“Are you a robot?” Why websites ask, and what to do

Sites put checks in front of actions that automation abuses: sign-in, sign-up, password reset, checkout, and forms that send messages. Some show the check to everyone; others only when something about the visit looks unusual.

Being asked does not mean you are suspected personally. It usually means your request shares something with automated traffic: the network you are on, the speed of your clicks, a browser that blocks scripts, or an address that other people used for something else.

• Your answer to the challenge, if there is one: the box, the images, the audio.
• How the page was used, such as pointer movement, timing and whether scripts ran.
• Your connection, including whether the address is shared, a VPN or a data centre.
• Your browser, including whether cookies and JavaScript are allowed.

Invisible checks score these without asking anything, and show a puzzle only when the score is low.

The tick box is the best-known robot test: one click, and a score decides whether anything else is asked. Image grids ask you to pick every square with a given object; text puzzles ask you to type distorted letters; audio checks read out characters for people who cannot use the images.

Some checks show nothing at all. A short pause with a spinner usually means the page is running a script that measures the browser before letting you through. A bot check like this fails silently when scripts are blocked, which is why the same site can work on one device and loop on another.

1. Turn off the VPN or proxy and try again. Shared exit addresses are the most common reason for repeated checks.
2. Allow cookies and JavaScript for the site. Many checks cannot finish without them.
3. Disable extensions that block scripts or change pages, then reload.
4. Try another network, such as mobile data instead of office or public Wi-Fi.
5. Ask for the accessible alternative, or contact the site if the puzzle cannot be solved with your setup.

If you use a screen reader or have difficulty with visual or audio puzzles, the problem is with the check, not with you; the W3C documents these barriers in Inaccessibility of CAPTCHA.

Every robot check costs some real visitors their patience, and some their access. Show it only where an action is worth abusing, only after other signals point to automation, and always with an alternative path.

Measure how many people abandon the form at the check, and compare it with how much automation it stops. CAPTCHA covers the trade-offs, and blocking bots covers the responses that ask nothing of people.