--- title: "Does FlareSolverr still bypass Cloudflare in 2026?" description: "FlareSolverr in September 2026: one Chrome per request, cookies handed to another client, no working captcha solver, and what to use when a page needs a browser." canonical: "https://scalebrowser.net/blog/flaresolverr" last_modified: "2026-11-10" published: "2026-11-10" author: "davide" category: "stealth-tools" --- > ## Documentation Index > Fetch the complete documentation index at: https://scalebrowser.net/llms.txt > Use this file to discover all available pages before exploring further. # Does FlareSolverr still bypass Cloudflare in 2026? > FlareSolverr in September 2026: one Chrome per request, cookies handed to another client, no working captcha solver, and what to use when a page needs a browser. FlareSolverr sits in front of a lot of scrapers and media servers: send it a URL, get back the page and a Cloudflare cookie, keep your HTTP client. It has worked that way since 2020, and many setups still route every request through it. We read the repository, the changelog and Cloudflare's own documentation on 27 September 2026 to see what it still covers and where it stops. ## What is FlareSolverr? FlareSolverr is a local proxy server that opens a real Chrome for every request it receives, waits until Cloudflare's check on that page has passed, and returns the HTML and the cookies to the caller. Its [README](https://github.com/FlareSolverr/FlareSolverr) describes the mechanism in one sentence: "it uses Selenium with the undetected-chromedriver to create a web browser (Chrome)". You talk to it over HTTP on port 8191 with a JSON command such as `request.get`, and it answers with the page and a cookie list you can hand to another client. | Property | Value | | --- | --- | | GitHub stars | 15,689 | | Latest release | v3.5.2, 12 September 2026 | | Docker Hub pulls | 31,432,713 | | Browser stack | Chrome through Selenium and undetected-chromedriver | | New browser per request | yes, unless a session is created | | Default wait for the check | 60,000 ms (60 seconds) | | Working captcha solvers | 0, per its README | | Licence | MIT | *Source: [FlareSolverr GitHub repository, README, changelog and Docker Hub, read 27 September 2026](https://github.com/FlareSolverr/FlareSolverr)* The project is maintained: v3.5.2 bumped Chromium and its dependencies, and v3.5.0 on 26 May 2026 added a way to reach the Turnstile checkbox. The row that matters most is the second to last. ## Does FlareSolverr still bypass Cloudflare in 2026? FlareSolverr is still built to wait out Cloudflare's automatic check, the one that asks for no interaction, and it stops at an interactive challenge unless it is told how to reach a Turnstile checkbox. We found no dated public measurement of how often the automatic check passes for it in 2026, and its repository listed 90 open issues and pull requests on 27 September. The README is explicit: "At this time none of the captcha solvers work", and a page that shows one returns the error "Captcha detected but no automatic solver is configured". The Turnstile option added in May works by pressing Tab a configured number of times until the checkbox has focus, so you have to know that number for each page. Cloudflare describes what its checks look at. Turnstile runs "proof-of-work (computational puzzles), proof-of-space, probing for web APIs, and various other challenges for detecting browser-quirks and human behavior", according to its [Turnstile documentation](https://developers.cloudflare.com/turnstile/). FlareSolverr's Chrome is real, so the web APIs answer honestly, but its browser is a fresh Selenium session on every request, and the site sees that session and nothing else of you. ### Why do FlareSolverr's cookies fail in another client? The cookies fail in another client because Cloudflare binds the clearance to the browser that earned it. The [clearance documentation](https://developers.cloudflare.com/cloudflare-challenges/concepts/clearance/) says the `cf_clearance` cookie "is securely tied to the specific visitor and device it was issued to, preventing reuse across machines". FlareSolverr's own README warns about one half of this: "If you want to use Cloudflare clearance cookie in your scripts, make sure you use the FlareSolverr User-Agent too. If they don't match you will see the challenge." An HTTP client that copies the cookie and the user agent still brings its own network connection, and nothing in FlareSolverr makes that connection look like the Chrome that solved the check. ## What does one Chrome per request cost? One Chrome per request costs memory, time and every piece of state the page built up. The README notes that "Web browsers consume a lot of memory" and that "With each request a new browser is launched", and it advises against many requests at once on a small machine. A session keeps one browser alive and has to be destroyed by hand, and a request can wait up to 60 seconds for the check by default. ![Your code sends one HTTP call with a URL to FlareSolverr in blue, which starts a new Chrome through Selenium and waits up to 60 seconds for Cloudflare's automatic check, then hands back HTML and cookies; for a captcha it has 0 working solvers.](/blog/flaresolverr/per-request.png "FlareSolverr starts a new Chrome through Selenium for each request, waits up to 60 seconds for Cloudflare's automatic check and returns the HTML and cookies. Per its README, none of its captcha solvers work.") The larger cost is what the design leaves out. FlareSolverr opens a page and returns it: its API has no command to click, type or fill a form, and each new browser starts without history, storage or logins. A task that signs in, keeps an account or answers a second factor needs a browser that stays open and that the agent can operate, which is a different tool, not a better FlareSolverr. How curved pointer paths such as ghost-cursor's look to a page is covered in [ghost-cursor and Bezier paths](/blog/ghost-cursor). Scalebrowser runs real browser profiles on your own PC: your AI agent drives them over MCP and signs in without ever seeing a password. ## What is a good FlareSolverr alternative? A good FlareSolverr alternative depends on whether you need the page once or need to work in it. Ian L. Paterson's [benchmark of 7 tools on 31 targets](https://ianlpaterson.com/blog/anti-detect-browser-benchmark-patchright-nodriver-curl-cffi/), published on 13 May 2026, included a site behind Cloudflare Turnstile that blocked every tool except nodriver, and a Cloudflare interstitial that nodriver passed while four tools were gated and two blocked. Our survey of the [Cloudflare tools of the free path](/blog/stealth-browser) compares those tools by the layer they change. The UC Mode and CDP Mode of SeleniumBase are covered in SeleniumBase UC Mode and CDP Mode. | Situation | Tool | Why | | --- | --- | --- | | Public page, no interaction, many URLs | curl_cffi | copies Chrome's TLS handshake without a browser; 26 of 31 targets in Paterson's test | | Existing FlareSolverr setup, automatic checks only | FlareSolverr | maintained, one HTTP call per page | | New Python code that has to open pages behind Turnstile | nodriver | the only tool without a block in Paterson's test | | Accounts, forms, second factors, long sessions | a browser the agent keeps open | state survives the request | We measured the last row with our own agent working the page on Cloudflare's live widgets in August 2026. Two of the three Turnstile modes never asked for interaction. | Turnstile mode | Page | Result | | --- | --- | --- | | Managed | 5sim.com login | token after 1.7 seconds, no click | | Invisible | Cloudflare dashboard login | token after 2.9 seconds, 2 runs | | Checkbox forced | Cloudflare sign-up | failed 2 of 2 on 4 August, passed 2 of 2 on 14 August | *Source: Scalebrowser agent in its own browser, live Cloudflare pages with production site keys, 4 and 14 August 2026* The forced checkbox is the case FlareSolverr reaches only with a Tab count set per page, and it is also the one that failed for us first. We report it with both dates because a single green run would have told the wrong story.