Why Am I Getting CAPTCHAs on Every Site? The Captcha Trap

Introduction

If you keep getting CAPTCHAs on every site, it has little to do with how well you spot traffic lights. A bot check asks you to prove you are human when it cannot decide from your request alone, or when the site owner has told it to check everyone who looks like you. For an ordinary person the usual reasons are:

an IP address you share with people who misbehave, such as a VPN, an office network or a mobile carrier
a browser that blocks the check's script or throws away its cookie
an extension that changes what your browser says about itself
a connection that drops in the middle of the check
reloading too fast

The quickest way to tell which one is yours: open the site on a different network, then in a different browser, and see which change stops the checks (step by step below). Most of these causes can also be seen from your own browser, and nearly every one has a matching card in the packet.guru scan.

The Captcha Trap, in One Paragraph

The captcha trap is a CAPTCHA loop: every check you pass is followed by another one. A pass does not last. Depending on the system, it is a one-time proof that the site has to use within minutes, or a cookie that tells Cloudflare you passed and lasts about half an hour by default. None of this removes whatever made you look suspicious. If the cause is your IP address, your browser setup or a cookie your browser throws away, it is still there on the next page, and so is the next challenge.

What It Looks Like When a CAPTCHA Flags You as a Robot

No bot check tells you outright that it has marked you as a bot. You notice it in one of these ways:

Image grids that keep coming. You tick "I'm not a robot" and get pictures to select instead of a green check, then more pictures. That is reCAPTCHA's checkbox moving on to its secondary image challenge, or hCaptcha showing a visual task.
Google Search stops working and shows a page about "unusual traffic from your computer network", with a reCAPTCHA underneath.
A full-page check on a site behind Cloudflare asks you to verify you are human, then reloads into the same check.
An error page appears instead of the site. On Cloudflare, Error 1020 means a firewall rule written by the site owner denied you, and Error 1015 means you went over the site's rate limit.
Nothing visible happens. reCAPTCHA v3 never shows a challenge. It hands the site a score, and a low one can turn into an extra login code by email, a comment held for moderation, or a form that fails without saying why.

How Modern Bot Checks Decide

All three systems run JavaScript in your browser and weigh what it collects together with what they know about the request. None of them publishes a full list of signals, but their documentation shows where a normal person gets caught.

Google reCAPTCHA: A Score the Site Interprets

reCAPTCHA v3 returns a score for each interaction: 1.0 means very likely a good interaction, 0.0 very likely a bot. Google suggests 0.5 as a starting threshold, but the site picks the number and decides what happens below it. Google also advises running the script in the background of many pages, because more context about how visitors behave improves the score. Whatever the version, a pass reaches the site as a token that is valid for two minutes and can be checked only once.

The older v2 checkbox either passes you immediately or opens a challenge. The site has a say here too: a security preference on its key, a slider from "Easiest for users" to "Most secure", sets how strict the check is. One person on one connection can pass instantly on one site and get grid after grid on another.

Cloudflare Challenges and Turnstile: Browser Checks, Not Puzzles

Cloudflare's documentation says its challenges do not use puzzles or "select the objects" tests at all. When a challenge fires, the browser runs checks in the background: proof-of-work and proof-of-space computations, probes of web APIs, and tests for browser quirks and human behaviour. In the Managed Challenge, the mode Cloudflare recommends, the system decides how hard to push from the signals your browser gives off, and most visitors pass without clicking anything. Turnstile is the same platform as a widget inside a page, the box labelled "Verify you are human".

Sites on Cloudflare's paid Bot Management also get a bot score from 1 to 99 for every request, with 30 and above counted as likely human.

Two more details from the docs explain many loops. Site owners can challenge traffic by IP address, by network (its ASN, the number that identifies a provider's network) or by country, with no scoring involved, and Under Attack Mode puts an extra check page in front of the whole site while it is on. Cloudflare also lists two setups its challenges do not support: answering from a different IP address than the one that was challenged, and browser extensions that change the User-Agent or web APIs such as Canvas and WebGL.

hCaptcha: Confidence Plus the Site's Difficulty

The hCaptcha FAQ says how many challenges you have to solve depends on its computed confidence in your humanity, the difficulty the site chose, and other security factors. As with reCAPTCHA, a pass is a one-time token, valid for two minutes by default. Its developer docs, explaining how to force a visual challenge for testing, note that reloading rapidly several times is enough to start seeing them.

