When an anti-bot system's confidence that a visitor is a bot exceeds its configured threshold, it may redirect the request to a challenge page instead of the actual content. The challenge can take several forms: a JavaScript proof-of-work that the browser must compute, an invisible CAPTCHA (such as Cloudflare Turnstile or hCaptcha), an interactive puzzle, or a simple 'click to confirm you are human' button.
Once the challenge is passed, the anti-bot system issues a clearance cookie that is presented with subsequent requests. The cookie is often cryptographically signed with a short expiry, so scrapers must periodically re-solve challenges as cookies expire.
Challenge pages are distinct from hard blocks (HTTP 403) in that they allow legitimate automated systems — and sufficiently capable scrapers — to gain access by completing the challenge. APIs like AlterLab handle challenge resolution transparently, so callers receive the final page content without managing cookie state themselves.