Earlier quoted context omitted.
If all bots are subject to a rate limit, then the system works as designed. Especially if site operators can block bot accounts. Requiring accounts is one of the easiest solutions for that problem. One of the large issues with scrapers is that they pretend to be normal internet visitors that never visited your site before, because any bot that stored cookies would immediately be rate limited by basic config. Turnstil…
> Normal visitors get in for free Except for the unfortunate minority of normal visitors who always get misclassified as bots and get denied access regularly. I wouldn’t be complaining if Cloudflare’s misclassifier bit any user with the same small probability. But it keeps biting the same users over and over again.
Website owners that use Turnstile and other such services choose to exclude these users. A tiny margin of false positives isn't going to dissuade most website owners, I imagine only the ones that themselves have issues with Cloudflare will bother to add the necessary rules to permit uncommon users (and the bots that copy them).