The Hallway Track
Engineering Insights

Cloudflare CAPTCHA on at least one ampersand

Simon Willison · Jun 16, 2026 · Engineering Insights

Cloudflare CAPTCHA rules can be scoped to only challenge search URLs containing an ampersand, fixed via Claude Code.

“After some mucking around with Claude Code it turns out you can register the following rule instead, so the CAPTCHA only kicks in for search URLs containing at least one ampersand”

Simon Willison documented using Claude Code to refine a Cloudflare Managed Challenge rule so only search URLs with an ampersand trigger a CAPTCHA, and noted the Cloudflare MCP couldn't edit the rules so he used the API instead. It's a practical AI-tooling tip but a minor signal with limited industry relevance.

cloudflare claude-code captcha model-context-protocol

Watch / read the original source →