Just a moment...

This route exists as the false-positive guard for Phase 15's WAF challenge-page detection. Its title contains the exact substring Cloudflare uses on its challenge interstitial (“Just a moment...”), but everything else about the page is a legitimate editorial article. Real body, real <main>, no <noscript> demanding JavaScript, no WAF-provenance headers.

Why this page must not be marked blocked

A challenge-page detector that fires on the title alone would over-fire on every legitimate article whose author decided to open with “Just a moment...” — a common editorial device. The false-positive cost is worse than the miss cost: a missed challenge produces disputable findings, but a false-positive block wipes every finding on the URL and leaves the customer with nothing.

What the detector actually checks

Header-layer detection runs first: if the response carries cf-mitigated, x-vercel-mitigated, or a bounded set of equivalent provider headers, the block is high-confidence regardless of body content. Body-layer detection is a fallback for the rare case those headers are stripped by an intermediate proxy — and it requires corroboration: the body must also be small, or demand JavaScript in a <noscript>, or lack any <main> / <article> region. This page has a large body, no JS demand, and a proper <main>, so none of the corroborators fire.

Editorial content for size

To make the false-positive guard robust, this page must be large enough that the body-shape corroborator body under 8 KB doesn't fire. Editorial padding follows. If you removed this section the plant would still not fire (the other corroborators are also absent), but keeping the body clearly above the size threshold is what makes the plant faithful to a real content page. A crawler that reaches a genuine article page and reads a large body with real HTML structure should never conclude “this is a WAF challenge.” The detector's job is to catch challenges, not to police page titles.

Consider the shape of a real challenge page. Cloudflare serves a body of a few kilobytes at most, dominated by a spinner GIF and a <noscript> block explaining that JavaScript is required to prove the client is a browser. Vercel's Security Checkpoint is similar in structure: a small body, a <noscript> block, no <main> region. Akamai's Bot Manager interstitial carries a “Reference #” UUID and a link to the customer's WAF policy page. DataDome shows a captcha shell. Each is a chrome-heavy, content-light response — the opposite of an editorial article. The corroboration rule generalises across providers because their challenge shapes converge on that same lean interstitial pattern.

By contrast, this page has structural content, several paragraphs of real prose, and no client-side gating. The detector must treat it as normal content. The manifest for this route (in the SEO repo's tests/fixtures/defect_manifest.yaml) lists it under clean with the full phase_2e_full_check_list, so no fail or warn verdict may land on it — including from L18.CRAWLER_ACCESS, which reads the corpus summary of blocked artefacts and reports the crawler- access story at site scope.