hCaptcha is a challenge service that sites embed on logins, signups and forms. Most visitors see a checkbox. When the site's settings or hCaptcha's own checks call for more, a grid of images appears.
Two things changed in 2026 for anyone who meets it in a scraper. First, the big solving services no longer list it. On October 23, 2026, six well-known services named no hCaptcha task on their own pages, and searches for "hcaptcha solver" fell from 5,400 a month in spring to 1,900 in September. Second, the cheaper route got more important: meeting the challenge less often. That means a real browser, one steady address per session, and a warm cache. We measured what the checkbox costs in traffic, because on a proxy billed per GB every byte counts.
What hCaptcha checks
hCaptcha's developer docs describe the parts a scraper meets. The site loads hCaptcha's script, the visitor gets a token, and the site's server checks that token with hCaptcha's siteverify endpoint. The token goes into a form field named h-captcha-response.
The visitor's address is part of that check. "While remoteip is not strictly required, providing it helps improve verification accuracy," the docs say, and for Enterprise customers it "also enables risk scores". Sites can also act on the address directly. The docs tell Enterprise customers who want to see a challenge to "add a 'Challenge' rule targeting your IP or user agent".
hCaptcha sells itself against account abuse. Its pricing page lists account takeover, multi-accounting, account sharing, synthetic identities, incentive abuse and transaction fraud as use cases, and "Agent Controls" to "detect and manage agents". So expect it where accounts and money are, more than on plain public pages.
Why hCaptcha keeps coming back
"hcaptcha not working" draws 1,600 searches a month, and hCaptcha's own FAQ explains most of the loops people report.
The site picks the mode. Free Publisher accounts run in "Always Challenge" mode, at Easy, Medium, Difficult or Auto. The passive modes, where most visitors never see a challenge, belong to the paid Pro and Enterprise plans. On an always-challenge site, every visitor gets a challenge, whatever their browser or address.
More challenges follow doubt. Whether a visitor sees more than one "depends on computed confidence in the visitor's humanity, the site difficulty setting, and other security factors", the FAQ says. A failed challenge brings a new one.
Old browsers fall outside support. hCaptcha officially supports "the last two major versions of each browser". An automation setup pinned to an old Chrome build sits outside that line.
People take seconds. The FAQ puts a typical session at 3 to 10 seconds, depending on the difficulty mode.
So when the checkbox loops, check the browser version first, then whether each session keeps one profile and one address, then the pace. If the site runs in always-challenge mode, the challenge stays no matter what, and an official API or another data source is the better route.
Who still solves hCaptcha
We read each well-known solving service's own hCaptcha page and price list on October 23, 2026:
| Service | hCaptcha on its own pages | What its hCaptcha address did |
|---|---|---|
| 2Captcha | Not in its price table | The hCaptcha page led to the homepage; the API page answered 404 |
| Anti-Captcha | Not in its price list | The task address showed the home page |
| CapMonster Cloud | Not found | 404 |
| CapSolver | Not on its homepage list | The hCaptcha guide answered 404 |
| DeathByCaptcha | Not among 16 priced types | No hCaptcha page |
| NopeCHA | Not in its demo list | No hCaptcha page |
None of them said why on the pages we read. Newer services sell hCaptcha tokens in their place, and we do not list them: hCaptcha guards signups and accounts on purpose.
Treat old comparison tables with care. One newer service's table still prices hCaptcha at 2Captcha, CapSolver, Anti-Captcha and CapMonster, "compiled from each provider's public pricing pages". On October 23, none of those four listed hCaptcha at all. A ranking blog from May 2026 rates four of the same services for hCaptcha, without a method behind its success rates.
Search demand moved the same way:
- hcaptcha solver
- hcaptcha not working
- hcaptcha bypass
Machine solving is old news, for the record. A 2021 paper from the University of Louisiana at Lafayette solved 270 live hCaptcha challenges with 95.93% accuracy, in 18.76 seconds on average. It ran on 2 GB of memory and no graphics card. hCaptcha has changed a lot since, so read that as history.
What the checkbox costs in traffic
On a proxy billed per GB, a challenge also costs bandwidth. So we measured the checkbox on our own machine with hCaptcha's public test key, which never shows an image challenge and protects nothing. Headless Chrome 155 loaded a local page with the widget, three times over, with no proxy.
The cache decides the cost. A browser that starts every session with a fresh profile downloads the full 311 KB each time. One GB covers about 3,100 such first visits for the checkbox alone. Reuse the profile and the same GB covers about 271,000 repeat visits, 86 times as many. An image challenge adds more on top, which our test key could not show.
Where a residential IP fits
The address is one input, and hCaptcha's own docs show where it enters. The site's server may pass it with each token check. An Enterprise site can write rules against it. A residential address belongs to a home provider's network, which is a different starting point from a data center range.
It changes nothing else. The browser, its automation signs and the challenge itself stay as they were. For what a site can read about a browser, our FunCaptcha guide has our own headless Chrome run, and how websites detect proxies covers the address side.
A careful setup for automation you are allowed to run
- Use a real browser. Playwright or Puppeteer driving Chrome, with a profile that persists between runs. The cache is part of the saving above.
- Hold one address per session. Residential Premium sticky lines keep one exit for 3 minutes to 24 hours, and you set the length per line. Pick one longer than the flow, and pair one browser profile with one line.
- Pace like a person. Fewer requests per address, real waits between steps, and an ordinary path through the site.
- Test with one session before you scale. If a careful first session still meets a challenge on every page, fix the browser before you buy anything.
Residential Premium costs $1.49/GB for one GB, falling to $1.00/GB at 1,000 GB+. Our guide to sticky and rotating sessions explains when each fits.
When to stop
If the site offers an official API, use it. If the data you need sits behind an account flow that hCaptcha guards, read the site's terms first. hCaptcha exists to stop automated signups and account abuse, and a solved checkbox does not change what the site allows. For other anti-bot systems, our page on solver APIs explains how that market works.
Sources
- hCaptcha developer docs: integration, siteverify and remoteip, test keys, local development and forcing a challenge, read October 23, 2026.
- hCaptcha pricing, read October 23, 2026.
- 2Captcha, Anti-Captcha, CapMonster Cloud, CapSolver, DeathByCaptcha and NopeCHA: each service's own hCaptcha address and price list, read October 23, 2026.
- NoneCap and CaptchaSonic product pages, and a ranking blog of May 4, 2026, read October 23, 2026.
- Hossen and Hei, "A Low-Cost Attack against the hCaptcha System", 2021.
- Cloudflare blog: Moving from reCAPTCHA to hCaptcha, April 8, 2020, and Announcing Turnstile, September 28, 2022.
- Google Ads Keyword Planner, worldwide, English, read October 23, 2026.
- Our own measurement on October 23, 2026: headless Chrome 155.0.8059.85 with a temporary profile, hCaptcha's public test sitekey on a page served from our machine, three runs, no proxy.
