstile/v0/api.js in a tab. A page of JavaScript code means this network can reach the domain, though an extension may still block it inside other pages; a block page or a "can't be reached" error means something stops it.

# Windows (Command Prompt or PowerShell), macOS and Linux
nslookup challenges.cloudflare.com

# macOS and Linux, short form
dig +short challenges.cloudflare.com

# a normal answer: public addresses
104.18.94.41
104.18.95.41

# blocked by a DNS filter in its default mode (Pi-hole answers this way)
0.0.0.0

04The allowlist rule for each blocker

Add one rule in the tool that the test pointed to, then reload the page. The exception filter was checked with the adblock-rust engine that Brave Shields uses: it unblocked the check's script, its frame and its subdomains while a block rule for the rest of cloudflare.com stayed in force.

! uBlock Origin (My filters), AdGuard (User rules or Custom filtering rules), Brave (custom filters)
@@||challenges.cloudflare.com^

# uBlock Origin (My rules): cancels the medium-mode block on third-party scripts and frames
* challenges.cloudflare.com * noop

# Pi-hole v6: allow the domain and every subdomain
pihole --allow-wild challenges.cloudflare.com

# Pi-hole: show which of your lists contain the domain
pihole -q challenges.cloudflare.com

05Browser settings that stop the check

If no blocker is involved, the browser itself may be refusing what the check needs. Cloudflare's documentation names these causes; the menu paths are the browser makers' own.

• JavaScript turned off. In Chrome and Edge, check Settings, Privacy and security, Site settings, JavaScript.
• Cookies refused everywhere. Safari's Block all cookies option sits under Settings, Advanced, and Apple warns that it may stop some websites working. In Chrome, check On-device site data in Site settings.
• Extensions that change the browser's user agent or tamper with Canvas or WebGL, which Cloudflare lists among the things its challenges cannot support. Developer-tools overrides and device emulation can also change the result.
• An outdated browser. Browsers or systems more than five years old, or without security updates for over two years, have limited support, and Internet Explorer is not supported.
• In-app browsers and WebViews with restricted JavaScript, and email preview windows, which typically cannot complete interactive challenges. Open the link in your normal browser instead.

06VPNs, corporate networks and DNS filters

Network-level blocks affect every browser on the device, which is why the mobile-data test separates them from extensions. Pi-hole's default blocking mode answers a blocked name with 0.0.0.0 or ::, so the browser never reaches the check. Other DNS filters behave similarly or return the address of their own block page.

Corporate web filters and TLS-inspecting proxies can block the domain by category, and only the IT team can change that. A VPN or proxy can also make checks harder to pass: Cloudflare notes that shared VPNs and corporate proxies often have a poor IP reputation, and that a check issued to one IP address but answered from another is not valid, which leads to repeated checks. Turning the VPN off for a moment is a fair test. A numbered error page, such as 1015 for rate limiting, is a different problem from a check that cannot load.

07When it is not your fault: outages

If the message suddenly appears on many unrelated sites at once, the check itself may be down. On 18 November 2025 Cloudflare's network began failing at 11:20 UTC; its post-mortem says core traffic was largely flowing normally by 14:30, that 5xx volumes were back to normal at 17:06, and lists among the impacts that "Turnstile failed to load". News reports that day showed this exact message on ChatGPT, and no setting on a visitor's side could fix it.

In that situation, check the provider's public status page and wait. Changing blockers or DNS settings will not help, and you should undo any you changed while testing. Other edge failures have their own codes, listed in the Cloudflare error codes guide.

08Site owners: why your visitors see this message

Most reports come from visitors' blockers, but a few causes sit on the site's side. Cloudflare's documentation lists the ones to check:

• Your Content Security Policy must allow https://challenges.cloudflare.com in script-src and frame-src, or use the nonce-based approach Cloudflare recommends; pre-clearance also needs connect-src 'self'.
• Native apps that show your site in a WebView need JavaScript and DOM storage enabled, access to challenges.cloudflare.com and a consistent user agent for the session.
• CORS preflight requests carry no cookies, so a challenge on an API path breaks cross-origin calls; challenge pages also cannot be embedded in cross-origin iframes.
• Challenging API and fetch traffic at all is usually a mistake, because a script expecting JSON cannot complete a check. Keep challenges for pages people open, as discussed in what is bot management.

Content-Security-Policy: script-src 'self' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; connect-src 'self'