reCAPTCHA: How It Blocks Web Scrapers

reCAPTCHA is Google's CAPTCHA service and the most widely deployed one on the web. Most people know it as the “I'm not a robot” checkbox and the grids of traffic lights and crosswalks that follow, but its newer versions don't ask anything: they score each visit in the background and leave the decision to the site.

reCAPTCHA is not in our benchmark yet. Two of our targets load it, LinkedIn and Realtor.com, but on their forms (sign-in, contact, sign-up), not in front of the public pages we scrape. So there is no success rate, speed or cost to rank here. When a target that reCAPTCHA blocks joins the benchmark, this page will rank web scraping APIs against it the same way as our Cloudflare and AWS WAF CAPTCHA pages.

The versions of reCAPTCHA

reCAPTCHA v2. The checkbox, followed by an image challenge when Google isn't sure about the visitor. An invisible variant runs the same check when a form is submitted, without the checkbox.

reCAPTCHA v3. No challenge at all. Each action on the page gets a score from 0.0 (very likely a bot) to 1.0 (very likely human), and the site chooses what to do with a low score: block it, ask for another check, or just log it.

reCAPTCHA Enterprise. The paid version in Google Cloud, with the same score plus reasons for it, account-level protection and tuning to the site's own traffic.

How reCAPTCHA detects bots

Browser and behavior signals. The reCAPTCHA script collects details of the browser and how the visitor moves, types and clicks, and weighs Google's own history of that browser through its cookies. A fresh headless browser with no history and mechanical input scores low.

A token checked on the server. A passed check produces a token (g-recaptcha-response) that the form sends with the request, and the site's server verifies it with Google. Tokens expire after two minutes and can only be used once, so they can't be collected and reused.

Scraping APIs and reCAPTCHA

Because reCAPTCHA usually guards forms rather than pages, a scraper reading public pages rarely meets it. Where a page itself is behind it, an API that runs a real browser with a clean, residential IP and a consistent fingerprint gets a better score and fewer challenges. Solving the image puzzles is a separate job, which is done by CAPTCHA-solving services rather than scraping APIs.

Frequently asked questions about reCAPTCHA

Which web scraping API is best for reCAPTCHA?

We don't know yet, because none of our benchmark targets puts reCAPTCHA in front of the pages we scrape. We only publish rankings we have measured.

What is the difference between reCAPTCHA v2 and v3?

v2 shows a checkbox and, when unsure, an image challenge. v3 never shows anything: it gives each action a score from 0.0 to 1.0 and lets the site decide what to do with it.

How long is a reCAPTCHA token valid?

Two minutes, and only once. The site's server verifies it with Google, so tokens can't be collected in advance and reused.

Benchmarked anti-bots: Cloudflare · Akamai · DataDome · PerimeterX · Kasada · AWS WAF CAPTCHA · Castle  ·  Hub: All anti-bot benchmarks