In all three, the outcome depends on how your request looks and on how strict the site is, and only the first of those is yours to change.

Why Websites Think You're a Bot: The Common Triggers

A Shared, VPN or Datacenter IP

Google's help page for the "unusual traffic" message lists its causes, and most come down to sharing an address: other people on the same VPN, school or company network, or internet provider sending automated searches, malware on your computer or on another device on your network, and IPv6 tunnel services. Many mobile networks and some home providers use carrier-grade NAT, which puts a large number of customers behind one public address, so one scraper on that address can earn all of them a challenge. VPN and hosting addresses get the hardest time, because one rule can challenge a whole hosting network. What makes an address "dirty" is covered in IP reputation, clean versus toxic.

In the scan, the IP Reputation card names your connection type (RESIDENTIAL ISP, VPN / PROXY, DATACENTER, TOR EXIT NODE, or a relay such as Apple's Private Relay or Cloudflare WARP) and changes to BLACKLISTED if the address appears in public abuse databases. Why a VPN, a proxy, Tor and Private Relay look different to a site in the first place: VPN vs Proxy vs Tor.

Location Signals That Disagree

Your IP points to one place, while your browser's time zone and language list can point somewhere else. A challenge script can read all of these, but no vendor documents how much they weigh, so treat this as a possible factor rather than a confirmed one. One mismatch is ordinary for travellers, expats and VPN users. A clock in one region, languages from a second and an IP in a third is the pattern profiles built with anti-detect software tend to leave. Regional integrity explains which combinations are normal, and time zone mismatch covers the clock.

The Regional Integrity card checks whether your time zone matches your IP's location and whether your language settings agree with each other and with your region, and names what disagrees (TIMEZONE MISMATCH, LANGUAGE MISMATCH, UNUSUAL LANGUAGE, or MULTIPLE FLAGS). The Time Details section puts your device's clock next to the local time at your IP's location.

A Browser That Has Been Altered or Automated

The first problem here is a browser that lies about itself. A User-Agent switcher, or an extension that spoofs canvas or WebGL output, makes the browser claim things the rest of it contradicts, and Cloudflare names exactly these extensions as unsupported. The second is automation: a browser driven by automation software announces it through a flag defined in the W3C WebDriver standard, and Cloudflare's JavaScript detections look for headless browsers. Both are covered in fake browser detection and device integrity.

People who changed nothing can land here too. Antivirus software with HTTPS scanning, and corporate proxies, end your browser's encrypted connection and open their own to the site, so the site sees the proxy's TLS handshake, which may not match the browser named in your User-Agent. TLS fingerprinting with JA3 and JA4 explains the mechanism.

In the scan, Device Integrity checks that browser, operating system and device fit together (findings such as OS MISMATCH, VERSION MISMATCH or BOT DETECTED). Tamper Detection looks for built-in browser functions that have been replaced (FUNCTIONS SPOOFED, GPU SPOOFED). TLS / JA4 Fingerprint compares your handshake with the browser you report and shows ENGINE MISMATCH, or AUTOMATION TOOL when the handshake belongs to an automation library. On Device Integrity and Tamper Detection, the built-in protections of privacy browsers count as protection, not as tampering.

Blocked JavaScript or Cookies

Every one of these checks is a script, so a browser that does not run it cannot pass. Cloudflare's troubleshooting guide and Google's reCAPTCHA help both tell users to make sure JavaScript is on and to try without extensions, because blockers can stop the challenge from loading or from reaching the provider's servers.

Cookies matter for another reason. Cloudflare remembers a solved challenge in a cookie named cf_clearance, which is tied to the device that earned it and lasts 30 minutes unless the site sets another time. A browser that refuses that cookie, or clears cookies on every page load, throws the pass away right after earning it, and the next request is challenged again, however human you look.

The Browser & Device section of the scan shows whether cookies are enabled for the browser as a whole, so a block or auto-delete rule for one site will still read Enabled there. If the cards never get past their scanning state, something is blocking scripts on the page, and the same blocking can stop a challenge script.

