How a CAPTCHA works
A CAPTCHA embeds a small widget in the page, tied to the site by a public site key. When the widget decides you have passed - because you clicked the right images, or because your behavior scored as human - it issues a token: a long, opaque string. The page attaches that token to its next request, and the site's server checks it against the CAPTCHA provider's API before letting the request through. Older CAPTCHAs put a visible puzzle in front of you. Newer ones (reCAPTCHA v3, Cloudflare Turnstile) are invisible: instead of a puzzle they watch signals like mouse movement, timing, browser fingerprint, and IP reputation, then hand out a risk score. A high score passes silently; a low score triggers a fallback challenge.
Types of CAPTCHA
The main families are text CAPTCHAs (type the warped characters), image CAPTCHAs ("select all squares with a bus"), checkbox CAPTCHAs (the reCAPTCHA "I'm not a robot" tick, which is really a behavioral check disguised as a click), slider or puzzle CAPTCHAs (drag a piece into place), and invisible or scored CAPTCHAs that show nothing unless you look suspicious. The trend is away from puzzles a human finds annoying and toward silent scoring, because the puzzle itself was never the real test - the real test is whether the surrounding signals are consistent with a genuine browser session.
Why CAPTCHAs matter for web scraping
A CAPTCHA is the most visible layer of bot defense, and most non-trivial scraping projects meet one eventually. Hitting one stalls the request until the challenge is resolved. The durable approach is to not trigger it in the first place by behaving like ordinary traffic: use quality residential proxies, send a coherent browser fingerprint, keep request rates moderate, and reuse session cookies so repeated visits share one consistent session rather than appearing as a thousand strangers. When a challenge does appear, a CAPTCHA solver completes it and returns a token. Note the distinction: the CAPTCHA is the test, the solver is the software that completes it. A managed scraping API focuses on the durable side — minimizing the challenges that appear in the first place through quality proxies, coherent fingerprints, and human-paced requests.