How To Bypass Cloudflare When Web Scraping (2026)

Most open source Cloudflare bypasses only have a couple months of shelf life before they stop working. Anti-bot companies like Cloudflare can analyze public bypass code and quickly patch the vulnerabilities they exploit.

Smart proxies take a different approach, they develop and maintain their own private Cloudflare bypasses that aren't visible to anti-bot companies. These are typically more reliable because:

• Private Implementation: Cloudflare can't easily analyze and patch what they can't see
• Financial Motivation: Proxy companies are financially incentivized to stay one step ahead of Cloudflare
• Rapid Response: Bypasses are fixed the minute they stop working, often within hours
• Dedicated Teams: Full-time engineers focused solely on anti-bot bypass development

Smart proxy providers handle all the complexity of TLS fingerprinting, JavaScript challenge solving, and session management—you just make simple HTTP requests.

To validate the effectiveness of smart proxy services for Cloudflare bypass, we tested the Proxy APIs available within the ScrapeOps Proxy Aggregator across the 20 Cloudflare protected test domains.

ScrapeOps Proxy Aggregator Results

The ScrapeOps Proxy Aggregator routes requests through 20+ integrated proxy providers, automatically selecting the best provider for each target domain.

For each domain, the next table shows how many integrated providers met three benchmark tiers:

• 80%+ success rate with ≤15 s average success latency,
• 60%+ success rate with ≤25 s average success latency,
• 40%+ success rate with ≤35 s average success latency,
• and how many could not meet even the loosest tier (Failing).

The table below lists the best-performing provider the aggregator chose for each domain based on scraping 100,000 pages of that website.

The best provider was choosen based on which delievered the lowest cost plan whilst obtaining a success rate of at least 80% and a average succeess latency of less than 15 seconds.

Performance Summary

Key Observations:

• Full domain coverage: All 20 targets—including job boards (e.g. Indeed, Glassdoor), real estate (Zillow, Realtor.com, Redfin), retail and apparel (Nike, Adidas, Wayfair, Best Buy), and crypto/finance (CoinMarketCap, CoinGecko, Investing.com) were able to be scraped using Proxy APIs contained within the ScrapeOps Proxy Aggregator.
• Per-domain success rates for that winning provider stayed in the high 80s to high 90s; the lowest in this dataset was mediamarkt.de at 89.5%, while several domains exceeded 99% (e.g. Adidas at 99.6%).
• Automatic provider selection split wins across multiple backends: Zyte API, ScrapingAnt, and ScrapeDO each led on multiple domains; ScrapingBee, ScraperAPI, and ScrapingDog each topped individual targets—matching the diversity shown in the provider criteria counts.
• Latency reflects HTTP-level bypasses (no full browser session for these tests): fastest successful responses were under ~2 seconds on some domains, while heavier pages pushed toward ~10–13 seconds.

Smart proxies with professionally maintained Cloudflare bypasses delivered the strongest aggregate results in our comparison.

The combination of private bypass implementations, rapid updates, and intelligent multi-provider routing makes this approach a strong fit for production workloads when you want high success rates without running your own bypass stack.

Smart proxies are the pragmatic choice when you need reliable Cloudflare bypass without the engineering overhead of maintaining your own solution.

Ideal Use Cases

• Production Scraping: When uptime and reliability matter more than squeezing every cent of margin
• Variable Targets: Scraping multiple domains with different Cloudflare configurations
• Teams Without Anti-Bot Expertise: Skip the learning curve of reverse engineering Cloudflare
• Speed-Critical Workloads: HTTP-only requests are 10-100x faster than browser-based approaches
• High Volume: Scale to millions of requests without managing browser infrastructure

When NOT to Use This Method

• Extremely Tight Budgets: Per-request pricing adds up; DIY may be cheaper at very high volumes
• Sites Without Protection: Overkill for sites that work with basic HTTP requests
• JavaScript Rendering Required: Smart proxies return HTML; if you need JS execution, consider browser APIs
• Full Control Required: If you need custom browser interactions or session logic

Cost Considerations

Smart proxy pricing varies significantly by provider and bypass level. Here's what to expect:

The tradeoff: Smart proxies cost more than basic proxies but eliminate engineering time and provide significantly higher success rates on protected sites.