Too Fast, Too Often

A site owner can set how many requests a visitor may make in a period, and anyone over it gets Error 1015, with Cloudflare's advice to wait and not retry quickly. Google counts rank-checking software and other automated searches as automated traffic, and hammering reload on a challenge counts against you, as the hCaptcha note above shows. No card measures this: behaviour is judged by each site across your session, and the scan sees one visit.

A Bad or Unstable Connection

None of the three vendors lists a slow line as a bot signal. What hurts is a check that cannot finish. Cloudflare's troubleshooting guide puts "poor or unstable network connections" first among the reasons for repeated challenges, since the browser has to download the challenge, run it and send the answer back. A public address that changes during the check also hurts, for example a phone moving from Wi-Fi to mobile data or a VPN reconnecting through a new exit, because Cloudflare does not support an answer from a different IP.

Malware Somewhere on Your Network

Google lists malware on your computer or on a shared network device among the causes of "unusual traffic". When every device in the house gets challenges, the common factor is the network. Cheap Android TV boxes that turn a home connection into a residential proxy are one known route, described in TV Box Trojan Horse. If that abuse has put your address in public abuse databases, the IP Reputation card shows it.

How to Find Which Signal Triggers It

Change one thing at a time, the same swaps Cloudflare's troubleshooting guide suggests.

Keep the browser, change the network. Load the site over your phone's hotspot. If the challenges stop, the trigger is the network: the IP's reputation, your VPN, or something on your home connection.
Keep the network, change the browser. Try another browser, or a clean profile with no extensions. If the challenges stop, the trigger is an extension, a blocked script or cookie, or a spoofed identity.
Check other devices. If every device on one network is challenged and none are elsewhere, suspect a shared address or an infected device.

Then run the scan. packet.guru cannot see the score Google or Cloudflare gave you, and nobody outside those companies can. The Privacy & Trust Index shows the same families of signals those systems read, from your own browser. Its Trust score ("how genuine you look") drops for masking, forgery, automation and bad IP reputation, and each card names the specific finding.

Trigger	What the bot check sees	Where the scan shows it
Shared, VPN or datacenter IP	An address with a history, or a network the site challenges as a whole	IP Reputation card
Location signals disagree	A time zone that does not fit the IP, or language settings that do not fit each other or the region	Regional Integrity card, Time Details
Spoofed or tampered browser	Claims about the browser that the browser itself contradicts	Device Integrity, Tamper Detection
Automation or HTTPS inspection	An automation flag, or a TLS handshake that belongs to different software	Device Integrity, TLS / JA4 Fingerprint
Blocked scripts or cookies	A challenge that never completes, or a pass that is not remembered	Browser & Device (Cookies, global setting only)
Too fast or repetitive	Too many requests or reloads in a short time	Not measurable from one visit

How to Stop Getting So Many CAPTCHAs

Whatever the cause, stop reloading the challenge and give it a few minutes first. Retrying fast is exactly what rate limits and challenge systems count against you.

Update the browser. reCAPTCHA supports the two most recent major versions of the main browsers, and Cloudflare warns that browsers or systems that have gone more than two years without security updates can have trouble with its challenges.
Let the check run. In your blocker, allow scripts and cookies for the site you are trying to reach and leave it on everywhere else. If your browser clears cookies on every page load, add an exception for that site.
Turn off User-Agent switchers and canvas or WebGL spoofing extensions for that site. Those are the extensions Cloudflare names as unsupported.
On a VPN, pick another server or pause the VPN for that one site, and keep the connection stable while you solve a challenge. Some VPN providers sell a dedicated IP, an address nobody else uses, so its reputation is only yours.
On Apple devices, leave Automatic Verification on. It is on by default on iPhone, iPad and Mac when you are signed in to an Apple Account, and it lets participating sites accept a Private Access Token in place of some challenge steps. Cloudflare notes that some VPNs and managed corporate setups prevent the token.
If every device is affected, scan your computers for malware, check for devices you do not recognise or trust, and ask your provider whether your address is listed for abuse.
If you are blocked outright, the block is a rule the site owner wrote. For Error 1020, Cloudflare's advice is to send the owner a screenshot of the error page so they can find the event in their logs.

