Skip to content

CAPTCHA Test: Cloudflare Turnstile Pass Check and reCAPTCHA v3 Score

One click tests whether Cloudflare Turnstile lets you through without a click and what score Google reCAPTCHA v3 gives you. Cloudflare and Google decide the results.

CAPTCHA test: Cloudflare Turnstile and reCAPTCHA v3

Press “Start test” and this page runs Cloudflare Turnstile and Google reCAPTCHA v3 in your browser: can your current browser and IP pass without a click, and what score does Google give? Cloudflare and Google decide the results; we add no score of our own.

What Cloudflare sees

Websites behind Cloudflare see exactly this.

Testing…

Provided by Cloudflare

Cloudflare’s and Google’s scripts load only after you press it.

Tokens are sent once to Cloudflare or Google to be checked, and we do not keep them. Our logs record neither the token nor your IP.

This page actually runs Cloudflare Turnstile and Google reCAPTCHA v3 in your browser. Turnstile is tested in two modes: in managed mode Cloudflare decides from the visitor’s risk whether to let you straight through or ask you to tick a box; non-interactive mode never asks you to do anything and decides on its own. reCAPTCHA v3 needs no click: Google scores each visit from 0.0 to 1.0, where 1.0 is very likely a good interaction and 0.0 very likely a bot, and suggests a default threshold of 0.5. When Cloudflare keeps asking you to verify or you cannot pass, work through Cloudflare’s troubleshooting list: try another browser, turn off extensions that block scripts, make sure JavaScript is on, set the correct system time, and try another network. With a proxy, compare results with the proxy on and off: if you only fail with the proxy on, the IP is the likely cause, so test with another one. The results only show how Cloudflare and Google judge your current browser and IP on this site right now; other websites have their own settings.

Updated:

What each result means

What each result means
ItemMeaningNext step
Managed: passed without a clickCloudflare found nothing suspicious and let you through. This is the best result.Nothing to change.
Managed: passed after a clickCloudflare wanted one more check and asked you to tick the box. Cloudflare says it asks for interaction only when a further check is needed.Once in a while is fine; if it asks every time, work through the steps below.
Managed: did not passClicking did not help, or there was an error. An error code starting with 300 or 600 means Cloudflare judged the visit to look automated.Work through the steps below and test again.
Non-interactive: passed or failed automaticallyThis mode never asks you to do anything. Failing means Cloudflare would not let you through without interaction.If managed mode passes after a click while non-interactive fails, one extra check is needed; if both fail, the problem is clearer.
reCAPTCHA v3 scoreGoogle’s score from 0.0 to 1.0; the higher, the more likely a person. Google suggests a default threshold of 0.5, and each website can set its own.Below 0.5, websites using reCAPTCHA v3 may ask for extra verification, such as an SMS or email code.
Did not loadThe check’s script was blocked, usually by an ad blocker or the network.Turn off the extension or switch network and test again. This case does not count.

Cloudflare and Google decide the results; we add no score of our own. They show how your current browser and IP are judged on this site right now; other websites can use different modes and thresholds.

How Turnstile and reCAPTCHA v3 decide

Turnstile is Cloudflare’s human check. According to Cloudflare’s documentation, managed mode uses information about the visitor to decide whether an interactive challenge is needed, and even then you only tick a box, with no images or text to decipher; non-interactive mode shows a loading spinner and never asks you to do anything; a third mode is fully invisible. Each website picks one mode.

reCAPTCHA v3 does not interrupt visitors; it only scores them: 1.0 is very likely a good interaction, 0.0 very likely a bot. The website decides what to do with the score; Google’s example is to require two-factor or email verification for low scores. Google suggests 0.5 as the default threshold.

Neither publishes exactly which signals it looks at. Cloudflare’s troubleshooting list has you try another browser, another device and another network, which shows each of these can change the result: the same IP in a different browser, or the same browser on a different IP, can get a different result.

Cloudflare keeps asking you to verify, or you cannot pass: what to check

  1. Read the error code first

    This page shows Cloudflare’s error code. Starting with 300 or 600: Cloudflare judged the visit to look automated; 200100: your system clock is wrong, or something cached the check; 200500: challenges.cloudflare.com was blocked; 110600 or 110620: timed out.

    Expected result Fix the item the code points to.

  2. Try another browser and turn off extensions

    Cloudflare’s troubleshooting list: use a major browser (all are supported except Internet Explorer); turn off extensions, since ad blockers can block the scripts it needs; make sure JavaScript is on; try a private window, another browser or another device.

    Expected result If it passes after the switch, the problem is the original browser setup.

  3. Set the correct system time

    Error 200100 means the system clock is wrong or something cached the check. Turn on automatic time in your system settings.

    Expected result The next test no longer shows 200100.

  4. Compare with the proxy on and off

    Cloudflare’s troubleshooting list also says VPNs and proxies may interfere. Test once with the proxy off, then once with it on.

    Expected result If you only fail with the proxy on, the IP is the likely cause: use the IP purity check to see whether it is a datacenter IP or blacklisted, and switch to another IP if needed.

  5. Try another network

    The last item on Cloudflare’s list: switch networks, for example to a mobile hotspot.

    Expected result If another network passes, the original line or IP gets stricter treatment.