Most smart proxy providers offer similar functionality with varying pricing and effectiveness. The ScrapeOps Proxy Aggregator is unique in that it integrates 20+ proxy providers into a single API, automatically routing your requests to the best/cheapest provider for each target domain.

ScrapeOps Proxy Aggregator

The ScrapeOps Proxy Aggregator integrates over 20 proxy providers into the same proxy API, and finds the best/cheapest proxy provider for your target domains.

Basic Usage (Python)

import requests

response = requests.get(
    url='https://proxy.scrapeops.io/v1/',
    params={
        'api_key': 'YOUR_API_KEY',
        'url': 'http://example.com/',  
    },
)

print('Body: ', response.content)

Getting Started

1. Sign up for a free API key at here (includes 1,000 free API credits)
2. Monitor success rates in your ScrapeOps dashboard to optimize bypass selection

This section answers common questions about using smart proxies for bypassing Cloudflare.

For more information about smart proxies and Cloudflare bypass, check out these resources:

• ScrapeOps Proxy Aggregator Documentation
• Anti-Bot Bypass Guide
• Proxy Provider Comparison Tool
• Residential Proxy Comparison

This change log tracks any updates and revisions made to the Smart Proxy Method over time.

Cloudflare uses TLS fingerprinting to identify bots. Every HTTP client—whether a real browser or Python's requests library, creates a unique fingerprint based on how it negotiates TLS connections and structures HTTP/2 frames. Standard libraries like requests and httpx have fingerprints that Cloudflare recognizes as non-browser and blocks.

curl_cffi is a Python binding for curl-impersonate that sends requests with TLS fingerprints matching real browsers (Chrome, Safari, Firefox, Edge). Cloudflare sees a request that looks like it came from a real browser and allows it through—without you needing to run any JavaScript or launch a headless browser.

We tested curl_cffi across 20 Cloudflare-protected domains. If you prefer the httpx API, httpx-curl_cffi provides the same TLS fingerprinting via an httpx transport adapter.

Overall, curl_cffi achieved 16 out of 20 domains (80%) working in our tests. It works best on sites where TLS fingerprinting is the main detection method, while failing on sites that require JavaScript execution or have stricter multi-layer protection.

TLS impersonation is ideal when you need a lightweight, fast bypass that doesn't consume the CPU and memory of a headless browser. It works well on sites where fingerprinting is the primary detection method.

Ideal Use Cases

• High-Volume Scraping: Lightweight requests scale to millions of pages without the overhead of browser instances.
• Sites Using Basic Fingerprinting: When Cloudflare relies mainly on TLS/HTTP fingerprint checks rather than JavaScript challenges.
• Async Workflows: curl_cffi has native async support for concurrent scraping.
• Memory-Constrained Environments: No browser process, just HTTP requests with spoofed fingerprints.
• Budget Constraints: Free, open-source, no API costs.

When NOT to Use This Method

• Sites Requiring JavaScript Execution: If Cloudflare serves a "Checking your browser" page that runs JS challenges, curl_cffi cannot execute it. Use FlareSolverr or fortified browsers instead.
• Mandatory CAPTCHAs: TLS impersonation cannot solve hCaptcha or Turnstile. Consider smart proxies or browser APIs.
• High-Security Sites: Sites with aggressive multi-layer detection may still block you.

curl_cffi

curl_cffi is a Python binding for curl-impersonate that can mimic browser TLS/JA3 and HTTP/2 fingerprints.

Installation

pip install curl_cffi

Basic Usage

from curl_cffi.requests import Session

# Create a session that impersonates Chrome
with Session(impersonate="chrome136") as session:
    response = session.get("https://cloudflare.com/")
    print(response.status_code)
    print(response.text[:500])

Available Browser Impersonations

curl_cffi supports impersonating multiple browser versions:

Using With Proxies

from curl_cffi.requests import Session

proxies = {
    "http": "http://user:pass@proxy.example.com:8080",
    "https": "http://user:pass@proxy.example.com:8080"
}

with Session(impersonate="chrome136", proxies=proxies) as session:
    response = session.get("https://cloudflare.com/")

Async Support

import asyncio
from curl_cffi.requests import AsyncSession

async def fetch_urls(urls):
    async with AsyncSession(impersonate="chrome136") as session:
        tasks = [session.get(url) for url in urls]
        responses = await asyncio.gather(*tasks)
        return responses

urls = ["https://example1.com", "https://example2.com", "https://example3.com"]
results = asyncio.run(fetch_urls(urls))

Best For: High-volume scraping where TLS fingerprinting is the main detection method, async workflows, memory-constrained environments. If you prefer the httpx API, httpx-curl_cffi provides the same TLS fingerprinting via an httpx transport adapter.

