Study: 3.67% of sites in Alexa 1,000 are either blocking or presenting CAPTCHAs to Tor users, often carried out by CDNs like CloudFlare or Akamai
Tor users blocked or faced with CAPTCHA if IP address matches known exit node — Tor users blocked or faced with CAPTCHA if IP address matches known exit node.
Context & Ripple Effects
This study is the measurement that set up the year's defining fight over Tor access. Weeks after it found 3.67% of Alexa 1,000 sites challenging Tor visitors — with the enforcement point sitting at CDNs like CloudFlare and Akamai rather than at individual publishers — CloudFlare claimed 94 percent of the Tor traffic it sees is malicious, effectively citing the abuse side of the ledger this study quantified.
The dispute escalated fast: Tor publicly challenged the figure as likely flawed methodology in its rebuttal demanding an explanation, and years later the security picture darkened further when over a quarter of Tor's exit node capacity was twice found to be known-malicious in 2021. The 3.67% figure matters because it shows blocking decisions being made by infrastructure providers, not by the sites themselves.
First-order effects
- Tor users hitting Alexa 1,000 properties face CAPTCHA walls or outright blocks whenever their exit node IP is recognized, with CloudFlare- and Akamai-fronted sites doing most of the challenging.
Second-order effects
- Publishers effectively outsource their Tor policy to two CDN vendors' reputation lists, so a change in CloudFlare's or Akamai's default handling shifts access for thousands of sites at once — which is exactly how CloudFlare's blanket 'malicious traffic' framing became a site-wide policy without per-site decisions.
Third-order effects
- Access to the anonymous web becomes a function of CDN-layer reputation scoring rather than site-level choice, concentrating the anonymity-versus-abuse tradeoff in a handful of intermediaries whose methodology Tor can contest but not control.
The trend: Web access control is consolidating at the CDN layer, where exit-node reputation systems — not publishers — decide whether anonymous users get through.