  6. Check WebRTC and time zone too

    Whether WebRTC exposes another IP and whether your browser time zone matches the IP’s location are common mismatches in an account’s environment. Check each once.

    Expected result With both fine, come back and test the human check again.

What Cloudflare sees: IP, country and WARP

The first row comes from this site’s own /cdn-cgi/trace address. According to Cloudflare’s documentation, when a domain is added to Cloudflare, Cloudflare adds a /cdn-cgi/ path to it and serves it directly, and trace helps with troubleshooting. The IP and country shown are what websites behind Cloudflare see.

WARP is Cloudflare’s own VPN client (1.1.1.1 with WARP). Cloudflare’s documentation uses this very address to check whether WARP is connected: warp=on means WARP is in use.

Why there is no Cloudflare risk score

Cloudflare’s bot score runs from 1 to 99: 1 means a request is almost certainly automated, 99 almost certainly human. According to Cloudflare’s documentation, granular scores are only available to Enterprise customers who bought Bot Management. This site cannot get them, so they are not shown. This page shows results any website can verify: whether Turnstile lets you through and what score reCAPTCHA v3 gives.

CAPTCHA test FAQ

Does this tell me whether ChatGPT, Claude or other sites will let me through?

Not directly. Each website uses its own Cloudflare settings and thresholds, and some use other checks. This page shows how Cloudflare and Google judge your current browser and IP on this site right now. It is best used for comparison: after you switch IP or browser, does the result get better or worse?

Managed mode asked for a click. Is my IP bad?

Not necessarily. Cloudflare says it asks for interaction only when a further check is needed. Once in a while is normal; if it asks every time, or a click does not help, work through the steps above.

Is the reCAPTCHA score the same every time?

Not necessarily. Google scores every test again, so test a few times to see the range. Google also says that over quota it may return a fixed 0.9 with an error; this page shows no score when a result carries an error.

reCAPTCHA does not load where I am. What now?

Google says to use www.recaptcha.net where www.google.com is not accessible, and this page loads it from www.recaptcha.net. If it still does not load, the result shows “Did not load” and does not count.

Do you keep the results?

No. Verification tokens go only to Cloudflare and Google to be checked; we write nothing to a database and do not keep the tokens. A Cloudflare token is valid for 5 minutes and can be checked only once.

Reference links

8
  1. Cloudflare docs: Turnstile widget modes

    Official documentation · Confirmed on:

    Read on 4 November 2026. Managed mode automatically chooses between a non-interactive or checkbox challenge based on visitor risk, with no images or text to decipher, and requires interaction only if a further check is necessary to verify the visitor is human; non-interactive mode shows a visible widget with a loading spinner and visitors are never required to interact; invisible mode runs in the background with no visible widget.

  2. Cloudflare docs: Turnstile client-side error codes

    Official documentation · Confirmed on:

    Read on 4 November 2026. 110200 domain not authorized; 110600 challenge timed out (the visitor’s clock may be wrong, or the challenge took too long); 110620 interaction timed out; 200100 clock or cache problem; 200500 iframe failed to load, check whether challenges.cloudflare.com is blocked; 300* and 600* generic challenge failure, bot behavior detected. Troubleshooting: use a compatible browser (all major browsers except Internet Explorer), disable browser extensions, enable JavaScript, try private mode, try another browser or device, VPNs or proxies may interfere, switch networks (for example a mobile hotspot).

  3. Cloudflare docs: Turnstile client-side rendering

    Official documentation · Confirmed on:

    Read on 4 November 2026. Tokens expire after 300 seconds (5 minutes); each token can only be validated once; expired or used tokens must be replaced with fresh challenges.

  4. Cloudflare docs: /cdn-cgi/ endpoint

    Official documentation · Confirmed on:

    Read on 4 November 2026. When you add a domain to Cloudflare, Cloudflare adds a /cdn-cgi/ endpoint to it, managed and served by Cloudflare; https://<your domain>/cdn-cgi/trace identifies the Cloudflare data center serving your request, which helps with troubleshooting.

  5. Cloudflare docs: WARP client for Linux

    Official documentation · Confirmed on:

    Read on 4 November 2026. After connecting, run curl https://www.cloudflare.com/cdn-cgi/trace and verify that warp=on.

  6. Cloudflare docs: bot scores

    Official documentation · Confirmed on:

    Read on 4 November 2026. A score of 1 means Cloudflare is quite certain the request was automated, 99 that it came from a human; granular bot scores are only available to Enterprise customers who have purchased Bot Management.

  7. Google for Developers: reCAPTCHA v3

    Official documentation · Confirmed on:

    Read on 4 November 2026. reCAPTCHA v3 returns a score for each request: 1.0 is very likely a good interaction, 0.0 very likely a bot; by default you can use a threshold of 0.5; with low scores, for example, require two-factor or email verification; the verification response holds success, score, action, challenge_ts, hostname and error-codes.

  8. Google for Developers: reCAPTCHA FAQ

    Official documentation · Confirmed on:

    Read on 4 November 2026. Use www.recaptcha.net in your code where www.google.com is not accessible; you may hide the badge if you include the reCAPTCHA branding visibly in the user flow; over the v3 quota, verification may return a static score of 0.9 and an error message for the rest of the month.

Ready to try it?

Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.

Get started