Geonode logo
Website blocks

How to Fix the Cloudflare Just a Moment Loop

Five checks to find what breaks Cloudflare's test in your browser, then fixes for visitors and owners.

Updated

Get residential proxiesCheck your proxy

TL;DR

The Cloudflare Just a moment page is a challenge guarding the site, and it loops when your browser cannot complete the test or hold on to the cookie proving it passed. The fastest fix is to pause ad and privacy blockers for that site and reload once.

What the Cloudflare check looks like

Browsers show the challenge page; scripts get a 403 that carries a cf-mitigated header.

WhereWhat you see
Under Attack mode page, as Cloudflare's docs name itChecking your browser before accessing...
Any client, response header (curl -sI)cf-mitigated: challenge
Python urlliburllib.error.HTTPError: HTTP Error 403: Forbidden

Why this happens

Your browser must run Cloudflare's script, then store and send back the clearance.

Passing sets a cf_clearance cookie, valid 30 minutes by default, so you skip further checks. Blocked cookies or scripts, or an IP that changes between getting and solving the check, keep that pass from sticking.

Diagnose your Just a moment loop first

Start in the browser; each check rules out one cause.

  • Open the page in a private window on the same Wi-Fi; if it passes there, an extension or stored site data was blocking the check.

  • Try another browser on the same computer; if that one gets through, a cookie or JavaScript setting in the first browser blocks the check.

  • Look for a VPN app, proxy extension or iCloud Private Relay; if pausing it ends the loop, its shared exit address drew the check.

  • If the box shows error 200100 or 110600, check your device clock; Cloudflare names a wrong clock as a cause of both.

  • If the link opened inside an app or a mail preview, try it in Safari or Chrome; passing there points to the in-app browser.

Solutions ranked by effectiveness

Visitors start with the first two cards; the third is for the site's owner.

  1. Most common fix

    Allow the check's script and cookie

    Applies when the check keeps reappearing instead of opening the page. Cloudflare needs JavaScript and cookies to pass any challenge, and blockers can stop its script loading.

    1. Open your blocker's menu on this page and turn it off for this site.

    2. In Chrome, click View site information left of the address, then Site settings.

    3. Set JavaScript and On-device site data to Allow, then reload once.

  2. Check next

    Remove the VPN and correct your clock

    Applies when the loop follows you into a second browser. A VPN exit can carry other users' poor reputation, and an IP change mid-check invalidates the solve.

    1. Disconnect the VPN or proxy extension; the site is judging that shared address, not you.

    2. Set the clock to update automatically in your system's Date & time settings.

  3. Site owners

    Stop your own site from looping visitors

    If you run the site, look the visitor's Ray ID up in Security Events, then change what keeps challenging them.

    1. Turn Under Attack mode off unless a DDoS attack is under way.

    2. Exclude /cdn-cgi/challenge-platform/ paths from Rules expressions on challenged URLs.

    3. Serve every page over HTTPS; on HTTP, cf_clearance defaults to SameSite=Lax.

    4. Keep Challenge Passage between 15 and 45 minutes, as Cloudflare recommends.

Stop the Just a moment loop from coming back

For daily visitors, plus one habit for site owners.

  1. Keep the browser updating itself; Cloudflare gives limited support to browsers without security updates for two years.

  2. Skip extensions that change your User-Agent or alter Canvas and WebGL; challenges do not support them.

  3. If antivirus filters your web traffic, make sure it lets challenges.cloudflare.com through.

  4. Run a malware scan now and then; Cloudflare suggests one to visitors who keep getting challenged.

  5. Owners: test challenges on real phones, since emulated devices in developer tools can get different results.

See the check your users seeLoad your own site from a residential IP in a country where visitors report loops.
Try residential proxies

Related errors

Learn more

FAQ

The site sits behind Cloudflare, which checks that your browser is a real one before handing over the page. Most visitors pass in seconds without doing anything.

Work through the causes in order: blockers and site permissions, then any VPN, then your clock. If none helps, only the site's owner can change the check, so send them the Ray ID.

Each pass has a level: one from a Managed check does not cover an Interactive check. Sites using Cloudflare's Precursor can also re-check a session that looks suspicious before the pass expires.

No. Cloudflare says its staff cannot remove a challenge; only the site's owner can. Give the owner the Ray ID and a HAR file recorded with Preserve log on.

Cloudflare does not support curl or tools such as Puppeteer for solving production challenges, so scripts stop at a 403. Use the site's API, follow robots.txt and its terms, or ask the owner for access.

A real check asks at most for a click. Microsoft has documented fake ClickFix checks that spoof Cloudflare and tell you to paste a command into the Windows Run box; never do that.

Check your site in a browser

Add your computer's IP to Geonode's whitelist, and the browser needs no proxy password.

Try residential proxies