How to fix the error “Enable JavaScript and cookies to continue”
Cómo solucionar el error “Enable JavaScript and cookies to continue” Este error aparece cuando Cloudflare (u otro proxy inverso de seguridad) detecta que el navegador del usuario no cumple con los requisitos mínimos para acceder al sitio: JavaScript está deshabilitado o las cookies no están permitidas . Pero en entornos reales, el problema suele ser más sutil: el navegador sí tiene JS y cookies…
How to solve the error "Enable JavaScript and cookies to continue"
This error appears when Cloudflare (or another security reverse proxy) detects that the user's browser does not meet the minimum requirements to access the site: JavaScript is disabled or cookies are not allowed.
But in real environments, the problem is often more subtle: the browser does have JS and cookies enabled, but the runtime environment configuration (such as a headless browser, test automation, or a scraper) does not correctly emulate the client behavior.
Root cause technical
Cloudflare issues a challenge (CAPTCHA or JS challenge) to verify that the client is a real browser.
If the response does not meet the challenge (for example, because:
The browser does not execute the challenge JS (headless without support),
Cookies do not persist between requests,
The User-Agent or Accept-Language do not match real browsers,
The Referer or Origin is missing in headers,
Third-party cookies are blocked (such as those from Cloudflare),
) then the server returns this static message instead of redirecting to the requested page.
Critical note:
If you are using tools like curl, Python requests, or headless browsers without special configuration, you will not pass the Cloudflare challenge.
It is intentional: Cloudflare blocks non-human traffic by design.
Definitive solution (by scenario)
Case 1: Real browser (end user)
Verify that JavaScript is enabled:
Chrome: Settings → Privacy and security → Site settings → JavaScript → Allowed.
Firefox: Preferences → Privacy and security → Cookies and site data → Disable “Block cookies and site data”.
Clear cookies and cache (especially for *.cloudflare.com).
Restart the browser and reload the page.
Case 2: Automation / Scraping (Python + Playwright/Selenium)
Do not use requests or urllib: they do not execute JS.
Use a real browser with support for Cloudflare.
Example with Playwright (recommended):
```
from playwright.sync_api import sync_playwright
with sync_playwright() as p:
browser = p.chromium.launch(headless=False) # headless=True also works if properly configured
context = browser.new_context(
viewport={"width": 1920, "height": 1080},
user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
)
page = context.new_page()
# Optional: simulate human interaction to avoid blocks
page.goto("https://your-site.com", wait_until="networkidle")
# Explicit wait for Cloudflare challenge and its automatic resolution
try:
page.wait_for_selector("#challenge-error-text", timeout=5000)
raise RuntimeError("Cloudflare blocked the request. Make sure to use a real browser.")
except:
pass
# No challenge → all good
# Proceed with navigation
content = page.content()
```
Keys:
Use wait_until="networkidle" to wait for all JS to finish.
Never use headless="new" without extra configuration: Cloudflare easily detects modern headless.
If you use headless=True, add:
```
context = browser.new_context(
# ... other parameters ...
bypass_csp=True, # Avoid Content Security Policy blocks
java_script_enabled=True,
cookies=[{
"name": "cf_clearance",
"value": "...",
"domain": ".your-site.com"
}] # If you already have a valid clearance
)
```
Case 3: Mobile app / WebView (Android/iOS)
On Android:
Ensure that WebView.getSettings().setJavaScriptEnabled(true) and setAcceptCookies(true) are active.
On iOS:
Verify that WKWebView has dataStore = WKWebsiteDataStore.default() (to persist cookies).
Quick verification (CLI)
If you want to test if the site responds without a challenge:
```
curl -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
-H "Accept: text/html,application/xhtml+xml" \
-H "Accept-Language: es-ES,es;q=0.9" \
-H "Referer: https://www.google.com/" \
-c /tmp/cookies.txt \
-L https://your-site.com
```
If the HTML contains #challenge-error-text, the server is still blocking.
You need to emulate a real browser.
Pro-tip: Avoid the challenge from the origin
If you control the backend:
Add your IP or range to Cloudflare's whitelist (Panel → Firewall → Tools → Add IP Address).
Use Cloudflare Access with token authentication if it's an internal API.
For public APIs: disable "Under Attack Mode" and adjust WAF rules to exclude API endpoints.
Never try to "bypass" Cloudflare without authorization.
It is a violation of their Terms and may result in permanent blocks.
Definitive solution summarized:
Use a real browser (Playwright/Selenium) with enabled cookies, realistic User-Agent, and wait for JS to finish.
If you are the site owner, configure Cloudflare to exclude legitimate traffic.
Translated by urgent.news. Machine-written — may contain errors; check the original before relying on it.