Fake CAPTCHA Scams: "Verify You Are Human" Pages and ClickFix

Not every verification page is real. ClickFix is a social engineering technique in use since at least early 2024, which Microsoft Threat Intelligence analysed in August 2025. A fake check imitates Cloudflare Turnstile or Google reCAPTCHA, copies a malicious command to your clipboard in the background when you click it, and then shows "verification steps": open the Windows Run dialog, Windows Terminal or PowerShell, paste, press Enter. Microsoft also documented a macOS variant whose clipboard command asked for the user's password and installed an infostealer, and the payloads overall include password stealers and remote access tools. In August 2026 Microsoft described a newer campaign in which compromised websites showed a fake Cloudflare overlay on top of the page, complete with the logo, a "Verify you are human" checkbox and a spinner, then steered visitors to Windows Terminal or PowerShell.

A real bot check finishes inside the page: a checkbox, a set of pictures, or nothing at all. No real verification asks you to open a system dialog or a terminal and paste something into it. If you already did, treat the computer as compromised: disconnect it, run a full malware scan, and change your important passwords from a different device.

FAQ

Q: Why am I getting CAPTCHAs on every site?

A: Something that travels with you is the cause: your IP address (a VPN, a shared office or mobile address, or one with an abuse history), a browser that blocks scripts or clears cookies, or an extension that changes how the browser identifies itself. Swap the network, then the browser, to see which. If it started all of a sudden, look at what changed: a new VPN or extension, a browser update, or a new device on your network.

Q: Why does Google think I'm a robot?

A: Most of the causes Google lists for its "unusual traffic" page sit on your network: automated searches from others on the same VPN, company or provider network, malware on one of your devices, and IPv6 tunnel services. Solving the reCAPTCHA clears the message. If it keeps returning, check the VPN and the devices at home.

Q: Why does Cloudflare keep asking me to verify I am human?

A: Cloudflare's list is an unstable connection, a setting or extension blocking the challenge script, an unsupported browser, JavaScript turned off, and bot-like signals. A site can also challenge your whole network or country by rule. If you pass and are asked again straight away, check that your browser keeps cookies for that site.

Q: Are you more likely to be mistaken for a bot if you have bad internet?

A: Not for being slow. None of the three big vendors documents speed as a bot signal. A connection that drops or switches networks can stop a challenge from finishing, though, and Cloudflare does not support an answer from a different IP than the one challenged, so you may be asked again.

Q: Does a VPN cause CAPTCHAs?

A: It can. A VPN exit address is shared with many users, some of whom may automate or abuse sites, and a site can challenge a whole hosting network with one rule. Switching servers can help, and a dedicated IP removes the sharing.

Q: Why do I keep getting CAPTCHAs in Incognito mode?

A: A private window does not see the cookies from your normal window, including the one that records a passed check, so the site has nothing to remember you by. Private mode is also the test Cloudflare recommends for ruling out extensions and cached data: if the challenges stop there, one of those is the likely cause.

Q: Why am I getting so many CAPTCHAs on Safari or my iPhone?

A: One possible reason is iCloud Private Relay. When it is on, Safari traffic passes through two relays, and the second one connects you to each site from a temporary IP address instead of yours. Apple notes that without your IP address some websites may require extra steps to sign in or access content, and it warns that sites relying on IP filtering or rate limiting may try to stop you browsing while the relay is on. Apple also describes how to show your IP address to a single site in Safari, or turn Private Relay off for one network with the Limit IP Address Tracking setting. If it is on, the IP Reputation card in the scan names it as your connection type.

Sources

Challenge solve issues, Cloudflare challenges documentation.
How Challenges work, Cloudflare challenges documentation (including the limitations section).
reCAPTCHA v3, Google for Developers.
Resolve Google Search's "Unusual traffic from your computer network" message, Google Search Help.
Think before you Click(Fix): Analyzing the ClickFix social engineering technique, Microsoft Threat Intelligence, August 2025.

System Alert

Which signal is putting you in the trap?

Run the Privacy & Trust Index check and check the IP Reputation, Regional Integrity and Device Integrity cards to see what a bot check sees when your browser arrives.

The Captcha Trap: Why You Are Treated Like a Bot