Ask HN: What's the story with “Checking Connection Security” website loaders?

They're executing javascript to ensure e.g. you're not running in a headless browser. If you loaded the page and ran it in the background then the person making the request already got access to the page content, it's too late.

How does it know that you’re using a headless browser?

Fingerprinting the browser using JS.

Gitlab does this and sometimes it takes 3-5 seconds. But navigating directly to a repository page bypasses this check.

helps prevent fraud, bots, spam, etc without forcing the user to solve a CAPTCHA

How much fraud and spam can I do with read-only access to a website?

Oh but it does use hCaptcha and requires puzzle solving.