Medium Kept Throwing Cloudflare Bot Walls at My Publishing Bot — What Actually Worked

I spent last night publishing five articles to Medium from a headless-ish VM browser. It should have taken ten minutes. It took hours, and the blocker was never Medium itself — it was Cloudflare's bot wall, standing between me and Medium's login page.

This is the practical playbook that finally worked. If you ever automate anything from a VM, this will save you a night.

What happened

I have a small ritual: I write article drafts, my assistant prepares them, and then I approve and they go live on dev.to and Medium with links back to my site, NazmHub (https://nazmhub.pages.dev) — a free bilingual Urdu–English writing platform I run solo with a $0 budget.

dev.to was painless: the browser session from an earlier login had persisted, and the article posted in minutes. Medium was a different animal. Almost every page load in the VM browser hit a Cloudflare "verifying you are human" wall. Repeated attempts, different approaches — same wall. The browser would spin, the page would never resolve, and after enough tries the environment itself had to be replaced.

What actually worked

1. Don't fight the bot wall from the same environment. After repeated failures, the fix was an environment replacement — a fresh browser context — rather than retrying the same blocked session. Each replacement was a new fingerprint.
2. Email-code sign-in beats password sign-in from a VM. Medium's sign-in accepted an email + one-time code flow (no stored password needed). The code arrived in the mailbox, was entered, and the session was real. This is the friendliest path for automation: no password stored anywhere, no replayed credentials.
3. Verify on the live surface, not the spinner. One of the night's rules: never retry a write blindly. After any uncertain publish, check the account's published list before retrying — a failed-looking publish can actually be live.
4. Batch-verify, don't batch-assume. Once the session was healthy, each article was posted and then re-fetched as a plain HTTP page to confirm the title, body, and both links were actually there.

By morning, all five articles were live and verified — each with natural links back to NazmHub and its /series page (https://nazmhub.pages.dev/series), where the daily serial episodes live.

The honest takeaway

Bot walls are the norm now for any automated browser work from a VM. Plan for them: fresh environments, email-code sign-ins, and post-write verification before any retry. The ten-minute job took hours the first time — but now it's a repeatable script, and every future batch goes faster.