Troubleshooting

Your site is behind bot protection

Good news first: your site isn't broken and your URL is right. Your visitors are seeing it normally. Our recorder is the only thing being stopped.

What's actually happening

Your site uses Cloudflare Turnstile, reCAPTCHA, hCaptcha or something similar. When our recorder opens your URL, that protection decides an automated browser isn't welcome and serves it a "verify you are human" page instead of your site.

We detect that and stop, rather than filming the challenge page and handing you a demo video of a CAPTCHA. Two ways forward — the first takes about a minute.

1

Record it with Autopilot

Autopilot records your own browser instead of ours. You're a real person on a real machine that the protection already trusts, so it simply lets you through — and you can walk through logged-in pages, dashboards and flows that a URL alone could never reach.

This works on any site, whatever protection it uses, and whether or not you own it. Every account includes a free Autopilot demo.

Open Autopilot →
2

Let our recorder through — if you own the site

If it's your site, you can tell your firewall that our recorder is welcome. Then normal URL demos work, including scheduled re-renders when your site changes. Every request we make carries this header:

X-InstaDemo-Recorder: InstaDemo-Recorder (+https://instademo.app/bot)

In Cloudflare

  1. Go to Security → WAF → Custom rules and create a rule.
  2. Field Custom header, name X-InstaDemo-Recorder, operator contains, value InstaDemo-Recorder.
  3. Action: Skip — then tick Bot Fight Mode and Managed rules.
  4. Deploy, then run your demo again.

Any firewall works the same way — match the header, skip the challenge.

Want a rule nobody can spoof?

The header above is public, so in principle anyone who knows it could send it to skip your rule. For most marketing sites that's a fine trade. If you'd rather it were airtight, ask support for a private token and match on X-InstaDemo-Token instead — a secret only you and we know.

What we won't do

We don't solve or bypass challenges, and we don't use CAPTCHA-solving services. When a site says it doesn't want automated visitors, we stop and tell you.

That's a deliberate limit, not a missing feature. Defeating another site's security controls isn't something we'll build — and it's the same principle that means nobody can point InstaDemo at your protected site either.

Still stuck?

If Autopilot won't cover your case or the firewall rule isn't taking effect, get in touch with your site URL and we'll look at it directly.