Selenium keeps getting blocked? Here's what Cloudflare actually sees
Cloudflare's bot protection checks your headers, TLS handshake, and HTTP/2 connection. Some of those checks refuse a request before any script runs. The others cannot refuse on their own, and a request they don't settle gets a JavaScript challenge page that inspects the browser. That's why the usual advice fails. You patch navigator.webdriver, add delays, and install a stealth plugin. The…
Cloudflare's bot protection mechanism examines headers, TLS handshake, and HTTP/2 connections. It blocks requests before running any scripts. The checks that cannot refuse requests on their own include a User-Agent blocklist and an HTTP/2 fingerprint that must match the browser in the headers. Selenium, which runs real Chrome, was found to leak HeadlessChrome in the User-Agent, causing the 403 error.
Replacing the User-Agent header with a normal Chrome string cleared the block in all 28 tests. Other factors, such as the raw HTTP client and rate limits, also impact the outcomes. To reproduce the block, run Selenium against a Cloudflare-protected page, observe the title, JavaScript check, and global window properties that ChromeDriver adds, and compare the results to a browser with the same settings.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
