Skip to main content

How to solve a verification challenge

In this article

How to solve a verification challenge

In almost every case there is nothing for you to do — the verification widget runs invisibly in the background, completes on its own, and the form's submit button becomes active. If the widget does decide to ask for confirmation, the checks below walk you through every variant you might encounter.

The invisible path (the usual case)

When you load the sign-in, forgot-password, or reset-password page, the widget appears as a small bordered box just above the submit button. You'll see a "Verifying..." indicator for a moment, followed by a green checkmark. As soon as the checkmark appears, the submit button is enabled. Fill in the form as usual and submit.

The interactive path

If Cloudflare wants extra confidence, it picks the lowest-friction modality available. You may see one of:

  • A checkbox labeled "Verify you are human" — click it and a green checkmark appears.
  • A short image task such as "select all squares containing a bus" — pick the matching tiles and the widget confirms.
  • An audio alternative — listen to a brief clip and type the spoken digits.

Once you complete the challenge the widget returns its green checkmark and the submit button is enabled.

Keyboard and screen-reader support

The widget is fully keyboard accessible. Press Tab to focus it, then Space or Enter to activate. When an interactive challenge appears, Tab moves between options and Space selects them. Screen readers announce the widget as a "verification challenge" and read the prompt text. If image tasks are difficult for any reason, focus the widget and press Tab until you reach the audio alternative.

Token expiration

A successful verification produces a token that is good for roughly five minutes. If you leave the form open for longer than that — for example, looking up a password — the widget will refresh on its own and ask you to verify again. Just complete the new challenge and submit. The token is also single-use: if a server-side check fails (for example, you mistyped your password and got a 400), the widget automatically remounts and you'll verify once more before retrying.

Where to go next