“Verify you are human”, and then again

Nothing you do inside the box will end this. The tickbox is a temporary contribution to a score that is recalculated on every single request, and the things dragging that score down are permanent properties of the request — your address, your clock, your settings. Change one of those and the loop stops; tick more carefully and it will not.

Why passing does not stick

Invisible and low-friction challenges do not issue a durable verdict. They compute a score continuously and gate on it continuously. Ticking the box is a large, temporary contribution to that score. Everything else in the request is a permanent one.

So if the permanent contributions are bad enough, the score falls below the threshold again within a page or two and you are asked again. This is not a bug and it is not personal. It is the design.

The permanent contributions, ranked

1. The exit address, and whether it is published as a household or as a hosting network.
2. The disagreement between that address's country and your browser's clock and language.
3. Signals inside the browser that cannot all be true at once — the strongest single thing a vendor can act on, because a contradiction shows intent in a way that rarity never does.
4. Anti-fingerprinting settings that report a machine which does not exist.

What the tickbox is actually measuring

Not whether you can identify a bus. The box exists to give the check a short window of your behaviour in a context where it knows exactly what it asked for — how the pointer travelled to the target, the timing of press and release, whether the page had focus, what happened between the click and the next request.

That is why the box sometimes passes instantly and sometimes unfolds into images: the images are what an unsure check falls back to, and how unsure it was had been decided from the request before you touched anything.

It is also why a person using a keyboard, a screen reader, a trackpad with accessibility settings, or a machine that is stuttering can find the box itself harder to pass. Those are all ordinary human conditions that produce unusual interaction traces, and it is one of the least defensible parts of this arrangement.

Why does this happen on some sites and not others?

Because the threshold is the site's to set, not the vendor's, and sites move it. The same score that sails through a news site can sit below the line on a ticket checkout, a sneaker release, a bank login or anything else that has recently been the target of something automated.

This explains the pattern people find most maddening: everything is fine all day, and the one thing you actually needed to do — buy the ticket, reset the password, complete the order — is the thing that will not let you through. You did not become more suspicious at checkout. The bar moved.

It also means a site that loops today may not loop next week, with nothing on your side changed at all. That is worth knowing before you spend an evening rearranging settings that were never contributing.

Signals that cannot all be true at once

The third item in the ranked list above is the one people have never heard of and the one vendors act on hardest, so it is worth spelling out with examples rather than leaving as a category.

A contradiction is two answers from the same browser that describe different machines. A user-agent string claiming macOS beside a graphics adapter that only exists on Windows. A time zone forced to UTC beside a language list belonging to one country and an address belonging to another. A touch-capable device count on a browser reporting a desktop. A screen size that changes between two reads seconds apart.

The reason these are weighted heavily is not that they are rare. It is that they imply intent. An unusual machine is an accident of who you are; answers that cannot all be true mean something is rewriting them, and rewriting them is what the check is defending against. This is why the extensions marketed as fixes for this exact symptom are frequently its cause.

What to change first

Run the reading on the home page. It prints these four as rows, in your browser's own values, ranked by how much each contributes, and it tells you which ones have a settings fix and which ones do not.

If you would rather not: turn off any extension that rewrites your user agent, canvas or screen size; move the VPN to your own country; and allow cookies for the site. Those three cover most loops.

What to do when none of it works

There is a point at which continuing to change settings is the wrong response, and recognising it saves you an evening. You have reached it when your reading's top rows are all marked as belonging to the network or the machine rather than to a setting.

At that point there are three honest options and none of them is a checklist. Do the one thing you need from a different network — a mobile hotspot is the usual answer and it is a genuinely different address on a differently classified network. Contact the site, since a real support channel can frequently pass you through by hand and the vendor is not the site's only tool. Or change the durable thing: use a browser built to present one consistent, ordinary reading on purpose rather than an accidentally strange one.

What will not help is another privacy extension. Every one of them adds a way for your browser to contradict itself, which is the row already ranked third on this list.