How to Scrape Past Cloudflare With Proxies in 2026

To get past Cloudflare, fix the client before you change the address. On October 22, 2026, we changed one thing at a time against 14 sites. With the same client, our home line and our server in a datacenter got the same answer at all 14. Most matched to the byte. With the same home address, swapping one build of curl for another changed two answers from a challenge to the full page. A wider run over 140 Cloudflare sites that day found the address mattering at 9. Seven of them went against the datacenter (Cloudflare 403 Forbidden). Cloudflare's own docs explain both results: it reads the client's TLS fingerprint on every request, and it scores residential proxy traffic too.

This guide shows the test and what Cloudflare says about its bot score, challenges and cookies. Then it shows where a residential proxy still helps, and the setup that follows. We sell residential proxies, so we have a stake in the address part of this. Our own test says it is the smaller part for a single request, and this page reports that.

Can residential proxies bypass Cloudflare?

Not on their own. Cloudflare has a rule that "Observes traffic from residential proxy networks and similar commercial proxies". When it matches, "Bot Management sets the bot score to 29". Cloudflare's scale runs from 1 to 99. A score of 1 means automated, 2 to 29 likely automated, and 30 to 99 likely human. So a request from a home exit can land at the top of "likely automated" on that signal alone. What a home network does buy is covered below: it keeps volume from piling up on one network, which Cloudflare watches on its own.

What decided Cloudflare's answer: the address or the client?

We sent the same plain request, curl with a Chrome 141 user agent and no JavaScript, to 14 sites. Then we changed one variable at a time:

• The address. The same Linux build of curl (8.5, OpenSSL) ran from our home line and from our server in a datacenter.
• The client. From the same home line, a Windows build of curl (8.16, Schannel) sent the same request.

Each build has its own TLS fingerprint. An echo service read the Windows build's JA4 as t13d2013h1_2b729b4bf6f3_e24568c0d440. It read the Linux build's as t13d3112h2_e8f1e7e78f70_b26ce05bbdd6. That is 20 cipher suites against 31. Everything else (user agent, URL, HTTP version) was the same.

The address changed nothing. The home and datacenter columns match row for row, and most byte counts matched exactly. The client changed SSENSE and Whatnot on every run. GameStop answered the same Windows build with a page twice and a block twice within about fifteen minutes. Its rule was not stable even for one client. Here is the last run, both builds from one PC on one line:

Readers saw this years ago. The Stack Overflow question "Python's requests triggers Cloudflare's security while urllib does not" has 26,455 views. Two client libraries on one machine got two verdicts.

This test also changes how we read our own earlier data. In our August retail study, six Cloudflare stores split their answers between our home and datacenter requests. The two requests also came from two separate clients. In October, two of those six changed with the client alone, two loaded for both addresses, one refused both and one was unstable. The study now carries a correction.

What Cloudflare checks

Cloudflare spells out how it checks requests.

• Heuristics on every request. "The Heuristics engine processes all requests", matching them "against a growing database of malicious fingerprints". A client's TLS handshake can lose here before anything else is weighed. It is the layer our two curl builds differed in. Cloudflare profiles clients by JA3 and JA4.
• JavaScript detections. An invisible script that "identifies headless browsers and other malicious fingerprints".
• Machine learning. The model behind most scores reads "Request features, including headers, session characteristics, and browser signals".
• The address. The proxy rule above, and scraping rules that analyze request patterns "by ASN" and "by JA4 fingerprint".
• The session cookie. "Cloudflare uses the __cf_bm cookie to smooth out the bot score and reduce false positives for actual user sessions".

Fine scores, JA4 and the proxy rule belong to Cloudflare's paid Enterprise Bot Management; free plans run Bot Fight Mode. Each site also writes its own rules on top, which is why two Cloudflare sites can answer the same request in two ways.

Challenges, blocks and cf_clearance

• "Just a moment..." with a 403 and cf-mitigated: challenge is a challenge. A real browser passes it, and a plain client cannot. Our Turnstile guide covers the widget version.
• "Attention Required!" with a 403 is a block from a site rule; there is nothing to solve on that request.
• cf_clearance is the reward for passing. Cloudflare's docs say the cookie "is securely tied to the specific visitor and device it was issued to, preventing reuse across machines". It also recommends that sites rate-limit per cookie value. Passing once in a browser and replaying the cookie from a script, or sharing one cookie across many exits, works against both rules.

