Loading...
Pricing of Cloudflare Waiting Room solution
Inherited a site with a captcha or another protection layer but no access to the source code? In that case you naturally ask: which solution is installed, is it configured correctly, and how can the workflow be tested?
In this article, we have tried to answer all the key questions. The first step in solving the task is to determine which protection system is being used. To do this, you can refer to the list of popular captchas and anti-bot protection systems, where you will find visual examples and key indicators that help you quickly understand what you are dealing with.
If you discover that your site uses Cloudflare Waiting Room, the next step is to study its properties and operation in more detail. In this article, you can also review the instructions on how to integrate Cloudflare Waiting Room so that you fully understand how it functions on your site. This will help you not only understand the current protection, but also properly plan its maintenance.
What is Cloudflare Waiting Room
Cloudflare Waiting Room is a virtual queue that protects a website from overload during traffic spikes. If there are too many visitors, "excess" users are temporarily redirected to a waiting page, where they see their queue status and estimated entry time. As soon as a spot becomes available, they are automatically admitted to the site.
How to solve Waiting Room via CapMonster Cloud
When testing the Waiting Room mechanism, it is important to ensure that the queue functions correctly and regulates access to the site.
Here is how you can check this:
- Open the page where the Waiting Room is enabled and ensure the queue appears when the user limit is exceeded.
- Try accessing the site from multiple devices or browsers simultaneously to generate artificial load — some requests should be placed in the queue.
- Verify that users placed in the queue see the waiting page and are then automatically admitted to the site when a spot becomes available.
- Ensure that refreshing the page does not remove the user from the queue.
For automated testing and captcha recognition, you can use specialized services, such as CapMonster Cloud — a tool that accepts captcha parameters, processes them on its servers, and returns a ready-made solution. This solution (token or cookie) can be inserted into a form or browser to pass the verification without user interaction.
Working with CapMonster Cloud via API typically involves the following steps:
Creating a task
At this stage, you pass your API key, captcha type, and its parameters. The service returns a unique taskId, which can be used later to retrieve the result.
Sending an API requestThe following parameters must be specified in the request to solve Cloudflare Waiting Room:
type - TurnstileTask;
websiteURL - URL of the page where the challenge is located;
websiteKey - Cloudflare key on the target site;
cloudflareTaskType - wait_room;
htmlPageBase64 - Base64 encoded HTML page containing the title <title>Waiting Room powered by Cloudflare</title>;
userAgent - Browser User-Agent. Pass only an up-to-date UA from Windows OS;
Also, for this task, you must use your own proxies:
How to connect Cloudflare Waiting Room to your site
To confidently navigate how captcha works on your site, understand its verification logic, reconnect, or reconfigure it, we recommend studying this section. It describes the protection connection process — this will help you quickly understand all the nuances.
Requirements and preparation- Cloudflare Plan: Waiting Room is available for Business and Enterprise.
- CDN and Proxying: Your site must be connected to Cloudflare, and the DNS record for the domain or subdomain must be proxied.
- Cookies: Visitors must support cookies, as Cloudflare uses them to track queue position.
- Decide which pages/users will be in the queue and which will bypass the Waiting Room (e.g., administrators, VIPs, specific paths).
1. Register with Cloudflare and connect your site.
2. In the Traffic → Waiting Room section, create a new queue:
3. Click Create Waiting Room.
Specify:
- Hostname / URL where the Waiting Room will be active.
- Waiting Room name (for internal records).
- Maximum number of simultaneously active users (optional, if limited load is required).
4. Customize the waiting page design:
- You can use the Cloudflare template or custom HTML/CSS.
- Add a logo, waiting time information, and instructions for users.
5. Save and activate the Waiting Room.
6. Configuring Rules
Cloudflare allows excluding specific traffic from the queue.
Typical Bypass Rules:
- Admin IP addresses: always allow.
- Paths/URL: exclude static files (.js, .css, .png) or specific pages.
- Geo-targeting: exclude specific countries.
- Query string: exclude specific GET parameters.
Possible errors and debugging
Invalid domain or incorrect queue configuration
The waiting room page does not appear. Check that the queue rule is linked to the correct URI, path, or host.
Page loading timeout or queue token timeout
The client did not wait for the server response. Increase timeouts in tests and monitoring to handle delays correctly.
Re-verification or expired queue token
If the user uses an expired token or invalid cookies, the system will show the waiting page again.
Conflict with other access checks
Simultaneous use of Waiting Room and other authorization/bot-protection rules may lead to cyclic checks. Follow recommendations for the sequence of checks and user bypassing logic.
Protection resilience checks
After integration, make sure the system really protects the site from automated actions.
Try requesting the page without special cookies — the user should be placed in the waiting room.
Test re-entry with already set cookies — the user should bypass the queue and reach the main content.
Conduct load testing (e.g., with k6 or JMeter) at a high request rate — the waiting room page should display correctly, and the queue server should remain stable.
Check server reaction to expired or incorrect cookies/tokens. Expected result — the user is returned to the waiting page.
Security and optimization tips
Configure queue rules and token TTL according to the load level and risks
Store all secrets (e.g., token signing keys) only on the server
Log queue events and passage status to understand why users are placed in the waiting room and identify false positives.
For transparency, add links to the Privacy Policy and Terms of Use on waiting room pages.
Supported captchas
reCAPTCHA v2
GeeTest
DataDomeConclusion
If you’ve taken over a website that already has a captcha or another protection system installed, but you don’t have access to the code, don’t worry! It’s quite easy to identify which technology is being used. To verify that everything works correctly, you can use the CapMonster Cloud recognition service in an isolated test environment to make sure that the token processing mechanism and the validation logic are functioning properly.
In the case of Cloudflare Waiting Room, it’s enough to detect the system, observe its behavior, and confirm that the protection is working correctly. In this article, we showed how to identify Cloudflare Waiting Room and where to find instructions on how to integrate or reconfigure it, so you can confidently maintain the protection and keep its operation under control.
Amazon Waf
Faucet Pay
Imperva (Incapsula)
Prosopo
Text CAPTCHA
Yidun
MTCaptcha
Altcha
Funcaptcha
TSPD
Hunt
Alibaba
Friendly