Cloudflare WAF Rule: Trigger CAPTCHA Only on Ampersand-Containing Search URLs
Simon Willison's Weblog42 days agoTutorialSimon Willison was frustrated that even simple single-term searches on his site were triggering Cloudflare CAPTCHA challenges meant to deter aggressive crawlers. With help from Claude Code, he crafted a Cloudflare WAF Managed Challenge rule that activates only when a search URL contains at least one ampersand — the character that separates multiple query parameters. The result: ordinary searches like /search/?q=lemur pass through freely, while complex faceted queries with multiple parameters still face the challenge.
CAPTCHAs can still detect AI agents★ 72
Hacker News (AI keywords)60 days agoPaperRoundtable argues that CAPTCHA image recognition is largely solved, but process-level behavior still separates humans from AI agents. Their CogCAPTCHA30 benchmark combines CAPTCHA with cognitive psychology tasks to test not only outputs, but how answers are produced. Results suggest frontier models like Claude, GPT, and Gemini are not necessarily more humanlike than smaller or cognition-trained models.