Simon Willison 分享了一个来自他自身经验的小技巧，即使用 Cloudflare 的 Managed Challenge（CAPTCHA）来保护网站的分面搜索免受激进爬虫的侵扰。他发现即使是简单的单参数搜索（例如 `?q=term`）也会触发验证，这很烦人。在尝试了 Claude Code 之后，他发现了一条规则，可以将 CAPTCHA 限制在查询字符串中至少包含一个 & 符号的 URL 上，从而让简单的搜索请求可以无中断地通过。
16th June 2026
[](https://til.simonwillison.net/cloudflare/captcha-on-at-least-one-ampersand)
[TIL](https://simonwillison.net/elsewhere/til/) [Cloudflare CAPTCHA on at least one ampersand](https://til.simonwillison.net/cloudflare/captcha-on-at-least-one-ampersand) --- I use Cloudflare's CAPTCHA (they call it a "Managed Challenge") on \[simonwillison.net/search/\](https://simonwillison.net/search/) to prevent crawlers from following every single possible combination of my \[faceted search\](https://simonwillison.net/2017/Oct/5/django-postgresql-faceted-search/) UI.
I'm using Cloudflare's CAPTCHA (they call it a "Web Application Firewall \> Custom rules \> Managed Challenge" these days) to prevent crawlers from aggresively spidering my [faceted search engine](https://simonwillison.net/2017/Oct/5/django-postgresql-faceted-search/) on this site, but I got fed up of even simple `?q=term` searches triggering the challenge.
After some mucking around with Claude Code it turns out you can register the following rule instead, so the CAPTCHA only kicks in for search URLs containing at least one ampersand:
`(http.request.uri.path wildcard r"/search/*" and http.request.uri.query contains "&")`
And now [/search/?q=lemur](https://simonwillison.net/search/?q=lemur) works without triggering a CAPTCHA!