They can be relaxed via managed challenges or even set by specific countries or regions.

Guam and the Northern Mariana Islands are part of the U.S. :rolleyes:

If you use a UK connection or VPN you can bypass the verification

Got stuck in a cloudflare loop this morning. Just continually kept getting the checking if you are a bot message. Very frustrating.

Unfortunately tech is unaware of such a setting existing

Even if it could tell whether a user were logged in, recall that logged-in users used to regularly go on posting sprees. Being logged in is no guarantee of pr:oper behaviour or that the user is not a bot of some kind.

It's interesting because I tried the VPN from my anti-virus programme and Cloudflare says the IP is blocked. So that route won't work, at least not with the free one I have.

I've found that Cloudflare bl:(cks many/most public VPNs.

I mostly read FT by clicking on a link in an email notification. If it's been a day since my last visit, Cloudflare recently will always do a check. Sometimes it'll just go through after wasting some time. Sometimes it'll demand I click a check box. It's so silly and random. (I'm logged in and on a static IP.)

The fact that the Cloudflare challenge is random is exactly what can help defend the platform against bots and other automated attacks, as they struggle to bypass the differing and random nature.

On both laptop and phone, with two different browsers, my experience is currently:
~20% of pages just load as normal;
~30% I get a "checking you're human" page that resolves and goes the page I want;
~35% I have to click the checkbox to show I'm human and it goes to the page I want;
~15% it says it's verified me (with or without checking the box) but then says a security token is missing and refuses access.

The odd things are:
- after I've just gone through the verification to get to a forum page (eg OMNI /PR), I have to do it again to open the threads from that page;
- if it dumps me after saying "no security token" I can open a new tab and load the same page with no check.

I'm not convinced it's "random to confuse the bad guys" as much as "random because our software sucks."

That is your device. Device software last updated?

Laptop - Firefox updated 7 April 2026. (latest version)
Android Phone - Whale browser updated 14 April 2026 (latest version)

I don't think it's me.

What I have.And get cloudflare messages on screen, but not a "no security token" message.

I had the same thing in 2023 (and so did others - in fact, you can browse the whole thread to see multiple people on multiple devices in multiple countries were affected) and then it went away without my updating my browsers. I'm pretty sure it's not me.

Pretty bad from HK again - have to connect thru UK VPN to post this

For the past 10 or so days, I've been getting the Cloudfare check 90% of the time when accessing FlyerTalk, either on Android or Windows desktop. The 10% of the time I don't get the check is because I go to a different FlyerTalk thread with a couple of minutes of performing the check. Two days ago, I couldn't go beyond the check. I'd tick the box and the check would reload, over and over.

What's random about it?

It doesn’t seem to be random, it seems to be configured entirely based on the country of your internet connection.

When I’m in the UK, on mobile, home wifi, any free wifi or even a VPN set to the UK, there’s no Cloudfare challenge.

If I use my Australian mobile on roaming data in the UK (or anywhere) I get the verify you’re a human Cloudflare challenge. If I switch back to UK-based wifi or turn on my UK VPN, I’m no longer interrupted by Cloudflare.

When I’m travelling and using my UK mobile data on roaming, there’s no Cloudflare challenge. As soon as I connect to a local wifi outside the UK I get the verify you’re a human challenge. If I use my Australian VPN in the UK I get the Cloudflare challenge.

It's getting worse with captcha trying to solve itself multiple times now before succeeding. Makes no sense to spend half a minute watching stupid security shenanigans to be able to open the forum and repeat the same process 15 minutes later once session times out.

Edit: computer cannot pass the verification anymore. What a joke.

Makes more sense than having the forum succumb to botnet attacks.

Malaysian IPs getting flagged as well (connecting thru the hotel’s WiFi so pretty sure it’s not my prepaid roaming SIM card)

So all other countries than USA and UK are botnets?

What makes no sense is that someone decided to allow all access from a US or UK internet connection without ever challenging it, and decided that any attempt to visit the site from the rest of the world is a possible botnet attack that needs challenging.

