Cloudflare Bypass for Scraping

⭐ Thank you for 1,800+ stars! Introducing Version 2.0 with enhanced request mirroring, improved caching and better reliability for bypassing Cloudflare protection.

Bypass Cloudflare protection with ease. Supports cookie generation and request mirroring for any HTTP method.

Sponsors

IPcook

Need Reliable Proxies? IPcook Has Got You Covered

• 🔄 Monthly Plans with Auto-Renewal
• 🚀 99.99% Uptime
• ⚡ Avg. Response Time < 0.5s
• 📶 Up to 100K Concurrent Connections
• 🌍 55M+ IPs Across 185+ Locations
• ♻️ IP Rotation Per Request
• 🔒 Up to 10 Sub-accounts
• 🛟 24/7 Premium Support

🎁 Start with a FREE 100MB Trial 💸 Use code WELCOME20 for 20% OFF

Scrape.do

Scrape.do is the ultimate toolkit for collecting public data at scale. Unmatched speed, unbeatable prices, unblocked access.

One line of code. Instant data access

• 🔁 Automatic Proxy Rotation
• 🤖 Bypass Anti-bot Solutions
• ⛏️ Seamless Web Scraping

Claim your free trial

BirdProxies

BirdProxies — Hey, we built BirdProxies because proxies shouldn't be complicated or overpriced. Fast residential and ISP proxies in 195+ locations, fair pricing, and real support. Try our FlappyBird game on the landing page for free data!

• Discord: https://discord.com/invite/birdproxies

RapidProxy

RapidProxy – Power Your Data with Premium Proxies

🎁 Try proxies for free + Use code RAPID10 for 10% OFF

• 90M+ IPs in 200+ countries & regions
• No expiration on traffic — use anytime, no pressure
• Unlimited concurrency for maximum performance
• Starting from just $0.65/GB — built for scale
• City-level targeting for precise geo access
• Flexible session control tailored to your needs
• Enterprise-grade speed & reliability
• Built for large-scale automation

💡 Built for Growth — Whether you're scaling scraping operations, running automation, or accessing global content, RapidProxy delivers the speed, stability, and flexibility you need to grow without limits.

👉 Start your free trial today

---

🚀 Quick Start

docker run -p 8000:8000 ghcr.io/sarperavci/cloudflarebypassforscraping:latest

Then point your scraper at the server and add an x-hostname header:

curl "http://localhost:8000/api/data" -H "x-hostname: cf-protected-website.com"

How it works

Two ways to get past Cloudflare, both powered by a real stealth browser (a patched Chromium via CloakBrowser).

🍪 Cookie generation — /cookies

Ask the server for clearance cookies for a URL and use them however you like:

curl "http://localhost:8000/cookies?url=https://protected-site.com"

{
  "cookies": {
    "cf_clearance": "SJHuYhHrTZpXDUe8iMuzEUpJxocmOW8ougQVS0.aK5g-1723665177-1.0.1.1-5_NOoP19LQ..."
  },
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
}

Route the bypass through a proxy with the proxy query param:

curl "http://localhost:8000/cookies?url=https://protected-site.com&proxy=http://user:pass@host:port"

It launches a stealth browser, navigates to the URL, and solves the Cloudflare challenge — non-interactive challenges resolve on their own, and interactive Turnstile checkboxes are located inside their shadow DOM and clicked natively. Once cleared, it returns the cf_clearance cookie and the exact user-agent that earned it — you must send both together or Cloudflare rejects the cookie. The pair is cached, so repeat calls are instant.

Use this when you drive your own HTTP client and just need valid cookies.

🪞 Mirror mode — any path + x-hostname

Point your scraper's base URL at the server and add an x-hostname header; the server transparently proxies the request to the real site with Cloudflare already bypassed. Add x-proxy to route through your own proxy:

curl -X POST "http://localhost:8000/api/submit" \
  -H "x-hostname: protected-site.com" \
  -H "x-proxy: http://user:pass@host:port" \
  -H "Content-Type: application/json" \
  -d '{"key":"value"}'

It generates (or reuses cached) clearance cookies for the host, then replays your exact request — method, path, query, headers, body — to the real site using an HTTP client that mimics Chrome's TLS/JA3 fingerprint, with the Cloudflare cookies merged in. You get the real response back unchanged. This clears both obstacles at once: the JavaScript challenge and TLS fingerprinting — with no browser needed on your side.

Use this when you want a drop-in proxy that "just works" for any HTTP method.

See docs/USAGE.md for control headers, the /html endpoint, and more.

Documentation

• Usage — installation, request mirroring, the /cookies and /html endpoints, control headers.
• Configuration — environment variables (cookie TTL, proxy exit-IP checking, concurrency limits) and defaults.

Example Projects

• Calibre Web Automated Book Downloader
• Kick Unofficial API

Contributing

Contributions welcome! Submit PRs against the main codebase.