Hacker News Reader

Comment by gnopgnip | Hacker News Reader

The website operators have different options to decide what to do with the captcha info, they aren't required to block anyone or show multiple interactive captchas.

View on HN

I pay for Cloudflare Pro and the lowest I can set the WAF is "Essentially Off", requiring me to block whatever IPs are left at that level (which turns out to be a decent amount of legitimate requests). "Actually Off" apparently requires paying thousands of dollars a month for the enterprise plan.

Do you have any more details about what sort of requests are being blocked?

I’ve been planning to use Cloudflare for an upcoming project, under the impression that ‘Essentially Off’ really did mean essentially off, and would only block obvious DDoS traffic. I could understand a legitimate user being blocked if they shared an IP with a host actually engaged in a DDoS attack, but short of that, I don’t want anyone being blocked. It sounds like I should look at other CDN options…

It's a tiny amount compared to the traffic that does get through, but enough that affected users make it to our support channels. I think a good amount are due to VPNs used by users, the rest seemed like standard residential IPs that I didn't see a reason for being blocked.

Yes and no. They can decide not to show the captcha, but not how often it's repeated. The common issue with CF is not that they show a captcha before access. It's that you get just the captchas repeated and never get to the site.

If you're using CF for DDoS protection, then blocking and captchas are the features you want to use. Just not abuse.

As of very recently, all of my lg tvs cannot access certain cloudflare sites at all. Keeps spinning at “click here to verify you are human”. Scourge of the internet, they are

That is true but I was blocked from normal webshops. I always blamed the combination of a datacenter IP at the other side of the country + many computers using the shared ip.

Reply on news.ycombinator.com