http://simonwillison.net/2026-06-16T00:21:36+00:00Simon Willison2026-06-16T00:21:36+00:002026-06-16T00:21:36+00:00https://simonwillison.net/2026/Jun/16/captcha-on-at-least-one-ampersand/#atom-tag

<p><strong>TIL:</strong> <a href="https://til.simonwillison.net/cloudflare/captcha-on-at-least-one-ampersand">Cloudflare CAPTCHA on at least one ampersand</a></p> <p>I'm using Cloudflare's CAPTCHA (they call it a "Web Application Firewall &gt; Custom rules &gt; Managed Challenge" these days) to prevent crawlers from aggresively spidering my <a href="https://simonwillison.net/2017/Oct/5/django-postgresql-faceted-search/">faceted search engine</a> on this site, but I got fed up of even simple <code>?q=term</code> searches triggering the challenge.</p> <p>After some mucking around with Claude Code it turns out you can register the following rule instead, so the CAPTCHA only kicks in for search URLs containing at least one ampersand:</p> <p><code>(http.request.uri.path wildcard r"/search/*" and http.request.uri.query contains "&amp;")</code></p> <p>And now <a href="https://simonwillison.net/search/?q=lemur">/search/?q=lemur</a> works without triggering a CAPTCHA!</p> <p>Also included: notes on <a href="https://til.simonwillison.net/cloudflare/captcha-on-at-least-one-ampersand#trying-the-cloudflare-mcp">trying out the Cloudflare MCP with Claude Code</a>, though it turned out not to be able to edit the rules in question so I had Claude Code <a href="https://til.simonwillison.net/cloudflare/captcha-on-at-least-one-ampersand#using-the-api-instead">switch to the Cloudflare API</a> instead.</p> <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/cloudflare">cloudflare</a>, <a href="https://simonwillison.net/tags/model-context-protocol">model-context-protocol</a>, <a href="https://simonwillison.net/tags/claude-code">claude-code</a></p>

2009-04-29T11:13:40+00:002009-04-29T11:13:40+00:00https://simonwillison.net/2009/Apr/29/moot/#atom-tag

<p><strong><a href="http://musicmachinery.com/2009/04/27/moot-wins-time-inc-loses/">moot wins, Time Inc. loses</a></strong></p> The Time.com poll hack was more sophisticated than I first thought... Time implemented reCAPTCHA half way through the voting period, but the 4chan community fought back with a custom interface that crowdsourced the job of voting and let individuals submit up to 30 votes a minute. <p>Tags: <a href="https://simonwillison.net/tags/4chan">4chan</a>, <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/moot">moot</a>, <a href="https://simonwillison.net/tags/onlinepolls">onlinepolls</a>, <a href="https://simonwillison.net/tags/recaptcha">recaptcha</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/timedotcom">timedotcom</a>, <a href="https://simonwillison.net/tags/voting">voting</a></p>

2009-01-25T00:00:28+00:002009-01-25T00:00:28+00:00https://simonwillison.net/2009/Jan/25/ocr/#atom-tag

<p><strong><a href="http://ejohn.org/blog/ocr-and-neural-nets-in-javascript/">OCR and Neural Nets in JavaScript</a></strong></p> John dissects the brilliant Greasemonkey script that solves simple captchas using the canvas element and HTML5’s getImageData API. <p>Tags: <a href="https://simonwillison.net/tags/canvas">canvas</a>, <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/getimagedata">getimagedata</a>, <a href="https://simonwillison.net/tags/greasemonkey">greasemonkey</a>, <a href="https://simonwillison.net/tags/javascript">javascript</a>, <a href="https://simonwillison.net/tags/john-resig">john-resig</a>, <a href="https://simonwillison.net/tags/ocr">ocr</a></p>

2008-08-29T10:01:32+00:002008-08-29T10:01:32+00:00https://simonwillison.net/2008/Aug/29/captcha/#atom-tag

<blockquote cite="http://www.guardian.co.uk/technology/2008/aug/28/internet.captcha"><p>New authentication schemes such as OpenID, or Microsoft's CardSpace, may help as adoption increases. These systems make it possible to register for one site using credentials verified by another. Instead of having many sites with poor verification procedures, the internet could have a few sites with strong verification procedures, that are then used by others. The advantage for the user is that they no longer have to jump through multiple hoops for each new site they encounter.</p></blockquote> <p class="cite">&mdash; <a href="http://www.guardian.co.uk/technology/2008/aug/28/internet.captcha">Tim Anderson</a>, in the Guardian</p> <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/cardspace">cardspace</a>, <a href="https://simonwillison.net/tags/guardian">guardian</a>, <a href="https://simonwillison.net/tags/openid">openid</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/tim-anderson">tim-anderson</a></p>

2008-03-19T09:41:37+00:002008-03-19T09:41:37+00:00https://simonwillison.net/2008/Mar/19/recaptcha/#atom-tag

<p><strong><a href="http://seeknuance.com/2008/03/18/integrating-recaptcha-with-django/">Integrating reCAPTCHA with Django</a></strong></p> Looks pretty straight forward. <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/django">django</a>, <a href="https://simonwillison.net/tags/python">python</a>, <a href="https://simonwillison.net/tags/recaptcha">recaptcha</a></p>

2007-01-19T09:50:17+00:002007-01-19T09:50:17+00:00https://simonwillison.net/2007/Jan/19/nhl/#atom-tag

<p><strong><a href="http://www.slate.com/id/2157741">The NHL&#x27;s All-Star voting disaster</a></strong></p> The NHL ran an online poll to decide which players are picked for their All-Star Game. The only authentication was a poorly implemented CAPTCHA. Unsurprisingly, it got gamed. <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/gaming">gaming</a>, <a href="https://simonwillison.net/tags/nhl">nhl</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/stupid">stupid</a></p>

2006-12-19T18:01:50+00:002006-12-19T18:01:50+00:00https://simonwillison.net/2006/Dec/19/botbouncer/#atom-tag

<p><strong><a href="http://botbouncer.com/">botbouncer.com</a></strong></p> Neat concept: a third party service for ensuring that an OpenID has passed a CAPTCHA. <p><small></small>Via <a href="http://blog.janrain.com/2006/12/01/announcing-botbouncercom/">JanRain Blog</a></small></p> <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/janrain">janrain</a>, <a href="https://simonwillison.net/tags/openid">openid</a></p>

2006-08-24T19:01:42+00:002006-08-24T19:01:42+00:00https://simonwillison.net/2006/Aug/24/rss/#atom-tag

<p><strong><a href="http://kentbrewster.com/rss-captcha-prototype">RSS CAPTCHA Prototype</a></strong></p> Accessible captchas based on RSS feeds from friends’ sites. <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a></p>

2004-01-28T08:37:35+00:002004-01-28T08:37:35+00:00https://simonwillison.net/2004/Jan/28/solving/#atom-tag

<p><strong><a href="http://www.boingboing.net/2004/01/27/solving-and-creating.html">Solving and creating captchas with free porn</a></strong></p> More spammer ingenuity <p>Tags: <a href="https://simonwillison.net/tags/captchas">captchas</a>, <a href="https://simonwillison.net/tags/spammers">spammers</a></p>