Proxy tier benchmark › Protection systems
Which US public-data portals sit behind Cloudflare?
Cloudflare is the most common defence in front of US state business
registries, and the study's own numbers show what proxying does about it:
nothing. As the proxy tier climbs, blocked outcomes fall and challenge
outcomes rise, monotonically across all 1,920 requests — 50 blocked / 40
challenged unproxied, 20 blocked / 84 challenged on residential. You buy your
way from a 403 to an interactive challenge, and an HTTP client cannot solve an
interactive challenge at any tier or price.
Portals behind Cloudflare in this census
Sixty-one candidate URLs were probed once each from a clean US datacenter IP on 2026-08-18; 6 of the portals below were then measured through all six proxy arms, ten rounds each.
| Portal | Measured in | Behaviour | |
|---|---|---|---|
us_co_sos_biz |
six-arm run | 403 with a 5.5 KB `Attention Required! | Cloudflare` page on the unproxied and datacenter arms; 200 with a 14.8 KB interactive challenge on anti-detect and residential |
us_nc_sos_biz |
six-arm run | 403 on all 60 requests, every arm; probe title Just a moment... |
|
us_ut_bes |
six-arm run | 403 with a 4.5 KB block page on the plain arms; 200 with a 52.4 KB body on anti-detect and residential — eleven times the traffic, and not established to be a challenge | |
canva_template |
six-arm run | 403 with a 755 KB branded block page unproxied; 200 with a ~911 KB interactive challenge on the upper tiers | |
us_ia_sos_biz |
six-arm run | 200 with a 100 KB body carrying the portal's own title and text — flagged as a challenge, probably the real page | |
us_tx_harris_prop |
six-arm run | 404 from Microsoft IIS, flagged as a challenge because Cloudflare proxies the error page; the URL does not exist | |
us_fl_sunbiz_search |
census probe only | 403, Just a moment..., 16 characters of text — excluded, robots.txt unreadable |
|
us_ga_ecorp |
census probe only | 403, Just a moment..., 16 characters of text — excluded, robots.txt unreadable |
Two of these rows are classifier artefacts
The harness names Cloudflare by matching cdn-cgi/challenge-platform,
__cf_chl_, Just a moment... or Checking your browser before accessing
against the response body, and it does so before it checks whether the body
is the page that was asked for. Cloudflare injects its challenge-platform script
into ordinary responses when JavaScript detection is on, including error
responses.
That is why Iowa's 100 KB HTTP 200 carrying Business Entities Search and
Harris County's 2,183-byte IIS 404 both appear above. Neither is evidence of a
Cloudflare block, and both are flagged as such on their own pages. A census
built on body-signature matching alone will over-report Cloudflare wherever
Cloudflare is merely the CDN.
What to do about a real Cloudflare challenge
Not a more expensive proxy. Colorado and Utah both moved from a 403 to a challenge as the tier climbed, and neither moved from a challenge to a page. The tool for an interactive challenge is a real browser — see the Browser API — and the question to ask before reaching for one is whether the data is published as a bulk download or an API instead.
Run date: 2026-08-18 · All protection systems · All 32 benchmarked targets · Full report · Census data
Test your own target
The result above describes one URL on one day. Paste your own URL into the live tester and see the real response before creating an account.