--- title: "Byparr + Scrapling: The Open-Source Stack Replacing FlareSolverr for Cloudflare-Protected Scraping in 2026" description: "FlareSolverr was the default open-source Cloudflare bypass for three years and it's losing against 2026 Turnstile. Here's how Byparr (a Camoufox-backed drop-in replacement) and Scrapling (a three-fetcher Python framework) actually work, a six-site success matrix, and when you're better off just paying for a managed proxy or actor." date: 2026-04-24 lastmod: 2026-05-22 url: https://godberrystudios.com/posts/byparr-scrapling-flaresolverr-cloudflare-bypass-2026/ author: Tomas Lebedinskas categories: ["web-scraping"] tags: ["byparr","scrapling","cloudflare-bypass","web-scraping"] --- Short answer: **FlareSolverr still clears light JavaScript challenges, but Cloudflare Turnstile and 2026 Managed Challenges are where it breaks. Byparr is the Camoufox-backed drop-in replacement — same API, same port, better success rate. Scrapling is the Python framework that gives you three fetchers in one library: plain HTTP with TLS impersonation, Camoufox with an auto-Turnstile solver, or full Playwright.** On the six-site test I ran this week, a Byparr-plus-Scrapling stack cleared every target where FlareSolverr timed out — at 2–5× the latency and zero proxy spend. Past a few tens of thousands of requests per day, a managed actor or residential rotation still wins on cost. I ship two Apify Store actors that hit this exact wall in production, so this isn't theoretical for me — it's the same problem I solve every time I update [the Yelp Scraper](/posts/how-to-scrape-yelp/) and watch DataDome's defenses move. FlareSolverr has been the "just use this" answer for three years — one Docker command, port 8191, done. It slots into Prowlarr, Jackett, and every scraping tutorial on YouTube, including [my beginner's guide](/posts/web-scraping-for-beginners-2026-guide/) from last year. If you've spent any time on r/webscraping this year you know the story: Turnstile challenges routinely 200-OK but return a blocked page, issues like [#1664](https://github.com/FlareSolverr/FlareSolverr/issues/1664) have a long tail of "same here," and Scrapfly's 2026 guide flags the behavioral-analysis problem front and center. Two tools from adjacent corners of the open-source world have quietly become the better answer: **Byparr**, a Camoufox-backed FastAPI server that speaks the FlareSolverr API, and **Scrapling** (v0.4.8 as of May 2026), a Python framework whose three fetcher classes cover the full range from TLS-impersonated HTTP to full-browser Playwright with a Cloudflare auto-solver. This post walks through both, benchmarks them on six real targets, and tells you honestly when open-source still wins and when you should buy managed. ## Why FlareSolverr is losing in 2026 FlareSolverr's architecture hasn't changed since 2022: a Flask service runs Selenium with undetected-chromedriver, waits for the JS challenge to resolve, grabs the cookies, returns them. The client hits the real endpoint with a normal HTTP library. Lightweight, stateless, easy to scale. Cloudflare's 2025–26 detection model doesn't care whether your cookies look valid. The broader [pay-per-crawl economics](/posts/cloudflare-pay-per-crawl-http-402-scrapers-2026/) Cloudflare rolled out tell you where their incentives point — harder challenges are a feature. Three things shifted: **Turnstile replaced the old JS challenge.** It's a proof-of-work-style check that runs a hardware-fingerprint probe in the client. Undetected-chromedriver still clears some Turnstile instances, but the success rate fell sharply on the "Managed Challenge" variant, and FlareSolverr has no solver of its own. **Behavioral analysis fires in under 10 milliseconds.** From [AlterLab's 2026 teardown](https://alterlab.io/blog/playwright-anti-bot-detection-what-actually-works-in-2026): Cloudflare's AI Labyrinth flags the stock `Playwright + Stealth` stack almost instantly, because the TLS JA3 fingerprint of a Playwright-bundled Chromium doesn't match any real Chrome release. FlareSolverr sits on the same problem. **Maintainer cadence can't keep up.** Releases [still ship periodically](https://github.com/FlareSolverr/FlareSolverr/releases) and discussion #1416 mentions an experimental nodriver image — but `main` lags Cloudflare's rollouts by weeks. For a `*arr` user that's fine. For a scraper on a Turnstile-heavy SaaS site, weeks of downtime is the whole product. None of this makes FlareSolverr useless — it's still the fastest path to clearing a light JS challenge. What it isn't anymore is the default. ## Byparr: the drop-in, Camoufox-backed replacement [Byparr](https://github.com/ThePhaseless/Byparr) is the work of a single developer (ThePhaseless). Pitch: same API as FlareSolverr, modern stealth underneath. The `v2.0.0` release swapped the browser from Selenium-plus-undetected-chromedriver to [Camoufox](https://camoufox.com/), a Firefox-based anti-detect browser that patches fingerprints in C++ rather than via JavaScript overrides. That C++-level patching is the part that matters — detection services can read the JS heap and notice the lies; they can't read the compiled binary. The current line is `v2.1.0` (February 2026), which added Python 3.14 support and per-request proxy overrides via `X-Proxy-*` headers. A few things to know about Camoufox. Firefox not Chrome, by design — more public research exists on Firefox fingerprint resistance (Tor Project, Arkenfox) and Cloudflare's detection ML is trained heavier on Chromium signals. Camoufox's docs report 0% detection across CreepJS, BrowserScan, and Fingerprint.com. Memory footprint ~200MB versus 400MB+ for stock Firefox. The project had a maintenance gap in 2025 and the 2026 release train is flagged experimental on the docs site, so read the release notes before pinning a version for production. ### Install and run Byparr ```bash docker run -d --name byparr -p 8191:8191 ghcr.io/thephaseless/byparr:latest ``` That's it. The image is roughly 1.1GB (smaller than FlareSolverr's), the API docs are auto-generated at `http://localhost:8191/docs`, and the endpoint contract is compatible with FlareSolverr's v1 API — meaning anything that points at `http://localhost:8191/v1` with a FlareSolverr-shaped JSON body will work unchanged. A minimal request: ```bash curl -L -X POST 'http://localhost:8191/v1' \ -H 'Content-Type: application/json' \ --data-raw '{ "cmd": "request.get", "url": "https://protected-site.example", "maxTimeout": 60000 }' ``` For a real deployment, Docker Compose is cleaner: ```yaml services: byparr: image: ghcr.io/thephaseless/byparr:latest container_name: byparr environment: - LOG_LEVEL=INFO - USE_HEADLESS=true ports: - "8191:8191" restart: unless-stopped ``` If you're migrating from FlareSolverr, the change in any existing Prowlarr / Jackett / custom scraper config is one line — swap the base URL. No code changes, no payload differences. ### What Byparr fixes, and what it doesn't **Turnstile clearance rate.** Independent benchmarks through 2026 (Roundproxies, ZenRows, Scrapfly, Web Scraping Club's LAB #95) consistently rank Byparr at the top of the open-source pile — with the caveat that "top" still trails managed platforms on the same sites. **Behavioral fingerprint quality.** Camoufox modifies `navigator`, `screen`, `webgl`, canvas, and audio fingerprints at the C++ level, so the JS-heap inspection that catches `Playwright + Stealth` in 10ms finds nothing to flag. Passes CreepJS clean. **Active maintenance.** Byparr's release cadence is weekly-ish; patches land fast when Cloudflare ships a new detection signal. Hardest part to quantify in a one-day benchmark, matters most over a quarter. What it doesn't fix: latency. A Camoufox instance takes 3–6 seconds to boot and 2–4 seconds to render a Turnstile page. For light-challenge sites FlareSolverr was faster because undetected-chromedriver boots quicker. Pool sizing helps but the per-request cost is real. And Byparr has no solver for hard CAPTCHAs — if the site escalates past Managed Challenge, you'll bolt on CapSolver/2Captcha or rotate residential proxies until escalation stops. ## Scrapling: the Python-native stack Byparr is a service. [Scrapling](https://github.com/D4Vinci/Scrapling) is a framework you import — the problem it solves is slightly different. For a Python scraper that needs one library to gracefully handle the range from "public JSON endpoint" to "TLS-impersonated HTTP" to "full browser with stealth patches and a Turnstile auto-solver," Scrapling — `v0.4.8` as of May 2026 — is the cleanest answer shipping right now. Three fetcher classes, each a level deeper in sophistication: **`Fetcher`** — fast async HTTP with TLS browser-impersonation, HTTP/3 support, and persistent session management. Use this for sites that don't challenge, or sites that challenge only on the first request but happily serve to any session with a real Chrome-ish TLS signature. ```python from scrapling.fetchers import Fetcher page = Fetcher.get("https://example.com", impersonate="chrome") for product in page.css(".product"): print(product.css_first(".title").text, product.css_first(".price").text) ``` Passing `impersonate="chrome"` tracks whatever the latest Chrome TLS fingerprint is, so you don't have to bump a hardcoded version every time curl_cffi adds one — pin a specific target (`"chrome136"`) only if you need reproducible behavior. **`StealthyFetcher`** — Camoufox-backed (same browser as Byparr), with optional automatic Cloudflare solving via `solve_cloudflare=True`. The one to reach for when the Fetcher starts getting blocked. ```python from scrapling.fetchers import StealthyFetcher page = StealthyFetcher.fetch( "https://protected-site.example", headless=True, network_idle=True, solve_cloudflare=True, ) for review in page.css(".review"): author = review.css_first(".author").text body = review.css_first(".body").text print(author, "—", body[:60]) ``` **`DynamicFetcher`** — full Playwright-managed Chrome or Chromium for sites that genuinely need JavaScript execution against the real DOM (infinite scroll, SPA routing, authenticated flows). Use this when `StealthyFetcher` can't render the page you need. Three session-flavored variants too — `FetcherSession`, `StealthySession`, `DynamicSession` — keep cookies and browser state across requests. The `AsyncDynamicSession` / `AsyncStealthySession` pair handles concurrency with a `max_pages` knob that rotates browser tabs so you don't boot a Camoufox instance per request. ### The adaptive part The feature that got Scrapling its 2026 attention isn't the fetchers — it's `adaptive=True` on the parser. Mark a selector as adaptive and Scrapling tracks the element's structural fingerprint (tag, attributes, siblings, text signature) at scrape time. When the site renames `.price-tag` to `.price-tag-new` three weeks later, Scrapling relocates by similarity and your scraper keeps working. Enough drift still breaks it — but it buys months of uptime between fixes on volatile sites. ```python price = page.css_first(".price-tag", auto_save=True) # Three weeks later, on the same page structure but renamed classes, # the same line finds the element — Scrapling matches on the saved fingerprint. ``` This is the part I wish I'd had when Google migrated `` → `