• curl_cffi Documentation
• TLS Fingerprinting with JA3 and JA3S
• Understanding Browser Fingerprinting

Browser APIs are managed browser services designed specifically for web scraping at scale. Unlike running your own fortified headless browser locally, these services handle:

• Automated Unblocking: Built-in CAPTCHA solving, JavaScript challenge handling, and anti-bot mitigation
• Fingerprint Management: Automatic browser fingerprint rotation and consistency
• Proxy Integration: Built-in residential/datacenter proxy rotation
• Session Handling: Persistent sessions, cookie management, and retry logic
• Infrastructure: Cloud-based browser instances that scale on demand

You interact with these services using familiar Puppeteer or Playwright APIs, but the underlying browser runs on their infrastructure with all stealth optimizations pre-configured.

To validate the effectiveness of browser API services, we tested Bright Data Scraping Browser, ZenRows Scraping Browser, and Scrapeless Scraping Browser across 20 domains including job boards (Indeed, Glassdoor), real estate (Zillow, Realtor, Redfin), retail (Nike, Best Buy, Etsy, Wayfair), and crypto/finance sites (CoinMarketCap, CoinGecko). Each service was tested using default configurations with Puppeteer integration. Success rates are shown per domain.

Combined domain coverage: 13/20 benchmark domains (65%) had at least one provider at ≥60% success (Bright Data, Scrapeless, or ZenRows).

Summary Comparison

Overall, browser APIs outperform self-hosted fortified browsers (which showed 0–35% in our tests) but success is domain-dependent. For difficult targets, expect variable results. Bright Data posted the highest average success rate across domains in this run; combined domain coverage (≥60% on any provider) is higher than any single provider’s slice of the benchmark because different vendors excel on different sites.

Browser APIs are ideal when you want the power of browser automation without the operational overhead of maintaining stealth patches, proxy infrastructure, and browser orchestration.

Ideal Use Cases

• High-Value Targets: Sites with aggressive anti-bot protection where DIY stealth solutions fail
• Production Workloads: When reliability matters more than cost optimization
• Teams Without Anti-Bot Expertise: Skip the learning curve of stealth patches and fingerprint management
• Variable Scale: Projects that need to scale up/down without managing browser infrastructure
• Rapid Prototyping: Get scraping quickly without building evasion infrastructure

When NOT to Use This Method

• Tight Budgets: Per-request pricing adds up quickly at high volumes
• Simple Sites: Overkill for sites that work with basic HTTP requests or curl_cffi
• Full Control Required: If you need deep customization of browser behavior
• Vendor Lock-in Concerns: Your scraping logic becomes dependent on third-party services

Cost Considerations

Browser API pricing is typically per-request or per-minute of browser time. Here's a rough comparison:

The tradeoff: Browser APIs cost more per request but eliminate engineering time spent on stealth maintenance, infrastructure management, and debugging detection issues.

Choose the browser API that best fits your needs. Each provider offers similar core functionality but differs in pricing, features, and target use cases. All support Puppeteer and Playwright integration via WebSocket connections.

const puppeteer = require('puppeteer-core');

const SBR_CDP = 'wss://brd-customer-CUSTOMER_ID-zone-ZONE_NAME:PASSWORD@brd.superproxy.io:9222';

async function main() {
    const browser = await puppeteer.connect({
        browserWSEndpoint: SBR_CDP,
    });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/', { waitUntil: 'domcontentloaded' });
    console.log(await page.title());
    await browser.close();
}

main();

const { chromium } = require('playwright-core');

const SBR_CDP = 'wss://brd-customer-CUSTOMER_ID-zone-ZONE_NAME:PASSWORD@brd.superproxy.io:9222';

async function main() {
    const browser = await chromium.connectOverCDP(SBR_CDP);
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
}

main();

import asyncio
from playwright.async_api import async_playwright

SBR_CDP = 'wss://brd-customer-CUSTOMER_ID-zone-ZONE_NAME:PASSWORD@brd.superproxy.io:9222'

