Cloudflare Turnstile Bypass - Automatic Captcha Solver

Cloudflare Turnstile runs invisibly for most visitors and only shows a visible challenge when traffic looks suspicious — it can appear as a Managed, Non-Interactive, or Interactive challenge depending on the risk signal. Surfsky includes an internal manual solver and automatic mode; for a first test, use manual mode after the challenge appears.

Before you start

Use the CAPTCHA setup example to start a browser and create a page-level cdp session. The snippets below use an async Playwright or Puppeteer session after navigating to your target. Turnstile solving is free and needs no key.

Turnstile signals include browser-level checks like TLS fingerprint and Client Hints, not just the visible widget. A page can still block a request that never shows a challenge at all — the invisible check is not the same as “no protection.”

Manual captcha solving

Wait for the challenge to appear, then send:

result = await cdp.send("Captcha.solve", {
    "type": "turnstile",
    "timeout": 60000,
})
if result["status"] not in ("success", "not_detected"):
    raise RuntimeError(result)

const result = await cdp.send("Captcha.solve", {
  type: "turnstile",
  timeout: 60000,
});
if (!["success", "not_detected"].includes(result.status)) throw new Error(JSON.stringify(result));

result = await browser.send("Captcha.solve", {
    "type": "turnstile",
    "timeout": 60000,
})
if result["status"] not in ("success", "not_detected"):
    raise RuntimeError(result)

const result = await browser.send("Captcha.solve", {
  type: "turnstile",
  timeout: 60000,
});
if (!["success", "not_detected"].includes(result.status)) throw new Error(JSON.stringify(result));

The timeout is in milliseconds. Without a Turnstile widget on the page, the command fails with the CDP error No captcha detected on the page.

success: the widget passed, and solution holds its token.
not_detected: the widget had already passed, or never asked for a click.
failed: the widget did not pass.

After success, wait for a selector or response that identifies the protected content.

Automatic captcha solving

Attach solve event listeners, then start detection with "turnstile" in types before navigating:

await cdp.send("Captcha.autoSolve", {"types": ["turnstile"]})
await page.goto(target_url, wait_until="domcontentloaded")

await cdp.send("Captcha.autoSolve", { types: ["turnstile"] });
await page.goto(targetUrl, { waitUntil: "domcontentloaded" });

await browser.send("Captcha.autoSolve", {"types": ["turnstile"]})
await browser.goto(target_url, wait_until="domcontentloaded")

await browser.send("Captcha.autoSolve", { types: ["turnstile"] });
await browser.goto(targetUrl, { waitUntil: "domcontentloaded" });

status: "started" confirms the background loop started. Observe failures and use a bounded wait for your page result. Keep the CDP session connected until the job completes.

Reducing challenges

Most Turnstile checks run invisibly and never surface a challenge for a clean session — a widget only appears once the risk signal is high enough. If detection consistently fails to find the challenge, inspect the page for a Turnstile iframe and wait for it to load; the page may have already passed the invisible check, or it may be blocked before a challenge ever renders.

Verify bypass worked

status: "success" confirms the challenge widget accepted the interaction, not that the target page unblocked the protected content. Wait for a selector or response that identifies that content before treating the job as done. Inspect one attempt in DevTools and record the result or error before retrying. Stop the browser when the job ends.

Turnstile bypass FAQ

Does Turnstile always show a visible challenge?

No — most visitors pass invisibly. Cloudflare only surfaces a Managed, Non-Interactive, or Interactive widget when the risk signal from behavior and browser fingerprint is high enough.

Do I need an API key for Turnstile?

No. Turnstile solving is free.

Why does detection fail to find a Turnstile challenge?

The page may have already passed the invisible check with no widget shown, or it may be blocking the request before any challenge renders. Inspect for a Turnstile iframe and wait for it to load before assuming detection is broken.

A solve reports success but the page is still blocked — why?

A success status confirms the widget accepted the interaction, not that the site’s own check passed. Wait for the protected content or a successful response before assuming the job is done.

Questions? Contact support.

Get started

Connect your tools

Browser sessions

Browser actions

CAPTCHA guides

Debugging

Performance and limits

About Surfsky

Cloudflare Turnstile Bypass - Automatic Captcha Solver

Before you start

Manual captcha solving

Automatic captcha solving

Reducing challenges

Verify bypass worked

Turnstile bypass FAQ

​Before you start

​Manual captcha solving

​Automatic captcha solving

​Reducing challenges

​Verify bypass worked

​Turnstile bypass FAQ

Before you start

Manual captcha solving

Automatic captcha solving

Reducing challenges

Verify bypass worked

Turnstile bypass FAQ