# hCaptcha image challenge every time: why it happens > hCaptcha's challenge is its score. A puzzle every time usually means blocked cookies, a crowded VPN exit or a browser whose values disagree with each other. Source: https://mosaicbrowser.com/blog/hcaptcha-image-challenge-every-time ## Why hCaptcha gives some browsers a puzzle every time hCaptcha's challenge is its score. A puzzle every time usually means blocked cookies, a crowded VPN exit or a browser whose values disagree with each other. ![The challenge you get is the score, beside a screenshot: a Mosaic leak test: every surface a site reads, checked from inside the profile page](https://mosaicbrowser.com/covers/hcaptcha-image-challenge-every-time.webp) hCaptcha gives some browsers an image challenge every time because the challenge is its score. There is no "you passed" screen; what you get is the verdict. Trusted: nothing, or one easy round. Risky: a grid, then another grid. A grid on every site means one thing about your visit gets the same low rating each time, and it is usually one of four: blocked cookies, a crowded VPN or proxy exit, a browser that contradicts itself, or too many requests. Solving puzzles changes none of the four. ## An hCaptcha image challenge every time is the verdict Our detection catalogue in Mosaic has a row for this page, id `hcaptcha`, pointed at `accounts.hcaptcha.com/demo` and filed under WAFs. It is marked `reference`, which means the app does not grade it on its own. The pass condition is written as a sentence for a person to judge: > A passive pass or a single easy challenge, not an escalating image grid. We left it that way on purpose. The page never prints a score, so any number our extractor pulled off it would be one we made up. A third round of tiles is the reading. ## 1. Blocked cookies This is the cause privacy-minded people hit first. If an extension or a strict cookie setting blocks hCaptcha's cookies, each visit shows up with no history at all, and an empty history gets the full treatment. To check it: - allow cookies for hCaptcha's domain and reload - or try once in a browser profile with default settings If the grid disappears, that was it. Mosaic is a desktop app Email yourself the link and open it on your computer. [How it works: Machines that exist](https://mosaicbrowser.com/features/real-fingerprints) ## 2. A crowded exit A VPN server carries many people at once, and some of them run scripts. The address has a bad name before your first request leaves. The shape is a grid on every site from the moment you connect. Residential proxies get this too. A home line sold through a pool carries other customers' traffic, and two sellers can resell one pool ([proxy sellers sharing IPs](https://mosaicbrowser.com/blog/proxy-providers-share-ips)). Switching the VPN off for one visit, or trying another exit, tells you within a minute whether the address is the problem. If it is, you need a cleaner address ([residential IPs flagged as proxies](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy) covers what the reputation lists look at). ## 3. A browser that contradicts itself Every page can read your User-Agent, platform, timezone, language, screen, GPU and fonts. On a normal laptop those agree, because they come from one real machine. Install a User-Agent switcher and the browser says Windows in the header and macOS in the font list. A contradiction costs more than any odd value on its own ([what goes into a browser fingerprint](https://mosaicbrowser.com/glossary/browser-fingerprint)). The exit is part of the same comparison. A German IP with a clock set to Los Angeles does not add up, even if nothing inside the browser was changed. ## 4. Rate A burst of sign-ins, searches or form posts raises the score by itself. So do failed attempts at the challenge. If a site is rate-limiting you, stop and come back later; every retry is one more request against you. ## What Mosaic changes, and what it leaves alone Mosaic is built for people running accounts they are entitled to run, one profile per account. Each profile's timezone, language and location follow its proxy's measured exit, so the clock and the IP agree. Fingerprint values are changed in C++ inside the engine, not by an extension, so every frame reads the same machine. Before each launch Mosaic checks the proxy, and it can score an exit's reputation before you put an account behind it ([how to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it)). A site can set hCaptcha to challenge every visitor. Nothing above turns that off, and nothing should: it is the site's call. One more habit from running detectors. The catalogue row has `settleMs: 20000`, so nobody reads the hCaptcha demo until twenty seconds after it loads; a reading taken earlier describes a page that has not decided yet ([a bot score that read 0 before anything had been measured](https://mosaicbrowser.com/blog/bot-score-before-measuring) is that mistake on another detector). ## Questions ### Why does hCaptcha show me an image challenge every time? Because it rates your visit as risky every time. The usual reasons are cookies blocked for hCaptcha, a VPN or proxy exit shared by many people, and a browser whose reported values contradict each other. Solving the puzzle does not change any of those, so the next visit is rated the same. ### Does solving more hCaptcha puzzles make it stop? No. A solved puzzle lets that one request through. The signals that caused it, your address, your cookies and your browser, are the same on the next page, so the next challenge is just as likely. ### Can a website make hCaptcha always show a puzzle? Yes. The site chooses how hCaptcha is set up, and some set it to challenge every visitor. If everyone on a site gets a grid, it is the site's choice and not your browser. ### Is there an option for people who cannot do image puzzles? hCaptcha publishes accessibility options for people who cannot solve visual challenges. Its accessibility page explains how to use them, and the site you are visiting can also be asked for another way in. ## Related [fingerprint-scan.com bot score: 0 before anything was measured](https://mosaicbrowser.com/blog/bot-score-before-measuring): fingerprint-scan.com shows Bot score 0/100 while its hash still reads collecting. Read the score only after the hash exists, and expect 15, not 0. [The residential IP several detectors already knew](https://mosaicbrowser.com/blog/residential-ip-detected-as-proxy): A residential proxy can be detected as a proxy because it is one. On one Wichita exit, FingerprintJS and incolumitas never loaded in three rounds. [The same home IP, sold by several providers](https://mosaicbrowser.com/blog/proxy-providers-share-ips): Residential pools overlap: one home device can sit in several sellers' networks at once, so switching seller does not promise switching neighbours. [Browser fingerprint: what a site can read about your machine](https://mosaicbrowser.com/glossary/browser-fingerprint): A browser fingerprint is the set of values a site reads about your browser and computer, which together recognize you without cookies. What goes into one. [How to check a proxy before you use it](https://mosaicbrowser.com/guides/how-to-check-a-proxy-before-you-use-it): Check that a proxy answers and tunnels, where its exit really is, whether the address is residential or blocklisted, and that the browser stays behind it. [The RTT client hint, read off the wire](https://mosaicbrowser.com/blog/rtt-on-the-wire): ECT, RTT and Downlink headers behind a proxy, measured: a claimed round trip moved JavaScript to 300 and left the RTT header at 50. So we claim neither. [fingerprint.com wouldn't load through our proxy, and that was a result](https://mosaicbrowser.com/blog/fingerprint-demo-not-loading): Through one residential exit the FingerprintJS demo hung; from the same Mac with no proxy it loaded. Our runner blamed itself. The exit was why. [Same IPHey score, opposite reasons](https://mosaicbrowser.com/blog/iphey-same-score-different-signal): IPHey Unreliable on a normal Chrome is usually the exit. Our profile and a stock Chrome both got MX 90, for a browser signal and a location signal. ## Mosaic, on your own computer The browser this blog is about: its own Chromium, fingerprints from real machines and a proxy exit per profile. Free holds 3 profiles. Pro is $49 a month for any number. Mosaic is a desktop app Email yourself the link and open it on your computer.