Playground Sign in Start free
Resource · Anti-bot

Solve CAPTCHAs. Or skip them entirely.

The 2026 best practice is to never see a CAPTCHA in the first place. When one does fire, auto_captcha_solve can solve it for 5 extra credits. Here’s when to rely on each, when not to automate at all, and how to monitor your CAPTCHA spend.

Last updated Mar 2026
1

Avoid > solve. Almost always.

CAPTCHA-solving is a fallback, not a strategy. The 2024–2026 generation of bot detection (Turnstile, reCAPTCHA v3, AWS WAF) rarely shows a challenge UI; instead, it scores every request continuously on JA4 + IP + behaviour + browser internals. A “CAPTCHA” only appears when the score crosses a threshold. The reliable, cheap, fast path is keeping the score below threshold so no challenge ever fires.

Avoid (prevention)
Solve (reaction)
Speed
+0ms (request just succeeds)
+20 to 60s per challenge
Cost
No extra credits
+5 credits on every request that sets it
Success rate
~98% on Turnstile, ~95% on DataDome
~85% on image puzzles
Reliability
Stable across vendor updates
Drops when puzzle types change
When it wins
Always - when feasible
Long-running sessions; account-bound flows where the IP changed mid-session and you need to recover
The default config we recommend
js=true + proxy_type=premium (or residential) + matching proxy_country. On most protected sites this clears below challenge threshold. auto_captcha_solve=true is a safety net with a price: it adds 5 credits to every request that sets it, CAPTCHA or not, and it forces JS rendering. Turn it on only for the sites that need it.
2

The CAPTCHAs you’ll meet

Each major family, what triggers it, and how it gets resolved inside a scraping pipeline.

Cloudflare Turnstile Invisible

Default mode is fully invisible. Triggered by JA4 mismatch, IP reputation, or behavioural anomalies. Solved server-side by a real Chromium with patched fingerprint.

+5 credits when solved
reCAPTCHA v3 Score-based

Continuous score from 0.0 to 1.0. Most pages pass at ≥0.5; sensitive ones want ≥0.7. No challenge UI shown - purely score-driven.

+5 credits when solved
reCAPTCHA v2 (image) Image puzzle

Click-the-traffic-lights and similar grids. Triggered when v3 score is too low or as a fallback. Outsourced to a vetted human-loop service. Median solve ~12s.

+5 credits when solved
hCaptcha Image puzzle

Same flow as reCAPTCHA v2 - image grid, human-loop solve.

+5 credits when solved
AWS WAF / Bot Control JS challenge

JS-execution puzzle plus behavioural checks. Solved server-side by headless Chromium with patched anti-detection. Almost always invisible.

+5 credits when solved
DataDome Score+UI

Multi-signal scoring; falls back to a slider/puzzle UI on the borderline cases. Server-side handles the score path; UI path needs human-loop.

+5 credits when solved
PerimeterX / HUMAN Multi-signal

Stack of TLS, behavioural, account-history scores. Requires residential IPs plus a clean fingerprint to never trigger. UI fallback is rare but supported.

+5 credits when solved
GeeTest / Slider Behavioural

Drag-the-slider puzzle, common on Chinese-origin sites and some financial portals. Server-side path solves with motion modelling.

+5 credits when solved
3

How CAPTCHAs get solved

Two outcomes. Either the challenge never needs solving, or it gets solved and you pay a small surcharge.

No challenge shown (no surcharge)

Turnstile, reCAPTCHA v3 and AWS WAF mostly score the request without showing a puzzle. With js=true and a good proxy, the challenge JS runs in our headless browser and the page loads. Nothing is solved, so nothing extra is billed.

CAPTCHA solved (+5 credits a request, typically 20 to 60s)

When a page does show a CAPTCHA and auto_captcha_solve=true is set, it is solved through external solving services. Solves typically take 20 to 60 seconds (cap it with auto_captcha_solve_timeout, in milliseconds, default 120000). Every request that sets auto_captcha_solve=true costs 5 extra credits, whether or not a CAPTCHA was found and solved. Solving forces JS rendering, which also raises the base cost of the call.

The cheapest CAPTCHA is the one that never fires
Most CAPTCHAs are avoidable. js=true + proxy_type=premium (or residential) + matching proxy_country reduces challenge frequency dramatically. Don’t pay for solves you could have prevented with three flags.
4

Monitoring your CAPTCHA spend

The Ujb-Credits response header gives the exact cost of each call, so auto_captcha_solve=true shows up as 5 extra credits on each call that sets it. Log it per target and tune your config where solves pile up. The four metrics below are worth tracking in your own logs.

