So now from Hong Kong I get the click to prove you are human Cloudflare box, click it and a few seconds later it just returns, ad infinitum.

However, I bring up a VPN to the UK and straight in with no verification.

It seems strange that defences are necessary against attackers that are apparently so stupid that that they can't spoof their location!