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.connect_over_cdp(SBR_CDP)
        page = await browser.new_page()
        await page.goto('https://cloudflare.com/')
        print(await page.title())
        await browser.close()

asyncio.run(main())

const puppeteer = require('puppeteer-core');

const ZENROWS_CDP = 'wss://browser.zenrows.com?apikey=YOUR_API_KEY';

async function main() {
    const browser = await puppeteer.connect({
        browserWSEndpoint: ZENROWS_CDP,
    });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/', { waitUntil: 'domcontentloaded' });
    console.log(await page.title());
    await browser.close();
}

main();

const { chromium } = require('playwright-core');

const ZENROWS_CDP = 'wss://browser.zenrows.com?apikey=YOUR_API_KEY';

async function main() {
    const browser = await chromium.connectOverCDP(ZENROWS_CDP);
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
}

main();

import asyncio
from playwright.async_api import async_playwright

ZENROWS_CDP = 'wss://browser.zenrows.com?apikey=YOUR_API_KEY'

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.connect_over_cdp(ZENROWS_CDP)
        page = await browser.new_page()
        await page.goto('https://cloudflare.com/')
        print(await page.title())
        await browser.close()

asyncio.run(main())

const puppeteer = require('puppeteer-core');

const SCRAPELESS_CDP = 'wss://browser.scrapeless.com?token=YOUR_API_TOKEN';

async function main() {
    const browser = await puppeteer.connect({
        browserWSEndpoint: SCRAPELESS_CDP,
    });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/', { waitUntil: 'domcontentloaded' });
    console.log(await page.title());
    await browser.close();
}

main();

const { chromium } = require('playwright-core');

const SCRAPELESS_CDP = 'wss://browser.scrapeless.com?token=YOUR_API_TOKEN';

async function main() {
    const browser = await chromium.connectOverCDP(SCRAPELESS_CDP);
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
}

main();

import asyncio
from playwright.async_api import async_playwright

SCRAPELESS_CDP = 'wss://browser.scrapeless.com?token=YOUR_API_TOKEN'

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.connect_over_cdp(SCRAPELESS_CDP)
        page = await browser.new_page()
        await page.goto('https://cloudflare.com/')
        print(await page.title())
        await browser.close()

asyncio.run(main())

Instead of developers maintaining their own stealth patches and proxy infrastructure for Puppeteer or Playwright, browser APIs combine rendering, anti-bot mitigation, and session handling behind a single WebSocket endpoint.

What Browser APIs Replace

Migration From Local Browsers

If you already have Puppeteer or Playwright scripts, migrating to a Browser API typically requires changing just one line:

// Before: Local Puppeteer with stealth
const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');
puppeteer.use(StealthPlugin());
const browser = await puppeteer.launch({ headless: false });

// After: Browser API
const puppeteer = require('puppeteer-core');
const browser = await puppeteer.connect({
    browserWSEndpoint: 'wss://provider.example.com?apikey=YOUR_KEY',
});

The rest of your scraping logic—page navigation, selectors, data extraction—remains unchanged.

Future-Proofing

Future anti-bot defenses increasingly rely on behavioral and session analysis, meaning services that simulate entire browser environments with human-like patterns are more robust than standalone headless browsers. Browser APIs invest continuously in staying ahead of detection methods, making them a sustainable choice for long-term scraping projects.

This section answers common questions about using browser APIs for bypassing Cloudflare and other anti-bot systems.

For more information about browser APIs and managed scraping solutions, check out these resources:

• Bright Data Scraping Browser Documentation
• ZenRows Scraping Browser Guide
• Scrapeless Documentation
• Puppeteer Documentation
• Playwright Documentation
• Browser Fingerprinting Explained

This change log tracks any updates and revisions made to the Browser API Method over time.

