A Cloudflare challenge can score as a performance regression in overnight Lighthouse runs

Lighthouse cannot compute a lab metric without a full HTML document, and then a rendered page ^[6]. When the edge returns a challenge instead of that document, the number is not a Core Web Vitals measurement at all. According to the dev.to writeup, it records a security product refusing to serve HTML to automation ^[2].

What differs between the check that passes and the 3am run that fails is the request ^[9]. The page is the same. An interactive session may carry cookies from an earlier challenge, can run a JavaScript challenge, and often comes from a residential network with no association with bulk scraping ^[7]. Scheduled and API-driven runs arrive from data-centre ranges and send predictable automation User-Agents, including Chrome-Lighthouse strings. They hold no challenge cookie, and they cannot complete a managed challenge the way a person with a browser can ^[8].

What you can do next depends on which product did the blocking. Cloudflare documents that Bot Fight Mode challenges traffic matching known bot patterns. It cannot be bypassed or skipped with WAF custom rules or Page Rules, because it does not run on the Ruleset Engine ^[12]. Skip actions live in WAF custom rules, so the rule never runs. IP Access rules are evaluated against the connecting IP before Bot Fight Mode looks at the request ^[14]. That ordering is why they still work. Those rules need the addresses PageSpeed Insights fetches from, and the writeup does not list them ^[21].

Super Bot Fight Mode adds configurable actions and supports Skip actions in WAF custom rules. The writeup calls that the practical path for allowing verified bots or monitoring User-Agents while other automated traffic still gets challenged ^[15]. Enabling it does not settle the question. Misconfigured "Definitely automated" or "Likely automated" actions still catch Lighthouse and PageSpeed Insights traffic, because Cloudflare does not classify it as a verified bot ^[16]. Under Attack Mode raises friction for almost everyone, and the writeup cites community threads reporting PageSpeed Insights failing with ERRORED_DOCUMENT_REQUEST while that mode is on ^[17].

The writeup puts the cost of the wrong diagnosis at a sprint spent treating a blocked fetch as an LCP incident ^[18]. Matching the failed run to the right Cloudflare product, it says, saves a week of rewriting Largest Contentful Paint budgets on a document that never left the edge ^[19]. Those are one practitioner's figures, not a measurement, and they only transfer to a team that would have started in the front end. Check Cloudflare Security Events for that URL at the timestamp of the failed run, where Bot Fight Mode, Super Bot Fight Mode, a WAF custom rule, rate limiting or Under Attack Mode is labelled against the request ^[4].