If a website in Russia loads halfway, hangs on a white screen, or disconnects with a connection error, but works fine with a VPN, it is likely due to traffic restrictions to Cloudflare. A significant portion of foreign websites operates through Cloudflare. Since June 9, 2025, Russian providers have been cutting connections to it, allowing only the first 16 KB of each page file to load. By the end of October 2026, NextDNS was also blocked, and in the summer of 2026, issues began with encrypted DNS from Cloudflare and Google. Below, we will discuss how to determine if this is the case, what can be fixed with settings in five minutes, and when a proxy outside of Russia can help.
What Happened and Who It Affects
Cloudflare is a network through which websites distribute pages, images, and scripts while protecting themselves from bots. Users typically do not know that a website is behind Cloudflare. Therefore, it appears as if "the internet is selectively broken": some websites load while others do not.
Chronology from open sources:
- June 9, 2025. Cloudflare announced on its blog that Russian providers are restricting access to websites protected by it: only the first 16 KB of each resource loads, after which the connection drops or hangs. The restriction affects HTTP/1.1, HTTP/2, and HTTP/3 (QUIC). The company named Rostelecom, MegaFon, Beeline (VimpelCom), MTS, and MGTS.
- July 2025. Roskomnadzor, according to "Kommersant" and "Interfax," stated that no measures against Cloudflare were taken and again recommended website owners to leave this CDN and disable the TLS ECH extension.
- August 2026. Subscribers of Rostelecom, Dom.ru, Tattelecom, and St. Petersburg's SkyNet complained that encrypted DNS (DoH and DoT) at addresses 1.1.1.1 and 8.8.8.8 stopped working: the connection establishes and drops at the moment of encryption.
- End of October 2026. NextDNS stopped working. A representative of the service on the support forum replied that its IP addresses and TLS names were blocked, and the company does not intend to bypass the restriction.
Ordinary users who access foreign websites, developers who need documentation and packages behind Cloudflare, and anyone who manually enabled "Private DNS" or NextDNS on their phone or router are affected.
How to Determine if Cloudflare is the Culprit
Typical signs include:
- the page loads without styles and images or remains blank, although the tab title has appeared;
- the browser shows ERR_CONNECTION_RESET, ERR_TIMED_OUT, or ERR_QUIC_PROTOCOL_ERROR;
- the behavior differs between mobile internet and home Wi-Fi: restrictions work differently with various operators;
- the same website opens immediately with a VPN or from another country;
- nothing opens at all, and "Private DNS" or NextDNS is enabled on the phone — this indicates a DNS issue, not a website issue.
A quick check: open the address site/cdn-cgi/trace (for example, example.com/cdn-cgi/trace — substitute with the desired domain). If you receive a short text with the lines fl=, colo=, and loc=, the website is operating through Cloudflare. If this page does not load either, and everything is fine with non-Cloudflare sites, the situation is almost definitive.
Why Changing DNS Doesn't Help
A common piece of advice is to "set DNS to 1.1.1.1 or NextDNS." Currently, this does not work and can even be detrimental. The 16 KB restriction activates on the path from you to Cloudflare's servers, after the website address has been found. Cloudflare explicitly states that the connection breaks within the Russian network, even if it reaches its servers abroad. Changing to a correct DNS does not alter this.
Moreover, encrypted DNS has become a target itself. If a "Private DNS" with the NextDNS or Cloudflare address is set on the phone, and that address is blocked, the device cannot resolve the IP of any website, resulting in a complete loss of internet access. The network icon continues to show a connection, however.
What a Proxy Solves and What It Doesn't
When you work through a proxy outside of Russia, the provider sees the connection not to Cloudflare's address but to the proxy server's address. The proxy then sends the request to the website from a network without restrictions. The website responds to the proxy, which then delivers the entire page to you.
