botcheckme

The captcha you solved comes straight back

A captcha is not a test you pass once. It is a pass it issues you and then has to read back on your next request. When it cannot read the pass, it has no way of knowing you ever solved anything.

The fastest fix, before any explanation: leave private browsing, allow cookies for the site including third-party cookies, reload, and solve it once more. A captcha that loops is usually a captcha whose pass could not be stored, and that is the change that lets it be stored.

What is actually happening

Solving the challenge produces a token. The token is stored — as a cookie, in local storage, or in storage belonging to the challenge vendor's own origin rather than the site's — and sent back with your next request. The site checks it and lets you through.

Every step of that can fail without anybody telling you. If the storage write is refused, there is no token. If the token is stored against a different origin than the one that reads it, there is a token but nobody can see it. If your address or your fingerprint changed between the two requests, the token may be bound to the wrong thing and rejected.

Cause one: storage refused

By far the most common. Blocking all cookies, blocking third-party cookies where the vendor needs one, or browsing in a private window that discards the pass on close — all three produce the identical symptom. Your reading's third-party storage row tests what this browser will and will not write, and prints the result of each test.

Cause two: the address is doing the scoring

On a shared or hosting-network address, the score is recomputed from scratch on each request and keeps landing below the threshold. You pass the box, the score rises briefly, and the address pulls it back down. Nothing you do inside the browser changes this.

Cause three: the geography contradiction

If your exit country and your clock disagree, the recomputed score will disagree with your just-issued pass on every request. This is the row that clears fastest: move the VPN to a server in your own country and the loop usually stops on the next attempt.

Cause four: the page changed underneath it

A blocker that cancels the vendor's own requests, or hides the element the challenge measures, can leave the flow half-finished with no error. Allow-listing the one site is usually enough.

In order

  1. Leave private browsing and allow cookies for the site, including third-party cookies, for as long as it takes to get through.
  2. Allow-list the site in your blocker.
  3. Move the VPN to your own country, or turn it off for this site.
  4. If it still loops, switch networks — a mobile hotspot — for the one thing you are trying to finish.

How long is a captcha pass supposed to last?

Longer than one page. That is the whole diagnostic value of this symptom, and it is worth stating precisely because it tells you when to stop blaming yourself for solving it wrong.

The exact lifetime is the site's choice and is not published, but the design intent is universal: you solve once and continue for a session. If you are asked again within seconds, or on the very next click, no lifetime setting explains that. Either the pass was never stored, or it was stored somewhere the next request could not read, or it was rejected on arrival because something about the request changed.

So the useful question is not “how long should this last” but “did it survive one navigation”. If it did not, work the list above rather than solving more carefully.

Why does it loop on one site and not others?

Because sites configure the same vendor very differently, and because the storage arrangement differs per site. Three ordinary explanations:

  • Different protection levels. The same vendor offers a range from a light score check to an interstitial on every request. A site under attack this week is stricter than it was last week, and nothing about you changed.
  • Different storage origins. Some deployments store the pass on the site's own domain, others on the vendor's. If your browser blocks third-party storage, the second arrangement loops and the first does not — same browser, same settings, different outcome.
  • Different sensitivity to what you are doing. A checkout, a login and a password reset are scored harder than a product page. Looping only at payment is not a coincidence and it does not mean the site distrusts you personally.

The image puzzle that never accepts an answer

A specific variant deserves its own paragraph, because it feels like an accusation of incompetence and it is not one. You select the traffic lights, it fades and gives you another grid, and another, indefinitely.

That is not a judgment about your answers. When a challenge is unsure, it asks for more — more rounds, harder images, longer interaction — and how unsure it is was decided before the first grid appeared, from the request itself. People who report solving twenty grids are not solving them wrong; they are being asked to keep proving a point that the images were never going to settle.

The remedy is the same as the rest of this page: change something about the request, not about how carefully you click. The ranked reading tells you which thing.

What if I am on my phone?

Two differences change the odds, and they pull in opposite directions.

In your favour: a phone browser is running almost no extensions, so the page arrives at the challenge unmodified and the processor is not competing with thirty tabs. Two of the four causes on this page are much less likely there.

Against you: mobile browsers restrict cross-site storage more aggressively than desktop ones, and an in-app browser — the one that opens inside a messaging or social app rather than in your actual browser — is the strictest environment of all and frequently the reason a checkout loops on a phone. If a link opened inside another app, use the “open in browser” option and try again there before changing any settings.

In the order they most often turn out to be the one. That order is a judgment about this symptom, not a reading of your machine — read your browser and these become rows with your own values in them, ranked by arithmetic instead of by opinion.

  1. Third-party storage

    The challenge cannot store the pass it just gave you, so it asks again.

