A CAPTCHA can fail even when you select the correct images. Common causes include blocked scripts, an expired challenge, an unsupported browser, network restrictions, or a problem with the website’s CAPTCHA setup.
Start with the browser and network checks below. If the CAPTCHA still fails, use any displayed error code to identify whether the website owner needs to fix its integration.
Quick fixes for a CAPTCHA that will not work
- Reload the CAPTCHA itself. For Google reCAPTCHA, select the reload button beside the image to receive another challenge. Avoid repeatedly submitting the entire form when only the CAPTCHA is failing.
- Complete the CAPTCHA last. On a long form, fill in the other fields first. Google says verification can expire after a period of time or inactivity. If it expires, select the checkbox again and restart the challenge.
- Enable JavaScript. Google recommends enabling JavaScript for reCAPTCHA, and Cloudflare Turnstile requires it. A script blocker, privacy setting, firewall, or browser extension may make the widget blank or unresponsive.
- Temporarily disable extensions for the site. Test with ad blockers, content or script blockers, fingerprinting protection, and canvas blockers disabled. Reload the page. If that solves the problem, allow the site in the relevant extension rather than leaving every extension disabled.
- Try a private window. Incognito or Private mode can help identify extension or cached-data conflicts, but it is not a guaranteed fix. If the CAPTCHA works there, check extensions or clear the site’s cookies and cache in the normal browser.
- Try another supported browser. Google reCAPTCHA supports the two most recent major versions of Chrome, Firefox, Safari, and Chromium Edge on desktop; supported mobile browsers include Chrome, Safari, and the Android native browser. Cloudflare supports current releases and, depending on the browser, the two previous major versions. Internet Explorer is no longer supported by Cloudflare.
- Turn off a VPN or proxy temporarily. A VPN or proxy may interfere with challenge requests or lead to additional checks. Test once without it to see whether it is involved.
- Test another network. Connect the device to a phone’s mobile hotspot. If the CAPTCHA works there but not on Wi-Fi, investigate the original network, including its firewall, proxy, DNS filtering, or IP reputation.
When the CAPTCHA is visible but the challenge keeps failing
A failed answer is only one possible cause. A challenge may expire, its scripts may be unable to reach the provider, or the system may detect behavior associated with automation.
Use an audio challenge when image puzzles are difficult
In Google reCAPTCHA, select Get an audio challenge, then press PLAY. Enter the numbers you hear and press ENTER or select Verify. If the recording is unclear, select Get a new challenge. If it will not play in the page, use Alternatively, download audio as MP3.
Recommended Free Tools
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Do not use an embedded browser or automated client
Open the page in a supported browser instead of an email preview, in-app browser, or custom webview. Cloudflare says embedded and in-app browsers may have limited support. Its challenges do not support command-line clients such as wget and curl, headless browsers, or automation frameworks such as Selenium, Puppeteer, and Playwright.
Check the system clock
An incorrect device clock can invalidate time-sensitive challenge requests. Set the clock to update automatically, then reopen the browser. For Turnstile error 110600, Cloudflare identifies an incorrect visitor clock or a challenge that took too long. Error 200100 can indicate a clock problem or a challenge cached by an intermediary.
What to do when reCAPTCHA is missing or unsupported
If the checkbox is absent or the widget says the browser environment is unsupported, Google recommends updating the browser, enabling JavaScript, and disabling plugins or extensions that may conflict with reCAPTCHA.
A faulty website integration can also be responsible. If reCAPTCHA works on other sites but not on one form, report the problem to that site’s administrator rather than repeatedly changing your device.
When Google says your computer or network is sending automated queries
Google may display a message such as “We’re sorry, but your computer or network may be sending automated queries.” Open Google’s reCAPTCHA test page. If a normal CAPTCHA appears there, Google says the computer and network are safe and the original website may have a configuration problem. If the warning also appears on the test page, follow Google’s unusual-traffic help.
You can also compare the same page in another supported browser, without extensions, and on a mobile hotspot. These tests help distinguish a local browser issue from a network or website problem.
