You request a page and Cloudflare hands you a spinner instead. "Checking your browser before you access the site." A few seconds later it either lets you through or loops you back to the spinner forever. That interstitial is the Cloudflare 5-second challenge, and whether you clear it comes down to what your client looks like, not how long you wait.
The 5-second challenge (Cloudflare calls it a managed challenge, or the older JS challenge) is a full-page interstitial that runs JavaScript in your browser to score whether you're a real visitor. Pass it and Cloudflare sets a cf_clearance cookie so it stops re-challenging you. Fail it and you never reach the actual site.
How it's different from Turnstile
People mix these up constantly, so it's worth being precise. Turnstile is a widget embedded in a form; it returns a token you submit. The 5-second challenge is a full-page gate in front of the whole site; it returns a cookie you reuse on later requests. Different mechanism, different output, different handling.
| Turnstile widget | 5-second challenge | |
|---|---|---|
| Where it appears | Inside a form (login, signup) | Full page, before you see the site |
| What it returns | A cf-turnstile-response token | A cf_clearance cookie |
| How you use it | Submit the token with the form | Send the cookie on subsequent requests |
| Lifetime | Single-use, ~300s | Session-length, tuned per site |
If it's the widget you're facing, go to what is Cloudflare Turnstile instead. This page is about the interstitial.
What the challenge actually checks
During those seconds, Cloudflare runs a JavaScript workload that probes your environment: the browser's fingerprint, whether APIs behave like a real browser, TLS characteristics of the connection, and the reputation of your IP. A plain HTTP client with no JavaScript engine can't run the workload at all, so it fails instantly. A headless browser can run it but often trips fingerprint checks. This is why raw requests or curl gets stuck in the loop no matter how many times you retry.
How to pass it
Two options, same as with Turnstile. Drive a real browser hardened against detection, or call an API that returns the clearance. With Peak the cloudflare5stask hands back the cookie, the matching user-agent, and the supporting headers in one response:
import requests
sol = requests.post(
"https://api.peak.fo/solve",
headers={"X-API-Key": "pk_your_api_key"},
json={
"task_type": "cloudflare5stask",
"url": "https://target.com/",
"proxy": "http://user:pass@ip:port",
},
timeout=30,
).json()["data"]
session = requests.Session()
session.headers["User-Agent"] = sol["headers"]["user-agent"]
for name, value in sol["cookies"].items():
session.cookies.set(name, value)
# keep using the same proxy IP that earned the clearance
page = session.get("https://target.com/data",
proxies={"https": "http://user:pass@ip:port"})
The one rule people forget: the clearance is bound to the IP and user-agent that earned it. Reuse it from a different IP or with a different user-agent and Cloudflare throws it out. That's the whole reason to send it on a sticky proxy with the returned user-agent. The mechanics of reusing the cookie correctly are in the cf_clearance cookie, explained.
Why retrying never helps
The instinct when you hit the loop is to retry harder. It doesn't work, because nothing about the retry changes what Cloudflare is scoring. Same client, same fingerprint, same verdict. You either change what your client looks like or you get a valid clearance from something that can pass the check. Hammering the endpoint just gets your IP rate-limited faster.
FAQ
What is the Cloudflare 5-second challenge?
It's a full-page interstitial that runs a JavaScript workload to decide whether you're a real browser. Pass it and Cloudflare sets a cf_clearance cookie so it stops challenging you. Fail and you can't reach the site.
Why do I keep getting the 5-second loop?
Because your client can't pass the check, so Cloudflare never issues clearance. A plain HTTP client has no JavaScript engine; a headless browser often fails fingerprinting. Retrying with the same client changes nothing. Use a hardened browser or an API that returns the clearance.
How long does clearance last?
Cloudflare tunes it per site, so treat it as a session token: use it until a request gets challenged again, then refresh. Because Peak bills only on success, a refresh costs about a tenth of a cent and a miss costs nothing. See pricing.
Stuck in the 5-second loop? Grab a key free at peak.fo.