Three kinds of challenges, explained without the marketing

Three kinds of challenges, explained without the marketing

Cloudflare offers several ways to make a visitor prove they aren't a script. They aren't interchangeable.

Interactive challenge. The visitor sees a checkbox or a small puzzle. Highest friction, highest certainty. Use it for endpoints that are worth protecting at the cost of some annoyance.

JavaScript challenge. The browser runs a small computation invisibly, usually within a couple of seconds. No click required. Stops simple scripts, but breaks anything that doesn't run JavaScript, including many legitimate API clients.

Managed challenge. Cloudflare picks the least intrusive check it thinks will work. Most real visitors pass without seeing anything. This is the sensible default for the "suspicious but unsure" bucket.

A practical rule of thumb: managed challenge everywhere you're unsure, interactive challenge only on login and signup, no challenge at all on anything machines are supposed to call.