CAPTCHA / challenge · Google
Google reCAPTCHA
Difficulty 3/5
A challenge layer rather than a perimeter. v3 scores silently in the background; v2 shows the checkbox everyone knows.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: high
How it decides
-
A risk score from browsing history, cookies, address reputation and interaction telemetry.
-
v3 returns a 0.0-1.0 score to the site, which decides what to do with it.
-
Google account state materially raises the score — a logged-out datacenter address starts low.
What you see when it stops you
- `www.google.com/recaptcha/api.js` in the page
- A `g-recaptcha` element
- An invisible badge in the corner
Signatures the detector matches
Publicly observable artefacts Google reCAPTCHA sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Page markup | reCAPTCHA script | 70 |
| Page markup | reCAPTCHA widget | 55 |
What actually gets through
-
Residential exits. reCAPTCHA weighs address reputation heavily and datacenter ranges score near the floor.
-
A real browser with a persistent profile; cookie history is part of the score.
-
Treat it as a scoring layer — find out what the site does with a low score before assuming you are blocked.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.