Where residential proxies fit

Two things are true at once. For one request, our 14-site test found the address changed nothing. Over 140 Cloudflare sites the same day, it changed the answer at 9, and the datacenter got the harder one at 7. At volume, Cloudflare watches request patterns per network. Its rule 50331648 "Observes patterns of requests sent to your zone, dynamically analyzing behavior by ASN". A scraper that sends thousands of requests from one hosting provider forms one pattern on one ASN. The same requests spread over many home networks are many small ones. That is the job a rotating residential pool does there, behind a client Cloudflare already accepts. The proxy rule still applies, so pacing and the client still decide how each request scores.

Most targets are American: Wappalyzer tracks 3,000,000 live websites with Cloudflare Bot Management, 90% of them in the United States. Every one of our pools targets by country, and Residential Premium adds state, city and ISP targeting.

A setup that gets through

1. Choose the client by what the page needs. Some pages answer a browser-grade TLS handshake without a challenge. There, a client that copies a browser's TLS fingerprint gets the HTML for a fraction of the traffic. Our curl-impersonate guide covers it. Where the page serves "Just a moment...", only a real browser passes.
2. Make the client agree with itself. The user agent, the TLS fingerprint, the HTTP/2 settings and the header order should all describe the same browser. A Chrome user agent on a non-Chrome handshake is a mismatch Cloudflare reads on the first request.
3. Spread volume over many networks with rotating residential exits in the site's country. Hold one sticky exit for each session that carries a cf_clearance cookie.
4. Pace like a person. Rate limits per cookie and patterns per network both reward a slower, wider job over a fast, narrow one.
5. Read every answer. A 403 with "Just a moment..." is a challenge and "Attention Required!" a block. A 200 counts only if the page holds the content you came for.

The traffic bill depends on step 1. At the HTTP Archive's 2024 medians, a full desktop page weighs 2,652 KB and its HTML 18 KB. Per page, a browser moves about 147 times the bytes of a client that only copies the handshake. At our one-GB residential price of $0.50 per GB, 1,000 full desktop pages come to about $1.33, and 1,000 HTML files to under one cent.

Test before you scale

Run your own version of the test before you buy anything. Send the same request from your client through two addresses, then the same address with two clients, and see which change moves the answer. Our proxy checker and IP lookup confirm what each exit is. If the client changes the answer and the address does not, more proxies will not fix it.

When the wall is not your problem to solve

If we already cover the platform, our scraper APIs return its data as JSON. The Cloudflare work stays on our side. If you run FlareSolverr and it stopped working, our FlareSolverr guide covers why.

Limits of this guide

We ran no bypass tool, browser automation or solver, and we tested no proxy's success rate, ours included. Our requests were plain curl clients from one home line and one server in a datacenter, one request per site per variable. They show what decides a plain client's first answer. What passes at depth or at volume is a separate question. A site rule that ignored our address on one request may weigh it at volume, where Cloudflare's network rule applies. GameStop's answer changed between runs. Cloudflare retrains its models all the time, so repeat the test before you rely on it. We will re-read the sources by January 22, 2027.

Sources

• Cloudflare docs, read October 22, 2026, on developers.cloudflare.com: Bot scores, updated August 26, 2026. Additional detections, April 15, 2026. Scraping detections, August 3, 2026. Bot detection engines, October 15, 2026. Clearance, October 16, 2026. JA3/JA4 fingerprint, May 6, 2026.
• Our test, October 22, 2026, about 13:00 UTC: 14 sites, curl 8.5 on Linux from a home line (WSL) and from a server in a datacenter. Then curl 8.16 on Windows from the same home line. The capture is from 13:11 UTC. An echo service read both builds' JA4.
• Wappalyzer, Cloudflare Bot Management page, read October 22, 2026.
• Stack Overflow questions about Cloudflare, read through the Stack Exchange API on October 22, 2026: views and dates as quoted.
• HTTP Archive, Web Almanac 2024, Page Weight: median desktop page and HTML document.
• Our retail bot-defense study of August 24, 2026, corrected October 22, 2026.