FlareSolverr is a proxy server that bypasses Cloudflare and DDoS-GUARD protection using a headless browser. It uses Selenium with undetected-chromedriver to solve Cloudflare's JavaScript and browser fingerprinting challenges.

When Cloudflare suspects a visitor is a bot, it displays a "Checking your browser" challenge page that runs JavaScript. FlareSolverr opens the target URL in a headless browser, waits until the challenge is solved, then returns the HTML and cookies to your scraper. You can use those cookies with a lightweight HTTP client for subsequent requests.

We tested FlareSolverr across 20 Cloudflare-protected domains:

FlareSolverr achieved 11 working + 3 partially working out of 20 domains (55-70%) in our tests. It works best on sites that require JavaScript execution to pass Cloudflare's challenge, but is slower and more resource-intensive than lightweight HTTP requests.

Ideally, FlareSolverr is a fallback when TLS impersonation fails, because the site requires JavaScript execution. On paper it's more resource-intensive but can solve challenges that curl_cffi cannot. In practice, it's not always reliable and often fails to solve the challenge.

Ideal Use Cases

• Sites Requiring JavaScript Execution: When Cloudflare's challenge runs JS that must complete before access is granted.
• Cookie Harvesting: Solve the challenge once, get valid cf_clearance cookies, then scrape with lightweight HTTP clients.
• Budget Constraints: Free, open-source alternative to commercial bypass services.
• Moderate Scale: Thousands to tens of thousands of pages where browser overhead is acceptable.

When NOT to Use This Method

• High Volume: Headless browser solvers consume significant CPU/RAM—impractical for millions of requests.
• Real-Time Requirements: High latency (10-60+ seconds per challenge).
• High Security Sites: Sites with CAPTCHAs, Turnstile, or aggressive fingerprinting often defeat FlareSolverr.
• Reliability Critical: Can break when Cloudflare updates; requires community patches.

Important Consideration

Open-source Cloudflare solvers have a limited shelf life. Many older solvers (cloudscraper, cloudflare-scrape) have been abandoned. Always verify the tool has recent commits and community activity.

FlareSolverr

FlareSolverr is a proxy server that bypasses Cloudflare and DDoS-GUARD protection using a headless browser.

Installation

Install FlareSolverr using Docker (Firefox browser included):

docker run -d \
  --name=flaresolverr \
  -p 8191:8191 \
  -e LOG_LEVEL=info \
  --restart unless-stopped \
  ghcr.io/flaresolverr/flaresolverr:latest

Usage Example

Send requests to the FlareSolverr server to get valid cookies:

import requests

post_body = {
    "cmd": "request.get",
    "url": "https://cloudflare.com/",
    "maxTimeout": 60000
}

response = requests.post(
    'http://localhost:8191/v1', 
    headers={'Content-Type': 'application/json'}, 
    json=post_body
)

data = response.json()
print("Status:", data['status'])
print("Cookies:", data['solution']['cookies'])
print("User-Agent:", data['solution']['userAgent'])

Response Format

{
    "status": "ok",
    "message": "Challenge not detected!",
    "solution": {
        "url": "https://cloudflare.com/",
        "status": 200,
        "cookies": [
            {
                "domain": ".cloudflare.com",
                "name": "cf_clearance",
                "value": "...",
                "expiry": 1705160731
            }
        ],
        "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36...",
        "response": "<html>...</html>"
    }
}

Using Cookies for Subsequent Requests

Once you have valid cookies, use them with your regular HTTP client:

import requests

# Use cookies from FlareSolverr
session = requests.Session()
session.headers['User-Agent'] = flaresolverr_user_agent
for cookie in flaresolverr_cookies:
    session.cookies.set(cookie['name'], cookie['value'], domain=cookie['domain'])

# Now make requests without FlareSolverr
response = session.get('https://target-site.com/data')

Best For: Sites requiring JavaScript execution, cookie harvesting for lightweight HTTP clients, moderate request volumes.

• FlareSolverr GitHub Repository
• TLS Fingerprinting with JA3 and JA3S
• Understanding Browser Fingerprinting

Vanilla headless browsers leak their identity in their JavaScript fingerprints which anti-bot systems can easily detect. Fortified headless browsers are modified versions of standard automation tools (Puppeteer, Playwright, Selenium) that patch these detection vectors.

