Why You Keep Getting CAPTCHAs

When the IP address is the cause

Many CAPTCHA systems weigh the address a request comes from. That address is often not yours alone. Google’s unusual traffic help page lists the usual suspects: other people on a school or office network, other users of the same VPN, other customers of the same internet provider, tunnel services and malware on a device behind the same connection.

Carrier networks add another layer. Mobile operators place many subscribers behind a smaller pool of public addresses using carrier-grade NAT, and RFC 6598 even reserves a dedicated block, 100.64.0.0/10, for the inside of that arrangement. The IETF’s review of address sharing, RFC 6269, states the consequence plainly: penalty-box defenses that punish an address do not work well when many users share it, because one user’s failed attempts can lock out the others.

Typical IP signals that raise CAPTCHA rates:

• a VPN or hosting address, which reputation databases label as such
• an address listed on public abuse feeds because someone else used it badly
• an address that sent a burst of traffic recently, even if that traffic was not yours
• an address whose country does not match your browser language or time zone

You can see what a public feed says about your current address with our IP reputation check, and which network announces it with the ASN lookup. Neither shows a website’s private score, which is the number that actually decided to challenge you.

When the browser is the cause

Challenge systems remember that you passed. If the browser cannot keep that memory, you pass again and again. Cloudflare’s description of how its challenges work relies on a JavaScript snippet that gathers client-side signals; a script blocker that stops it leaves the site with less evidence, not more privacy for the same result.

Common browser causes:

• Cookies blocked or wiped on exit. A passed check is usually stored as a cookie. Without it, every visit starts from zero.
• Scripts blocked. The check cannot run, so the site falls back to a visible puzzle or a block.
• Extensions that rewrite pages. Ad, privacy and translation extensions can break the widget or alter the signals it reads.
• An old browser. Vendors support recent versions; older ones may fail silently.
• Automation. Under the W3C WebDriver standard, a browser controlled by automation sets navigator.webdriver to true, and any page script can read it.

Some devices see fewer CAPTCHAs by design. Apple added Private Access Tokens to iOS 16 and macOS Ventura so a site can confirm a legitimate device without learning who you are. Sites that accept them show fewer puzzles to supported Apple devices, which is one reason the same page can behave differently on your phone and your laptop.

When the request pattern is the cause

A person reads, scrolls and clicks at an uneven pace. Scripts, refresh loops and a dozen tabs opened at once do not. Pattern problems show up as CAPTCHAs that start after a few minutes of activity and fade after a pause.

Continuity matters as much as speed. Cloudflare’s documentation is explicit that a challenge received on one IP and solved from another is not valid, and that this causes a loop. The same logic applies to most vendors: the proof you earn belongs to the connection that earned it. A VPN that reconnects, a phone moving between Wi-Fi and mobile data, or a proxy that rotates its exit mid-visit all reset that proof.

If you use a Google property and see the unusual traffic page, the cause is almost always pattern or shared-IP related. If a site uses an invisible score, the reCAPTCHA v3 guide explains what that score reacts to.

A four-step test to find the cause

Run these in order and stop when the CAPTCHAs stop. Each step changes one variable.

1. Same browser, different network. Turn Wi-Fi off and use mobile data, or the reverse. If the puzzles stop, the address was the problem.
2. Same network, clean browser profile. Create a new profile with no extensions and default cookie settings. If the puzzles stop, the browser was the problem.
3. Same setup, slower pace. One tab, no auto-refresh, no background scripts for ten minutes. If the puzzles fade, the pattern was the problem.
4. Check the address. Note your public IP on What is my IP and look it up on the reputation check. A listing explains the IP case; a clean result does not rule it out, because sites use their own data.

Write down the time and the IP of each test. If you contact a site’s support, that record lets them find your requests.

Fixes for people, scrapers and proxy users

For everyday browsing. Keep cookies for the sites you use, allow their scripts, update the browser and turn off the VPN for sites that challenge it constantly. If one vendor’s widget never loads, the hCaptcha guide and the press and hold guide cover the vendor-specific failures.

For scrapers. CAPTCHAs are the site telling you it noticed. Read the terms, use an official API or data feed where one exists, cache what you already fetched and cap concurrency. Keep cookies between requests so a passed check is reused instead of repeated. Treat a challenge as a signal to slow down, not as an obstacle to retry against.

For proxy users. Most loops come from the exit address changing during a session. Use a session that keeps one address for as long as the task runs. With mobile proxies from Coronium, each line is one physical device with its own SIM, rented to one customer, so the address history is not mixed with other customers’ traffic. You change the IP from the dashboard, through the API, with a rotation link or on a timer with a 60 second minimum. Two habits prevent most loops:

• set the timer longer than your longest session, or rotate by hand between tasks
• keep the rotation link out of chat apps and documents with link previews, because the link rotates on every GET request, including the preview fetch

A fresh address does not promise a visit without challenges. Carrier addresses are shared over time, so a new one can carry history from a previous subscriber; the address you get is still governed by each site’s own rules.

Frequently asked questions