Casting lovelace dashboard suddenly fails due to cloudflare bot challenge

Configuration Frontend
, ,
1

I have a script that casts a dashboard to a local pixel tablet. I have used it for years now without problem, but the last few days the dashboard fails to cast and instead I see a bot challenge from cloudflare for cast.home-assistant.io. Any idea why this happened in the last few days? I had not made any changes to HA, not even updating to the latest versions. I did try updates after the failure started, but that didn’t solve the problem.

Here is the cast snippet from the script:

 - service: media_player.play_media
      target:
        entity_id: media_player.pixel_tablet
      data:
        media_content_id: coffee-brewboard
        media_content_type: lovelace
      metadata:
        title: Coffee Brewing
        # thumbnail: https://brands.home-assistant.io/_/lovelace/logo.png
        media_class: app
        children_media_class: null
        navigateIds:
          - {}
          - media_content_type: lovelace
            media_content_id: ""

Note that I commented out the thumbnail - I am not sure why that was even there, but removing that did not resolve the problem. I am not even sure what resource is causing this challenge - any ideas on how to figure that out?

I also tried casting from cast.home-assistant.io and I get the same problem.

2

There have been several issues about this opened recently on github. Must be some wide change.

3

Ah, I had not thought of actually looking for bug reports. Looks like Cloudflare serves a managed challenge to all Cast devices on cast.home-assistant.io (403 cf-mitigated: challenge) · Issue #53730 · home-assistant/frontend · GitHub - I will go ahead and subscribe to that. Thanks!

4

I think Cloudflare is protectively challenging everything Home-Assistant.io right now, even the forums where I have constant interruptions.

Either the servers are having performance issues, or more likely the AI bots are hammering them in their endless thirst for knowledge.

Something out of our control at this stage but I’m certain they are tweaking in the background.

Maybe one of the mods will give us an update on what is happening, as the status page shows everyrhing back to normal a few days ago after a DDOS attack, but I can vouch it isn’t.

Scroll down a bit for history.

5

It ended days ago, the captcha was removed days ago as well.

6

And as of this morning it is working again. It’s a funny bug since HA kind of is a bot.

7

Captchas are back. So are refusals and connection errors.

8

They are not. :man_shrugging:

Literally talking with the guy who enabled/disabled them.

9

They just happened again a few minutes ago. Both refusal to display due to a connection error screen, and a cloufflare tick the box you’re not a bot screen. No captcha this time.

10

Will VPNing from Azerbejan make a difference? LA? London? It seems to be universal, VPN or not, not location dependant.

11

It is not on, it was turned off 2026-08-21T06:41:00Z