Metric
What it tells you
If it’s off
captcha_rate
Ratio of requests that triggered any challenge. < 5% is healthy; > 15% means the score is too high.
Switch to residential proxies; check device flag matches site
captcha_solve_rate
Ratio of requests where a CAPTCHA was actually solved. The 5 extra credits apply to every request with auto_captcha_solve=true.
Likely the same fix as captcha_rate
captcha_solve_p95
95th-percentile solve latency. Solves typically take 20 to 60s. Spikes mean a vendor changed their puzzle.
Contact support with example URLs
post_solve_success
Of requests that hit a challenge and were solved, how many returned a usable body.
< 90% means the challenge changed - check vendor-update log
5

When NOT to automate CAPTCHAs

We refuse some kinds of CAPTCHA-solving. Not because the technical path is harder, but because the CAPTCHA is doing the job it was designed to do - gating consent, authentication, or rate-limited public goods. Automating past it crosses from data extraction into impersonation.

Login / signup pages

A CAPTCHA on a login form is the consent gate. Solving it is impersonating the account owner.

Account creation

Mass signup automation is the canonical abuse case CAPTCHAs were built for. Out of scope.

Paywalled content

A challenge before paid content is the merchant gating their own goods. Don’t.

Banking / KYC

Out of scope, full stop. Not a use case we support at any tier.

Voting / sweepstakes

Ratchets that depend on one-human-one-vote integrity. Solving the CAPTCHA breaks the protocol.

Unsolicited contact forms

A CAPTCHA on “contact us” is anti-spam. Don’t solve it to send mass messages.

6

CAPTCHA-related API parameters

Parameter
Type
Default
Description
auto_captcha_solve
boolean
false
Detect and solve CAPTCHAs through external solving services. Forces JS rendering. Adds 5 credits to every request that sets it.
auto_captcha_solve_timeout
number
120000
Timeout in milliseconds for CAPTCHA solving (120000 = 2 minutes). Solves typically take 20 to 60 seconds.
js
boolean
false
Required for JS-based challenges (Turnstile, AWS WAF, DataDome). Without it, score-based vendors will simply mark the request as bot.
proxy_type
string
rotating
premium or residential for higher IP trust. Network-layer trust score is the primary lever for keeping vendors below challenge thresholds.
proxy_country
string
US
ISO country code for premium and residential proxies. Match it to the site’s audience. Paid plans and top-up packs.
wait_for
string
-
CSS selector. Wait until the post-challenge page is hydrated before returning HTML.
7

Code examples

Avoid CAPTCHAs in the first place (recommended)

Python · prevention
import requests

response = requests.get(
    'https://api.ujeebu.com/scrape',
    params={
        'url': 'https://target-site.com',
        'js': 'true',
        'proxy_type': 'premium',
        'proxy_country': 'US',
    },
    headers={'ApiKey': 'YOUR_API_KEY'},
)
print(response.text)

Auto-solve as a safety net

cURL · auto_captcha_solve=true
curl -X GET 'https://api.ujeebu.com/scrape' \
  -H 'ApiKey: YOUR_API_KEY' \
  -G \
  --data-urlencode 'url=https://protected-site.com' \
  --data-urlencode 'js=true' \
  --data-urlencode 'proxy_type=premium' \
  --data-urlencode 'auto_captcha_solve=true'

Hard-bounce on any CAPTCHA (compliance mode)

Node · no auto-solve
// auto_captcha_solve defaults to false: a challenge is never solved
const res = await fetch('https://api.ujeebu.com/scrape?' + new URLSearchParams({
  url: 'https://target.com',
  js: 'true',
  proxy_type: 'premium',
  auto_captcha_solve: 'false',
}), { headers: { ApiKey: 'YOUR_API_KEY' } });

if (!res.ok) {
  console.log('blocked or failed with status', res.status);
}
8

FAQ

Do I need auto_captcha_solve=true to bypass Cloudflare?

Often no. Turnstile is usually invisible: use js=true with premium or residential proxies first. auto_captcha_solve=true adds 5 credits to every request that sets it and forces JS rendering, which costs more.

How long does a solve take?

Solving uses external services and typically takes 20 to 60 seconds. You can cap it with auto_captcha_solve_timeout (in milliseconds, default 120000, that is 2 minutes).

Can I see which CAPTCHA was triggered?

Check the Ujb-Credits response header: a request with auto_captcha_solve=true costs 5 credits more than the same request without it, whether or not a CAPTCHA was solved.

Why are my requests still hitting CAPTCHAs?

Usually one of three things: (a) datacenter IPs on a site that scores IP reputation (try proxy_type=premium or residential), (b) js=false on a JS challenge, or (c) proxy_country not matching the site’s audience. The fingerprinting guide walks through the diagnostic flow.

What about Cloudflare’s 2025 update?

Cloudflare now scores audio context, deeper plugin enumeration, and a wider canvas variance check. We handle them in the rendering browser when you send js=true, with no extra parameter, and update the patches when vendors change.

Do you ever refuse a request?

Yes. CAPTCHAs on login pages, signup forms, paywalls, banking, KYC, and voting are out of scope. The API returns 422 with a clear refusal message rather than attempting the solve.

Ship Ujeebu tonight.

5,000 credits free. No card. Real residential proxies on the free tier.