hCaptcha: How It Blocks Web Scrapers

hCaptcha is a CAPTCHA service built as a privacy-focused alternative to Google's reCAPTCHA. Visitors it isn't sure about are asked to pick the images that match a prompt. Cloudflare used it for its challenges until it replaced it with its own Turnstile in 2022, and it is still common on sites that prefer not to send their visitors' data to Google.

hCaptcha is not in our benchmark yet. None of the targets we scrape every month shows it. So there is no success rate, speed or cost to rank here. When a target that hCaptcha blocks joins the benchmark, this page will rank web scraping APIs against it the same way as our Cloudflare and AWS WAF CAPTCHA pages.

How hCaptcha detects bots

Image challenges. The visible part is a grid of images and a prompt. The challenges change often and are built to be hard for image-recognition models, which raises the cost of solving them by machine.

Passive signals. Before any challenge, the hCaptcha script looks at the browser and the way the visitor interacts with the page. Its Enterprise plan can run without a visible challenge for most visitors and give the site a risk score instead.

A token checked on the server. A passed challenge produces a token (h-captcha-response) that the site's server verifies with hCaptcha before it accepts the request.

Scraping APIs and hCaptcha

Like reCAPTCHA, hCaptcha mostly guards forms and sign-ups. Where it sits in front of a page, what helps a scraper is not being challenged in the first place: a real browser, a clean residential IP and a consistent fingerprint.

Frequently asked questions about hCaptcha

Which web scraping API is best for hCaptcha?

We don't know yet, because none of our benchmark targets shows hCaptcha. We only publish rankings we have measured.

Is hCaptcha harder than reCAPTCHA?

Its image challenges are built to be hard for machine solvers, while reCAPTCHA v3 leans on an invisible score. Which one is harder depends on how each site sets it up.

Does Cloudflare still use hCaptcha?

No. Cloudflare replaced hCaptcha with its own Turnstile challenge in 2022.

Benchmarked anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · AWS WAF CAPTCHA · Castle  ·  Hub: All anti-bot benchmarks