A Cloudflare challenge means WebCheck was stopped at Cloudflare’s edge. It does not tell you whether the origin is healthy: your browser may pass the challenge and keep a clearance cookie, while WebCheck’s server-side request does not run browser verification.
Why does my browser work?
A browser can run Cloudflare’s verification and keep the clearance cookie for later requests. WebCheck makes a bounded HTTP request from its monitoring worker; it does not execute the challenge in a browser.
Check Cloudflare before changing your monitor
Look for the request in Cloudflare Security Events and review the rule that acted on it. Bot protection, managed challenges, Under Attack Mode and rate limits can all affect automated requests.
- Use a dedicated public health endpoint if one is available.
- If you allow monitoring traffic, scope the rule to the needed endpoint or service.
- Keep TLS verification and WebCheck’s network-safety rules enabled.
Challenge, forbidden response or outage?
WebCheck labels a response as an edge challenge only when it is HTTP 403, the Server header identifies Cloudflare and the response includes cf-mitigated: challenge. That run appears as Degraded with an edge-challenge error. A different unexpected 403 is treated as a failed status check. A 5xx response, timeout or connection failure may point to a service problem and should be investigated separately.