Verification challenge overview
The sign-in, forgot-password, and reset-password pages run a silent bot check from Cloudflare. Most of the time you see nothing at all; occasionally Cloudflare asks you to tick a box or complete a short visual or audio task before the button works. Your email, password, and reset link stay on our servers and are never sent to Cloudflare.
Why it is there
Those three pages are the ones attackers hammer with stolen passwords and reset spam. The check makes large-scale automation expensive while real people almost never notice it. It works alongside the per-account lockout and two-factor authentication, not instead of them.
What to expect
Fill in the form as usual and click the button. The check runs when you submit; there is no box, spinner, or green tick unless Cloudflare needs you to confirm. When it does, a small widget appears above the button — a "Verify you are human" checkbox, a short image task, or an audio alternative — and the button waits until you finish. The widget works with the keyboard (Tab to reach it, Space or Enter to activate) and with screen readers. The sign-in and forgot-password pages carry an About verification link that opens this article.
Why did it appear again?
A pass is single-use. Any submission that fails — a mistyped password, an expired reset link — uses it up, and the check runs again before your next try. A pass also lasts only about five minutes, so a form left open while you look up a password is re-checked on submit. Neither costs you anything beyond a second or two.
If the check fails
A failed check does not say so. On the sign-in page it shows "Invalid email or password" — the same message as a wrong password. On the forgot-password and reset-password forms it shows "Something went wrong. Please try again." Re-enter your details carefully and submit once more; the check re-runs on every attempt.
If it keeps failing with details you know are right, work down this list:
- Reload the page and try again.
- Make sure your network allows
challenges.cloudflare.com. Corporate and campus proxies sometimes block it; ask IT to allow it. - Turn off strict ad blockers, privacy extensions, or a VPN for this site, then reload.
- Check the device clock. A clock that is minutes out fails the check silently; set it to network time.
- Try another browser, or update the one you have — very old versions fail Cloudflare's compatibility checks.
- Try a different network, such as a phone hotspot, to rule out a shared address with a poor reputation.
If none of that works, tell an admin the time it happened so the platform team can investigate.
What Cloudflare receives
Basic request details: your IP address, browser type, and a little about the browser environment. No form fields, no tracking cookies, no cross-site fingerprinting.
Can I turn it off?
There is no per-user switch. Your administrator turns the check on or off for the whole app, and it stays on unless the app is running without a Cloudflare key. Every sign-in method the app offers goes through it; there are no passkeys or single sign-on logins.