Can someone from FlyerTalk please explain to Cloudflare that Guam and the CNMI are part of the United States?

Typical American company attitude. Just like if I don't use an American browser then I must be a hacker.

The latest iteration apparently thinks my new iPhone 16 is an older computer that needs more thorough checks?


https://cimg8.ibsrv.net/gimg/www.fly...6112dcc96.jpeg

Same for me on Firefox. Seems like a lie to me. I've never seen this version of the message before.

That's the message I mainly get.
​​​​​​
But considering there is a 17 the 16 is clearly ancient..... :D

https://cimg8.ibsrv.net/gimg/www.fly...d44d15f2b6.jpg
The story of my life. :rolleyes: :confused: :(

Glad you put that as a question and the answer is no, that's not what the message says.

Then my iPhone 13 Pro must be ancient, I'm getting the message too.

(Or because I'm stuck on a coach near the Slim River in Perak on my way back to KUL with varying internet quality)

It is probably more a random reflection of random response times that are not really driven by hardware or connections per se. I have had it with fully speed connection that NTT DoCoMo can deliver on their 5G network with a rather potent Android device.

Perhaps instead of just being snarky, which contributes very little to the discussion, you could try to be a bit more helpful and translate the poorly worded message into something the rest of us can understand then?

So now from Hong Kong I get the click to prove you are human Cloudflare box, click it and a few seconds later it just returns, ad infinitum.

However, I bring up a VPN to the UK and straight in with no verification.

It seems strange that defences are necessary against attackers that are apparently so stupid that that they can't spoof their location!

I'm rather curious as to why this Cloudflare configuration still isn't functioning properly.

I encounter Cloudflare protections on countless websites without any trouble whatsoever - yet on Flyertalk, it's an entirely different story. Quite impressive, in its own frustrating way.

At present, the only way I can access the site is by using a VPN set to the United States (other locations remain untested). Without that, I'm treated to an endless loop of Cloudflare checks, which is, as you might imagine, delightful.

This has been going on for weeks now with several effects coming and going. One might have hoped it would have been resolved by this point, but evidently that was optimistic. Perhaps let a cloudflare consultant do the configuration - one that does not have to experiment but knows what he is doing.

For reference, the issue occurs consistently across both desktop and mobile devices here in Germany, using a Vodafone cable connection.

Here's an example of what happens:
https://limewire.com/d/25eN7#aGmqH69Udn

It's gotten worse for me. Amusingly, the only time where I don't get blocked is when I use my company's VPN (Germany, set to Germany). I don't have a habit of using personal VPNs and the one included in my anti virus doesn't work. When I log on from my home in Germany or in France (there every couple weeks), with my mobile networks (Germany and France), there is a good chance the Cloudflare just doesn't verify and I am stuck in the endless loop as mentioned above.

There are some other French websites that use Cloudflare but none are anywhere near as aggressive in locking me out.

I guess Flyertalk doesn't want anyone but Americans and Brits using it, which is fine I guess, I can go elsewhere if I'm really a malicious bot :confused:

I'm sorry you're unable to understand the message but it seems quite obvious to me.

The message says "This verification can take longer due to an older computer or a slow internet connection".

It does not say "This verification can only take longer due to an older computer or a slow internet connection" which would mean your iphone (or speed) was to blame.

As it stands there are probably many unlisted issues which could also cause it.

I think this really has to do with what sort of IP address Cloudflare thinks you are connecting from as well as what specific country you are in. At my house in the US with a static IP address and web and email servers with a proper rDNS setup Cloudflare regularly pops up a screen verifying me (but without my having to click anything these days). At other places I frequent in the US I get n:o such screen.

Ever since Hong Kong was blocked for a while (but now is accessible again), I am no longer able to see images on posts. I believe another user also had the same issue.

Of course, accessing using a VPN would have zero issues. Would this be a cloudfare problem?