What does CHALLENGE mean


I have an app that communicates with my USA google cloud server using https. This communication passes through cloudflare.

I have a firewall rule that blocks traffic from certain countries. However India is not blocked, but traffic from India or Pakistan cant seem to reach the server based on what users from those countries are telling me.

The log in cloud flare shows traffic from those countries were “Challenged”, what does “Challenged” mean? Is that blocking the communication with the server? The app is not expecting any challenge whatever that is.


Challenge is an action that presents an hCAPTCHA for users to solve before they are allowed in.

Challenges may be presented because of specific Firewall Rules, but also by some of the Cloudflare WAF rules (if your site is on a paid plan), or due to your general Security Level setting. It often results from a temporarily “bad reputation” of the IP addresses used by users. In a world where many ISP providers use dynamic IP addresses, it’s expected that some users will at some point be challenged when trying to access a Cloudflare protected URL.

But if the app makes http request, and cloudflare sends back a challenge capcha page, the user wont see it becuase the app wont show that because the app is not expecting that. The app may have requested some information from the server like the persons friend list for example, expectnig a JSON string back not a website.

How will the user see this captcha?? The app is not a webpae, it doesnt show web pages so it will not display this to the user to interact with. It will just give an error because it receive something from the server its not expecting.

Im using the free plan.

Is there a way to prevent that? it 100% wont work for my app.

You should first visit he Firewall Log to see what Service is triggering the Challenge. If it is Security Level, you may want to create a Page Rule for the API URL reducing the Security Level to Essentially Off. If it’s something else, you need to change your settings accordingly in the Firewall app.

1 Like

now it seems to be challenging traffic from sites that are not in any firewall rules.

my app is sending https requests to the server and expects JSON string back, so if cloudflare sends back a webpage challenge to the app, the app will crash because it will try to parse the HTML thinking its a JSON string.

I would like to disable all challenges because its crashing my app

Does anybody know how?

This topic was automatically closed after 31 days. New replies are no longer allowed.