Solve CAPTCHAs. Or skip them entirely.

CAPTCHA-solving is a fallback, not a strategy. The 2024–2026 generation of bot detection (Turnstile, reCAPTCHA v3, AWS WAF) rarely shows a challenge UI; instead, it scores every request continuously on JA4 + IP + behaviour + browser internals. A “CAPTCHA” only appears when the score crosses a threshold. The reliable, cheap, fast path is keeping the score below threshold so no challenge ever fires.

Each major family, what triggers it, and how it gets resolved inside a scraping pipeline.

Two solve paths. The router picks based on what the site actually serves.

Server-side (free, ~1–3s)

Turnstile, reCAPTCHA v3, AWS WAF, DataDome score-paths, and most GeeTest puzzles all run inside the browser. A real Chromium with patched anti-detection executes the challenge JS and returns the resolved page. No human in the loop, no extra cost, no extra latency budget worth caring about.

Human-loop (1–2 extra credits, ~8–15s)

reCAPTCHA v2 image puzzles, hCaptcha image puzzles, and DataDome’s slider fallback can’t be cleanly automated. When they actually appear, a vetted human-loop service solves them. Server-side is attempted first; humans only get involved if the page genuinely renders the challenge UI.

Every response includes a captcha object so you can audit which sites cost human-loop credits and tune your config per-target. The four metrics below are what we ourselves watch in dashboards; the dashboard exposes them as time-series.

{
  "success": true,
  "credits_used": 6,
  "fetch_path": "premium",
  "captcha": {
    "encountered": true,
    "type": "cloudflare_turnstile",
    "method": "browser_solve",
    "extra_credits": 0,
    "solve_ms": 1840
  }
}

We refuse some kinds of CAPTCHA-solving. Not because the technical path is harder, but because the CAPTCHA is doing the job it was designed to do — gating consent, authentication, or rate-limited public goods. Automating past it crosses from data extraction into impersonation.

Avoid CAPTCHAs in the first place (recommended)

import requests

response = requests.get(
    'https://api.example.com/scrape',
    params={
        'url': 'https://target-site.com',
        'js': 'true',
        'stealth': 'true',
        'premium_proxy': 'true',
        'proxy_country': 'US',
    },
    headers={'ApiKey': 'YOUR_API_KEY'},
)
print(response.text)

Auto-solve as a safety net

curl -X GET 'https://api.example.com/scrape' \
  -H 'ApiKey: YOUR_API_KEY' \
  -G \
  --data-urlencode 'url=https://protected-site.com' \
  --data-urlencode 'js=true' \
  --data-urlencode 'stealth=true' \
  --data-urlencode 'premium_proxy=true' \
  --data-urlencode 'solve_captcha=true'

Hard-bounce on any CAPTCHA (compliance mode)

// Returns 403 with captcha.type set if any challenge appears
const res = await fetch('https://api.example.com/scrape?' + new URLSearchParams({
  url: 'https://target.com',
  js: 'true',
  stealth: 'true',
  solve_captcha: 'false',
}), { headers: { ApiKey: 'YOUR_API_KEY' } });

if (res.status === 403) {
  const meta = JSON.parse(res.headers.get('X-Meta'));
  console.log('blocked by', meta.captcha?.type);
}