CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a challenge — an image grid, a checkbox, or an invisible behavioral check — that a site shows a visitor it suspects might be a bot, before letting the request through.
Google's reCAPTCHA v2 (the "I'm not a robot" checkbox, sometimes followed by image grids) and reCAPTCHA v3 (a fully invisible score from 0–1 based on behavior, with no user-facing challenge at all) are the most widely deployed. hCaptcha works similarly and is common on sites that don't want to send data to Google. Cloudflare Turnstile is a newer, privacy-focused invisible check used across a large share of Cloudflare-protected sites.
None of these actually need a human to solve anything in most real traffic — v3-style and Turnstile-style checks pass silently for visitors whose browser fingerprint, IP reputation, and behavior look ordinary. The visible puzzle only shows up when the underlying bot score already looks suspicious.
CAPTCHA challenges are triggered by the same signals as any anti-bot system: datacenter IP ranges, missing or inconsistent browser fingerprints, unusually regular request timing, and poor reputation for the IP or ASN. A scraper that looks close enough to ordinary browser traffic — consistent fingerprint, residential IP, human-like pacing — triggers CAPTCHA far less often, which is a more sustainable strategy than solving every challenge that appears.
Third-party CAPTCHA-solving services exist, both ML-based solvers and human-solving farms, but they add latency and cost per request, and using them against a site's terms of service can carry legal and account-level risk depending on jurisdiction and use case.
How Crawlora handles this
Crawlora's stealth browser-rendering tier is built to keep requests below the fingerprint and behavioral thresholds that trigger a challenge in the first place — consistent device fingerprints, residential IP matching, and realistic navigation — rather than solving CAPTCHAs after the fact.
Related reading
Glossary
FAQ
Something about your traffic pattern crossed the site's bot-detection threshold — a new datacenter IP, faster request pacing, a browser fingerprint mismatch, or simply enough cumulative volume from the same IP. It's a signal to slow down or change your IP or fingerprint, not a permanent block.
It depends on jurisdiction, the site's terms of service, and what data you're accessing — courts have reached different conclusions in different cases. Treat it as a legal and ethical question specific to your use case, not a purely technical one.
Crawlora's approach is prevention-first — matched residential IPs and realistic browser fingerprints that avoid triggering a challenge — rather than paying to solve one after it appears.
Browse Crawlora APIs, test a request in Playground, and move from scraping infrastructure work to production data workflows.