    • Allow cookies for the site that keeps challenging you, including its third-party cookies, for as long as it takes to get through.
    • Turn off 'block all cookies' if it is on. Blocking third-party cookies only is usually survivable; blocking all of them is not.
    • Leave private browsing. A private window discards the pass every time you close it.
  2. Shared exit address

    Thousands of other people reach the web through the same address you do.

    • Turn the VPN off for the site that keeps challenging you, if you can accept that.
    • On a public or campus network, switch to a mobile hotspot for the checkout or login you are trying to finish.
    • If your provider uses carrier-grade NAT, ask them for a dedicated address — some offer one, most for a fee.

    There is no setting on your machine that changes this. The address is assigned to you by whoever runs the network.

  3. VPN exit country

    Your connection comes out in one country and your clock says another.

    • Switch your VPN to a server in the country your computer's clock is set to.
    • If you need that exit country, change your system time zone and language region to match it — the point is that the two agree.
    • If your workplace routes your traffic through another region, this is not yours to fix; the checklist on this page says so on the row.
  4. Content blocker

    A blocker is rewriting the page before the site's check can read it.

    • Add the site that keeps challenging you to your blocker's allow list. Most blockers have a one-click toggle for the current site.
    • Keep the blocker on everywhere else — you do not have to choose between blocking and getting through.
    • If you use a custom or aggressive filter list, turn that list off first and leave the default lists on.
  5. Connection

    Something between your browser and the site is making the connection for it.

    • In your antivirus, find the setting called HTTPS scanning, web shield or SSL inspection and turn it off for a test.
    • Check for a system or browser proxy: Windows Settings → Network → Proxy, macOS System Settings → Network → Details → Proxies. Turn off any you did not set up on purpose.
    • On a work network a company gateway does this on purpose. That is not yours to change; ask whoever runs it to exclude the site you need.

    When a company gateway makes the connection, no browser setting changes what the site sees.

What people search when this is happening

Why does the captcha keep coming back after I solve it?
Because solving it produces a pass that has to be stored in your browser and sent back on the next request, and something is stopping that round trip. Usually the storage write is refused — blocked cookies, a private window, restricted third-party storage. Sometimes the pass is stored fine but the score is recomputed from your address and lands below the threshold again anyway.
How do I fix a captcha loop?
In this order: leave private browsing and allow cookies for the site including third-party cookies; allow-list the site in your content blocker; move your VPN to a server in your own country or turn it off for that site; and if it still loops, do the one thing you need on a different network such as a mobile hotspot. Reload between each step, because a challenge already running keeps the conditions it started with.
Why does the captcha loop on one website but not others?
Sites configure the same vendor very differently, and the pass is not always stored in the same place. A site running a stricter protection level, or one whose deployment stores the pass on the vendor's domain rather than its own, will loop for a browser that restricts third-party storage while every other site behaves normally.
I keep getting more image puzzles no matter what I click. Am I solving them wrong?
No. Extra rounds are what an unsure challenge asks for, and how unsure it was got decided from the request before the first grid ever appeared. Clicking more carefully cannot change that. What changes it is changing something about the request — the storage, the network, the extensions — which is what the ranked reading is for.
Does clearing cookies fix a captcha loop?
It usually makes it worse in the short term, because the pass you are trying to keep is one of the things you just deleted. Clearing is worth doing only when you suspect a stale or corrupted pass from an earlier attempt, and then you have to allow cookies afterwards or you have simply arranged for the new pass to be discarded as well.

READ AT PRIOR TABLE ED. 1.0.0 · 2026-10-13 · ASSUMED, NOT MEASURED

The rank is taken against 15 written assumptions about how common each value is and 16 written weights about how much each one matters. 9 of them we think are probably wrong. Real counts from the browsers these sites have read appear beside a row, never inside its rank. Read the assumptions →

The rows you cannot fix from a settings page

A VPN you need for work, an address your ISP shares with a thousand other subscribers, a laptop with no graphics chip, a hardened profile that breaks the sites it was meant to protect — none of these have a checkbox. What is left is to present a reading that is internally consistent and ordinary on purpose, instead of one that is accidentally strange.

Donut Browser does that at the engine level: its Wayfern Chromium fork applies the fingerprint through CDP injection rather than patching JavaScript in the page, and it refuses to launch a profile whose proxy exit country, time zone and language contradict the profile's own fingerprint — which is the top row of most readings on this site. It is AGPL-3.0, it has no telemetry of any kind, and it runs on macOS, Windows and Linux.

Stated plainly: this site has no test results showing what any particular anti-bot service does with any particular browser, and neither does Donut Browser's own repository. What can be checked is the source, which is public.