For example, a commonly known leak present in headless browsers like Puppeteer, Playwright and Selenium is the value of navigator.webdriver. In normal browsers, this is set to false, however, in unfortified headless browsers it is set to true.

Headless browser navigator.webdriver leak

There are over 200 known headless browser leaks which stealth plugins attempt to patch. However, the actual number is believed to be much higher as browsers are constantly changing and it's in browser developers' & anti-bot companies' interest to not reveal all the leaks they know of.

Categories of Fortified Browser Tools

The ecosystem of fortified headless browsers can be broken down into three categories:

To validate the effectiveness of fortified headless browser tools, we tested three popular options across 20 domains including job boards (Indeed, Glassdoor), real estate (Zillow, Realtor, Redfin), retail (Nike, Best Buy, Etsy, Wayfair), and crypto/finance sites (CoinMarketCap, CoinGecko). Each tool was tested in its default configuration without additional proxy integration.

We compared Undetected ChromeDriver (Python/Selenium, widely used), Patchright (patched Playwright with stealth fixes), and Puppeteer Extra with its stealth plugin (Node.js). Results:

Summary Comparison

Overall, Patchright and Puppeteer Extra + Stealth tied with ~35% success, achieving full bypass on Best Buy, CoinMarketCap, and MediaMarkt, plus partial success on Nike, Skechers, and CoinGecko. Undetected ChromeDriver failed on every domain in our test, suggesting fortified browsers struggle against the anti-bot protections used by job boards, real estate sites, and most retail domains.

Fortified headless browsers are the go-to solution when you need to execute JavaScript, render dynamic content, or interact with pages while evading bot detection. They strike a balance between effectiveness and resource usage.

Ideal Use Cases

This method works best when:

• JavaScript-Heavy Sites: Single-page applications, React/Vue/Angular sites, or pages requiring JavaScript execution to render content.
• Interactive Scraping: When you need to click buttons, fill forms, scroll pages, or interact with elements to access data.
• Medium Security Sites: Websites with Cloudflare's standard protection where TLS fingerprinting alone isn't enough.
• Cookie Harvesting: Solving initial challenges to get valid session cookies for subsequent lightweight HTTP requests.

When NOT to Use This Method

Avoid fortified headless browsers when:

• High Volume Scraping: Browser instances consume 100-500MB RAM each, making them impractical for millions of concurrent requests.
• Speed is Critical: Page loads take 2-10+ seconds versus milliseconds for HTTP requests.
• Simple Static Content: If a site works with curl_cffi or similar TLS fingerprinting tools, headless browsers add unnecessary overhead.
• Maximum Stealth Required: For sites with the most aggressive anti-bot protection, even fortified browsers may be detected.

Cost Considerations

Pairing headless browsers with residential/mobile proxies can get expensive fast. Headless browsers typically consume 2MB of bandwidth per page (versus 250kb without). Here's an example cost breakdown using BrightData residential proxies:

Choose the tool that best fits your programming language and automation framework. Each has trade-offs in terms of stealth effectiveness, ease of use, and community support.

pip install undetected-chromedriver

import undetected_chromedriver as uc

driver = uc.Chrome()
driver.get('https://cloudflare.com/')
print(driver.title)
driver.quit()

import os
import shutil
import tempfile
import time
import undetected_chromedriver as webdriver


class ProxyExtension:
    """Class to create and manage a Chrome proxy extension."""

    manifest_json = """
    {
        "version": "1.0.0",
        "manifest_version": 2,
        "name": "Chrome Proxy",
        "permissions": [
            "proxy",
            "tabs",
            "unlimitedStorage",
            "storage",
            "<all_urls>",
            "webRequest",
            "webRequestBlocking"
        ],
        "background": {"scripts": ["background.js"]},
        "minimum_chrome_version": "76.0.0"
    }
    """

    background_js = """
    var config = {
        mode: "fixed_servers",
        rules: {
            singleProxy: {
                scheme: "http",
                host: "%s",
                port: %d
            },
            bypassList: ["localhost"]
        }
    };

