Tony Wang5 min readOne CAPTCHA Vendor Shows a Sharper Rank-Tier Gradient Than Anything Else in This Census
Breaking down our census's CAPTCHA rate by vendor reveals a 16x rank-tier gradient - sharper than anything else in this series.
Our original rank-tier post reported a single CAPTCHA number and left it there: 16.9% of reachable sites carry some CAPTCHA widget, full stop. That number is an average of four vendors that don't behave anything alike. Split it apart and the sharpest rank-tier gradient in this entire census series shows up — not in a framework, not in a CDN, in a CAPTCHA vendor almost nobody outside enterprise security teams has heard of.
One aggregate number, four completely different vendors
| CAPTCHA vendor | Top 10K | 10K-100K | 100K-1M |
|---|---|---|---|
| Arkose Labs16.0x top-heavy | 0.08% | 0.036% | 0.005% |
| Cloudflare Turnstileroughly flat | 6.08% | 6.18% | 4.91% |
| reCAPTCHAmildly tail-heavy | 5.35% | 7.56% | 9.33% |
| hCaptcha6.25x tail-heavy | 0.51% | 1.29% | 3.24% |
| Vendor | Top 10K | 10K–100K | 100K–1M | Direction |
|---|---|---|---|---|
| Arkose Labs | 0.08% | 0.036% | 0.005% | 16.0× top-heavy |
| Cloudflare Turnstile | 6.08% | 6.18% | 4.91% | roughly flat |
| reCAPTCHA | 5.35% | 7.56% | 9.33% | 0.57× (mildly tail-heavy) |
| hCaptcha | 0.51% | 1.29% | 3.24% | 0.16× — 6.25× tail-heavy |
Arkose Labs' gradient isn't just the sharpest one in this piece — checked against every rank-tier finding published across this entire census series (frameworks, bot management, LiteSpeed, email providers, certificate authorities, live chat), it's the sharpest single number found anywhere. reCAPTCHA, Google's free and effectively default option, only leans mildly toward the tail. hCaptcha runs a genuinely steep tail-heavy gradient — 6.25×, in the same range as the free live-chat and free-CA findings elsewhere in this series.
The real domains behind the 16x
A spot-check of Arkose Labs' top-tier sites reads like a list of "companies with a bot problem serious enough to justify enterprise pricing": Pinterest, appearing across six separate country-code domains (.pt, .es, .jp, .co.kr, .cl, .nz); TIAA, a major US financial-services and retirement-account company; Zenefits, an HR platform; virtualearth.net, one of Microsoft's own domains. Arkose Labs is priced and positioned for exactly this kind of account — high-value user accounts, sophisticated credential-stuffing and fraud risk, the kind of threat model a small site simply doesn't have.
There's a small irony in the same sample: nopecha.com and solvecaptcha.com — two services whose entire business is defeating CAPTCHAs — also carry an Arkose Labs signature, almost certainly because their own marketing pages reference or demo the exact challenge they're selling a bypass for.
The same company, two products, two opposite rank-tier stories
Cloudflare's own CDN is one of the most reliably tail-heavy findings in this whole census — the parent rank-tier post found it climbing from 20.8% of the top 1,000 sites to 42.2% of the 100K–1M tail. Cloudflare Turnstile, also a Cloudflare product, doesn't follow that pattern at all: 6.08% at the top, 6.18% in the middle, easing slightly to 4.91% in the tail — close enough to flat that it barely counts as a gradient in either direction.
The likely reason is that these are two different kinds of decision wearing the same company's name. A huge share of the CDN number is close to automatic — plenty of hosting setups and platforms route through Cloudflare's free tier by default, which is exactly why it climbs toward the tail alongside every other "default" finding in this series. Turning on Turnstile specifically is not automatic in the same way; a site owner has to decide their site needs bot protection and switch it on. That's a deliberate security decision, even when the tool doing it happens to be free — and deliberate decisions in this census consistently land closer to flat or top-heavy than tail-heavy, no matter what they cost.
Limits, stated plainly
Arkose Labs' counts are the smallest in this piece by a wide margin — 8 domains in the top 10,000, 32 in the 10K–100K band, 41 in the tail, 81 total. Its 16.0× ratio is real and the spot-check backs it up, but read the exact percentage as directional, not decimal-precise, the same caution this census applies to every small-sample cut. As with the original CAPTCHA finding, this is a static-HTML fingerprint, not a challenge-response probe — it detects a CAPTCHA vendor's script or markup on the homepage, not whether a visitor is actually challenged.
Query the full Tech Stack dataset
1,000,000 fingerprinted domains — CDN, CMS, ecommerce, CAPTCHA vendor and more — over one REST API, ranked by Tranco traffic rank.
Frequently asked questions
Which CAPTCHA vendor is most concentrated among high-traffic websites?
Arkose Labs, by a wide margin. In Crawlora's 1,000,000-domain tech-stack census, Arkose Labs runs 0.08% of the top 10,000 Tranco-ranked sites, falling to 0.005% of the 100K-1M tail - a 16.0x top-heavy gradient, the sharpest single rank-tier gradient found anywhere across this census series.
Which companies use Arkose Labs for bot/fraud protection?
A spot-check of Arkose Labs' top-tier domains in this census found Pinterest (across six country-code domains), TIAA (a major US financial services company), Zenefits, and Microsoft's virtualearth.net - consistent with Arkose's positioning as an expensive, enterprise-only account-security challenge for companies with high-value user accounts and serious credential-stuffing/fraud risk.
Does hCaptcha skew toward large or small websites?
Small ones, sharply - the opposite of Arkose Labs. hCaptcha runs 0.51% of the top 10,000 sites, climbing to 3.24% of the 100K-1M tail, a 6.25x tail-heavy gradient.
Why does Cloudflare Turnstile show a flat rank-tier pattern when Cloudflare's CDN is tail-heavy?
Because they represent different kinds of decision. Cloudflare's free CDN is close to an automatic default in many hosting setups, which is why it climbs toward the tail (20.8% to 42.2% in this census's rank-tier post). Turning on Turnstile specifically requires a deliberate decision that a site needs bot protection, which is why it stays roughly flat (6.08% top 10K, 4.91% tail) rather than following the same tail-heavy pattern as Cloudflare's other free-tier products.