What is CAPTCHA?

The flow is the same across vendors. A JavaScript widget loads on the page and collects signals, then produces an opaque token that the form submits alongside the user's data. The site's backend posts that token plus its secret key to the vendor's verification endpoint, and gets back a pass or fail with some metadata. Tokens are single-use and short-lived, expiring in around two minutes, so a scraper that harvests a token and replays it later gets a duplicate-or-timeout error instead of access.

reCAPTCHA v2 shows the checkbox and falls back to an image grid when the risk score is poor. v3 never interrupts; it returns a score between 0.0 and 1.0 and leaves the site to decide what a 0.3 deserves. hCaptcha and Turnstile follow similar models, with Turnstile leaning harder on non-interactive checks. All of them weigh roughly the same inputs, from IP reputation and ASN to cookies left by earlier sessions with that vendor, TLS and HTTP/2 fingerprints, pointer and keyboard timing, and how ordinary the browser environment looks.

Challenge frequency is driven more by the request pattern than by any single control. Hitting a hundred product pages a minute from one address, or sending a TLS handshake that no shipping browser produces, will raise the rate on its own. Address space plays a part as well. Datacenter ranges are cheap to buy and easy to classify by ASN, while mobile carrier addresses sit behind CGNAT and are shared with ordinary subscribers, which makes wholesale penalties expensive for the vendor applying them.

Third-party solving services exist, routing challenges to human workers or to their own models and returning a token over an API. They add seconds of latency and a per-solve cost, and they do nothing about the signals that triggered the challenge in the first place. Teams that get their challenge rate down usually do it by fixing the fingerprint and slowing the pace, then holding one address long enough that the traffic reads as a visit rather than a sweep.