    chrome.proxy.settings.set({value: config, scope: "regular"}, function() {});

    function callbackFn(details) {
        return {
            authCredentials: {
                username: "%s",
                password: "%s"
            }
        };
    }

    chrome.webRequest.onAuthRequired.addListener(
        callbackFn,
        { urls: ["<all_urls>"] },
        ['blocking']
    );
    """

    def __init__(self, host, port, user, password):
        self._dir = os.path.normpath(tempfile.mkdtemp())
        manifest_file = os.path.join(self._dir, "manifest.json")
        with open(manifest_file, mode="w") as f:
            f.write(self.manifest_json)
        background_js = self.background_js % (host, port, user, password)
        background_file = os.path.join(self._dir, "background.js")
        with open(background_file, mode="w") as f:
            f.write(background_js)

    @property
    def directory(self):
        return self._dir

    def cleanup(self):
        if os.path.exists(self._dir):
            shutil.rmtree(self._dir)


# Usage
proxy = ("proxy.example.com", 8080, "username", "password")
proxy_extension = ProxyExtension(*proxy)

options = webdriver.ChromeOptions()
options.add_argument(f"--load-extension={proxy_extension.directory}")
driver = webdriver.Chrome(options=options)

try:
    driver.get("https://cloudflare.com/")
    time.sleep(5)
    print("Page title:", driver.title)
finally:
    driver.quit()
    proxy_extension.cleanup()

pip install patchright
patchright install chromium

npm install patchright
npx patchright install chromium

from patchright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=False)
    page = browser.new_page()
    page.goto("https://cloudflare.com/")
    print(page.title())
    browser.close()

import asyncio
from patchright.async_api import async_playwright

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(headless=False)
        page = await browser.new_page()
        await page.goto("https://cloudflare.com/")
        print(await page.title())
        await browser.close()

asyncio.run(main())

from patchright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(
        headless=False,
        proxy={
            "server": "http://proxy.example.com:8080",
            "username": "user",
            "password": "pass"
        }
    )
    page = browser.new_page()
    page.goto("https://cloudflare.com/")
    print(page.title())
    browser.close()

const { chromium } = require('patchright');

(async () => {
    const browser = await chromium.launch({ headless: false });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
})();

npm install puppeteer puppeteer-extra puppeteer-extra-plugin-stealth

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

puppeteer.use(StealthPlugin());

(async () => {
    const browser = await puppeteer.launch({ headless: false });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
})();

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

puppeteer.use(StealthPlugin());

(async () => {
    const browser = await puppeteer.launch({
        headless: false,
        args: ['--proxy-server=http://proxy.example.com:8080']
    });
    const page = await browser.newPage();
    
    // Handle proxy authentication
    await page.authenticate({
        username: 'user',
        password: 'pass'
    });
    
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
})();

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

const stealth = StealthPlugin();
// Disable specific evasions if needed
stealth.enabledEvasions.delete('chrome.runtime');

puppeteer.use(stealth);

npx rebrowser-patches@latest patch --packageName puppeteer-core

npx rebrowser-patches@latest patch --packageName playwright

// Puppeteer (after patching)
const puppeteer = require('puppeteer-core');

(async () => {
    const browser = await puppeteer.launch({
        headless: false,
        executablePath: '/path/to/chrome'
    });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
})();

const puppeteer = require('puppeteer-extra');
const StealthPlugin = require('puppeteer-extra-plugin-stealth');

// Patches are already applied to puppeteer-core
puppeteer.use(StealthPlugin());

(async () => {
    const browser = await puppeteer.launch({ headless: false });
    const page = await browser.newPage();
    await page.goto('https://cloudflare.com/');
    console.log(await page.title());
    await browser.close();
})();

This section answers some frequently asked questions about using fortified headless browsers for bypassing Cloudflare.

For more information about fortified headless browsers and browser automation stealth, check out these resources:

• Undetected ChromeDriver Guide
• Patchright GitHub Repository
• Puppeteer Extra GitHub Repository
• Rebrowser Patches GitHub Repository
• Playwright Stealth (Python) GitHub Repository
• Browser Fingerprinting Explained

This change log tracks any updates and revisions made to the Fortified Headless Browser Method over time.