It’s just doing hash math (think like bitcoin mining) to make your CPU burn enough processing time to make a layer seven DDoS not worthwhile. It works. Because now the server uses way less processing time than the client did.
That is not true.
It does a whole bunch of checks, like fingerprinting your GPU, environment, etc.
The checks are even run in a custom VM, and are heavily protected.
The gathered data is then sent back to cloudflare, and you either get an access cookie (cf_clearance) back, or not.
