A captcha bot tries to solve or sidestep tests meant for humans so a script can continue into forms, checkouts, or account actions.
It is automation aimed at the test itself, which is different from a person being paid to solve the same test by hand.
How it works
Some bots send the challenge to an outside helper, and some try to answer from the page alone, yet either way the operator wants volume without a real visitor pausing to complete the test.
Sites see the result as sessions that clear a gate and then behave at a speed or a repetition no person sustains.
Defenses work better when the test is only one cost among others, including behavior, identity, and limits on sensitive actions.
A test that never changes, or that is skipped for every client that looks slightly normal, becomes a speed bump with a well known detour.
Concrete examples
- A script reaches a checkout challenge, clears it without a visible pause, and then opens dozens of orders in a minute.
- Many sessions fail the test in the same way and at the same interval, showing a solver that is still tuning.
- A small share of sessions pass the test and then immediately repeat a password guess, which is not how a person recovers an account.
Protective measures
- Treat a passed human test as one signal, and still limit sensitive actions that follow it.
- Change and layer checks so a single solver cannot be reused unchanged for months.
- Watch for passes that are immediately followed by repetitive account or payment actions.
- Measure both automated success and real customer failure so the test does not become a barrier to honest buyers.
How CDPCaptcha helps
Browser proof of work adds computation to each automated solving attempt, so a scripted solver spends more resources every time it faces a challenge.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.