| Situation | Will a Proxy Help |
|---|---|
| A foreign website behind Cloudflare loads halfway or disconnects | Yes, if the proxy is located outside of Russia |
| The website does not open due to blocked NextDNS or DoH | First, revert to automatic DNS. In the browser with the proxy, the proxy itself searches for the website address |
| Documentation, packages, and API behind Cloudflare in the terminal | Yes, via HTTPS_PROXY and HTTP_PROXY variables |
| Voice calls and online games where traffic goes over UDP | No, HTTP proxy only transmits TCP traffic |
| Russian websites and government services | No. Some of them are closed to foreign IPs, and they need to bypass the proxy |
| Banks and payment services | No. Such websites are unavailable through the proxy |
A fair disclaimer: a regular HTTP proxy does not encrypt the channel from you to itself; it only encrypts the connection to the website within it. Currently, the restriction described by Cloudflare is tied to its addresses, which is why the proxy bypasses it. However, no one can guarantee that filtering methods will not change. For more details on how DNS spoofing differs from a proxy, see the article Smart DNS or Proxy: What to Choose for Bypassing Restrictions.
Step-by-Step Instructions
- Remove the blocked DNS. On Android: "Settings" → "Network and Internet" → "Private DNS" → "Automatic" or "Off." On iPhone, delete the NextDNS profile or another DNS profile in "Settings" → "General" → "VPN & Device Management." On Windows and the router, revert to automatic DNS from the provider. If the internet is completely lost, it will return after this step.
- Check a specific website. Open /cdn-cgi/trace on its domain. If the address only responds with a VPN, the issue lies with Cloudflare's restrictions.
- Get a proxy in a neighboring country. For minimal latency, European countries are suitable. Russia does not need to be in the geo settings: a Russian IP will return you to the same restrictions.
- Configure the proxy only in the browser. The easiest way is to use a proxy switch extension (for example, SwitchyOmega or FoxyProxy) or a separate browser profile. Enter the host, port, username, and password from your account.
- Enable the proxy only for necessary websites. In the extension, set rules: foreign domains go through the proxy, while Russian websites, banks, and government services go directly. This way, you do not waste traffic on everything and do not break websites that are closed to foreign IPs.
- For the terminal, set environment variables. For example, export HTTPS_PROXY=http://username:password@host:port — this way, curl, pip, npm, and git will go through the proxy over HTTPS.
- Check the result. Open /cdn-cgi/trace again: the loc= line should show the proxy's country, and the website should load completely.
What Type of Proxy is Suitable
Cloudflare not only distributes websites but also protects them from bots. The addresses of its data centers are checked more strictly by its anti-bot system, which is why the "Verify you are human" window appears more frequently on them.
- Residential Proxies ($2.70 per GB) — the primary option. These are addresses from home providers, and websites behind Cloudflare treat them as regular visitors, resulting in fewer CAPTCHAs.
- Mobile Proxies ($3.80 per GB) — if the website is particularly picky or access is needed from mobile applications that can work through a proxy.
- Data Center Proxies ($1.50 per GB) — for documentation, packages, and API, where anti-bot is usually not enabled and traffic cost is important.
All three types work over HTTP and HTTPS: this is sufficient for browsers, downloads, and most applications. Voice calls and online games over UDP will not work through such a proxy.
Common Mistakes
- Changing DNS in circles. 1.1.1.1, 8.8.8.8, NextDNS — the 16 KB restriction does not disappear from this, and a blocked encrypted DNS completely disables the internet.
- Choosing a Russian IP. A proxy in Russia goes through the same networks and faces the same restrictions.
- Routing all traffic through the proxy. Videos and updates will consume gigabytes, and Russian services will start denying access to foreign addresses. Domain rules are needed.
- Expecting calls and games to work. HTTP proxies transmit web traffic; they do not carry UDP.
- Confusing Cloudflare restrictions with a website being blocked. If a website responds with error 1020 or 1005 with a Cloudflare page, this is a rule from the website owner against your IP, not a Russian provider issue. Here, a different IP is needed, not a bypass of filtering.
Conclusion
Half-loaded pages and disconnections on foreign websites in Russia are a result of traffic restrictions to Cloudflare that have been in place since June 2025. The blocking of NextDNS and encrypted DNS has added a problem where nothing opens at all. The first step is to revert to automatic DNS. The second is to route necessary websites through a proxy outside of Russia with domain rules. For most websites behind Cloudflare, the most convenient option is ProxyCove Residential Proxies: payment per gigabyte, country of choice, and setup in the browser in just a few minutes.