Your VPN exit doesn’t match your clock

If the captchas started the day you turned the VPN on, the fix is almost certainly one dropdown: pick a server in the country your computer's clock is set to. Nothing else about your setup has to change, and you keep the encrypted tunnel you turned it on for.

Here is why that single change does so much work. A bot check sees two halves of you. The network half is where your request came out: a country, a network operator, an autonomous system number. The browser half is what your browser volunteers about itself: a time zone from your operating system, a list of preferred languages, a currency and date format derived from both.

Neither half is suspicious by itself. Millions of people browse from Frankfurt. Millions of people have their clock set to Chicago. What almost nobody does by accident is both at once, on the same request, at the same second — and that is what a VPN produces the moment you connect to a server outside your own country.

Why this specific comparison, and not a harder one

Vendors reach for this check because it costs them nothing. The exit country arrives with the request; they already have it for routing and abuse purposes. The time zone arrives in the first line of the challenge script. Comparing two strings is not work. Compare that against, say, rendering a canvas scene and hashing it — which needs your browser to cooperate, takes real milliseconds, and can be spoofed by anything that can patch a function.

So the geography comparison sits early in almost every challenge, and a mismatch pushes you below the threshold before any of the interesting signals are even read.

How do I tell which half is wrong?

You need three facts and none of them require a tool. They take about a minute in total.

1. What country your clock is set to. On Windows: Settings → Time & language → Date & time, and read the time-zone line. On macOS: System Settings → General → Date & Time. On Linux the desktop's clock settings will say. Write down the country, not the city.
2. What country your VPN is exiting in. Read it in the VPN's own app, on the connection you currently have open — not from a website. The app is the only thing that knows for certain, and it is also the thing you are about to change.
3. What languages your browser asks for. Chrome: Settings → Languages. Firefox: Settings → General → Language. Safari inherits the system list. The first entry is the one that matters, because that is the one sent with every request.

If all three name the same country, this row is not yours and something else is producing the challenges — most often the address itself, which is a shared exit address and a separate page. If any one of the three disagrees with the other two, that is the one to move.

Which half to move

There are only two answers and they are both a minute's work.

If you use the VPN for privacy rather than for a specific country, move the exit: pick a server in the country your computer's clock is set to. You keep the encrypted tunnel and the address that is not yours, and you lose the contradiction. This is the answer for almost everybody.

If you need the exit country — because you are travelling and want your home country's catalogue, or because your employer routes you through one — move the browser instead. Set your operating system's time zone to the exit country and add that country's locale to your language list. The point is not which one is true; the point is that a check reads one consistent story rather than two inconsistent ones.

The VPN settings that matter besides the country

Four options in a typical VPN app change what a site reads about you, and three of them are on by default in at least one popular product.

• Fastest server / auto-connect. This is the one that catches people out. Your VPN silently re-picks the nearest fast exit — which is frequently in a neighbouring country — every time your connection drops. You set it to your own country in the morning and it is somewhere else by the afternoon. Pin the country instead of letting it choose.
• Multi-hop or double VPN. Your traffic leaves through the second country, not the first. Whatever the app shows as “connected to” may not be the exit the site sees. If you use multi-hop, the exit country is the last hop.
• Split tunnelling. Some of your traffic goes through the tunnel and some does not. That is fine for a bot check as long as the browser is consistently on one side of it. What is not fine is having the browser tunnelled while a helper process on the same machine is not.
• The VPN's own DNS. If the tunnel carries your traffic but your name lookups go out over your ordinary connection, some sites can see the difference. Most apps have a “use VPN DNS” or “DNS leak protection” toggle; leaving it on removes one more disagreement.

Why does turning the VPN off fix it instantly?

Because it removes both halves of the problem at once and you cannot tell which half did the work. Off, your address is your household's, published as a residential connection by your provider, and it is in the same country as your clock. Two rows clear simultaneously.

That is exactly why “it works with the VPN off” is not a diagnosis. Moving the exit to your own country keeps the tunnel and clears one row; if the challenges continue after that, the remaining one is address reputation and no browser setting touches it.

What about the VPN my employer makes me use?

A corporate VPN produces the same contradiction and you have less room to act on it. Your laptop's clock is set to where you live; your traffic comes out of a data centre wherever the company's gateway is; and that gateway is frequently published as a business or hosting network rather than a household one.

There are two honest options and neither is a browser setting. Ask whoever runs the network whether the site you need can be excluded from the tunnel — most corporate VPNs support per-destination exclusions and the request is routine. Or do the one thing you need on a personal connection. Your reading will mark this row as belonging to the network rather than to you, so you are not left changing settings that cannot help.

What this does not fix

Moving the exit fixes the contradiction. It does not change the fact that a commercial VPN's address is shared by a large number of strangers, and is published as belonging to a hosting network rather than to a household. That is a separate row with a separate fix, and on most readings taken through a VPN both rows are present at once.

Nor does it help if something inside the browser is rewriting your time zone. A privacy extension that forces UTC, or a browser in its strictest anti-fingerprinting mode, will report a clock that matches neither your VPN nor your country — which is the privacy-hardening row and has its own trade to weigh.