Press and Hold CAPTCHA

Who runs the press and hold check

HUMAN and PerimeterX announced their merger on July 27, 2022, which is why older forum threads call this the PerimeterX CAPTCHA. HUMAN’s Human Challenge documentation describes it as a simple press and hold challenge that tracks mouse, touch and keyboard events, with detection coming from its Bot Defender product. It can appear as a full block page, a page the site customized, or a pop-up over the page you were using.

That last form matters for apps and single-page sites. HUMAN’s Advanced Blocking Response applies when a background request asks for JSON: instead of returning an HTML page, the site returns data that tells HUMAN’s script to load the challenge in a modal. If a site seems to stall during a search or an add-to-cart action, a challenge may be waiting in a pop-up that an extension hid.

Why it repeats or will not accept the hold

HUMAN’s documentation says a user who fails cannot move to the next page and is given another challenge. It also lists two error messages worth recognizing. One tells you there seems to be a problem with your browser and asks you to upgrade. The other reports a connection issue and asks you to check that you are online and refresh. The first points at the browser, the second at the network.

The session lives in browser storage. HUMAN’s cookie and storage reference lists _px2 and _px3 for keeping the session, _pxvid for browser detection, _pxhd for server-side detection and pxcts for a session across tabs, with a fallback to local storage when cookies are blocked. HUMAN asks its customers to keep all of these unblocked. If your browser deletes them, or blocks them as trackers, a passed challenge is forgotten.

Fixes, in the order to try them

1. Hold properly once. Press, keep the pointer or finger still on the button until the bar completes, then release. Do not refresh during or right after.
2. Wait a minute before trying again. Rapid repeats look like a script.
3. Allow cookies and site data for the site. Most desktop browsers let you allow one site while keeping your settings for the rest.
4. Turn off script and tracker blockers for the site. HUMAN documents a first-party setup in which its sensor loads from the site’s own domain, so a blocker can break the site’s own pages along with the check.
5. Update the browser or try another mainstream one.
6. Stay on one network. Turn off Wi-Fi assist or automatic switching while you complete the check, and pause a VPN that reconnects.
7. Ask for the accessible version. HUMAN documents an Enhanced Accessibility Mode, certified against WCAG 2.2, that sites can enable. If you cannot hold a button, contact the site and ask whether it is available.

If you meet it while running automation

Treat the challenge as the site’s answer, not as a puzzle to defeat. Background requests that receive a JSON block response should stop and alert a person, not retry in a loop. Retrying the same request immediately is the pattern bot defenses are built to catch. HUMAN gives site owners challenge bypass tokens to test their own configuration, which shows the intended route for legitimate automation: ask the site owner.

A browser under automation reports navigator.webdriver as true under the W3C WebDriver standard, and any page script can read it. HUMAN does not publish which signals it weighs, so do not assume any single change hides automation.

For permitted work through a proxy, keep the exit stable for the whole session. With mobile proxies from Coronium, each line is one device with its own SIM, rented to one customer, and you decide when the IP changes: from the dashboard, through the API, with a rotation link, or on a timer with a 60 second minimum. Rotating between the challenge and the next request recreates the loop described above. The broader guide on why CAPTCHAs keep appearing shows how to separate browser signals from network ones.

Frequently asked questions