Rank #2
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Turnstile error codes and what they mean
Cloudflare Turnstile is a different product from Google reCAPTCHA, so its error codes point to different causes. If a site displays a code, use it to guide the next step instead of assuming the answer was wrong.
| Code | Likely cause | Useful action |
|---|---|---|
| 110100, 400020 | Invalid sitekey | The site owner should verify the sitekey in the Cloudflare dashboard. |
| 110110 | Sitekey not found | Check the sitekey spelling and dashboard configuration. |
| 110200 | Domain not authorized | The site owner should add the current domain under Hostname Management. |
| 110600 | Challenge timed out | Check the visitor’s clock and restart the challenge without leaving it idle. |
| 110620 | Interaction timed out | Restart the widget. Developers can use turnstile.reset(). |
| 200100 | Clock or cached-challenge problem | Correct the device clock or address stale intermediary caching. |
| 200500 | Iframe load error | Check whether challenges.cloudflare.com is blocked. |
| 300* and 600* | Generic challenge failure; Cloudflare labels these as bot behavior detected | Test without blockers, VPNs, automation, or an unusual browser environment. |
A 401 Unauthorized message in the browser console does not automatically mean Turnstile is broken. Cloudflare documents a case where the widget requests a Private Access Token that the browser or device does not support. If the widget completes and returns a token, that console message can generally be ignored.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
hCaptcha-specific failures
For hCaptcha, network-error indicates a connection problem. hCaptcha retries automatically several times before closing. script-error means the JavaScript SDK did not load; a firewall blocking api.js is one possible cause.
Other useful codes include:
- challenge-expired: the time limit to answer elapsed.
- challenge-closed: the challenge was closed.
- missing-captcha: no CAPTCHA was found.
- invalid-captcha-id: the stored widget ID does not match the rendered widget.
If you are visiting a site, retry after checking JavaScript, extensions, and the network. Website developers should inspect the widget ID and integration code.
For website owners: fix the integration instead of blaming the visitor
If users consistently fail on one form while the provider’s test page works, inspect the site’s implementation. Common configuration issues include using the wrong sitekey, failing to authorize the hostname, loading the provider script too late, blocking its iframe, or allowing the token to expire before form submission.
Turnstile error handling
Turnstile automatically retries by default because its retry setting is auto. Setting retry to never disables automatic recovery and leaves the application responsible for retrying. Automatic retries can invoke the error callback more than once for the same underlying problem, so error handlers should avoid duplicate messages or repeated recovery actions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #3
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Configure an error callback so a challenge failure does not become an unhandled JavaScript exception:
div class=”cf-turnstile” data-sitekey=”your-sitekey” data-error-callback=”onTurnstileError”
A rendered widget can be reset from an error, timeout, or expiry callback:
turnstile.reset(‘#my-widget’);
A retry configuration can look like this:
turnstile.render(‘#my-widget’, { sitekey: ‘your-sitekey’, retry: ‘auto’, ‘retry-interval’: 8000, ‘error-callback’: handleError });
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhen diagnosing an error, check the browser console and network panel for blocked requests to challenges.cloudflare.com, JavaScript exceptions, content-security-policy violations, and failed iframe loads.
hCaptcha loading and domain configuration
With explicit hCaptcha rendering, define the onload callback before the SDK loads and render the widget from that callback. Rendering immediately can create an initialization race:
Rank #4
- USB-C or tap via NFC for easy authentication on any compatible device. No drivers needed; optional Kensington software available for advanced management features.
- Works across Windows, macOS, iOS, Android, ChromeOS, and supports Passkeys and Apple ID.
- Slim, keychain-ready form for easy carry and on-the-go authentication
- IP68-rated for dependable performance
- FIDO CTAP 2.1 for enhanced security features (e.g. resident credentials, Passkey support) and backwards compatibility with CTAP 2. FIDO2 L2 certified security for phishing resistant protection against identity theft and unauthorized access.
script src=”https://js.hcaptcha.com/1/api.js?onload=yourFunction&render=explicit” async defer
For domain restrictions, open the sitekey in the hCaptcha dashboard, enable Domain allowlisting, add the hostnames, and save. Enter bare hostnames such as example.com, not full URLs such as https://example.com/login. A listed hostname covers its subdomains. hCaptcha documentation says domain allowlisting is off by default; confirm whether it has been enabled for the sitekey.
To reset a rendered hCaptcha widget, use its widget ID:
hcaptcha.reset(widgetID)
How to identify who needs to fix the problem
| What you observe | Most likely area |
|---|---|
| The widget is blank in every browser on one website | Website integration, blocked provider script, or unauthorized domain. |
| It works in Private mode but not the normal window | Extension, cookie, cache, or privacy setting. |
| It works on a hotspot but not home or office Wi-Fi | Firewall, proxy, DNS filter, VPN, or network reputation. |
| It works on another device using the same network | Local browser, clock, extension, or device configuration. |
| Only image challenges fail | Use the audio option or reload for another challenge. |
| The provider test works but the target form fails | The target site’s CAPTCHA integration or form workflow. |
When to contact the website
Contact the site owner when the CAPTCHA fails in two supported browsers, with extensions disabled, and on a second network—or when a provider error identifies an invalid key, missing key, or unauthorized domain. Include the page URL, approximate time, browser and operating-system versions, visible error code, and whether the widget works on the provider’s test page. Do not send passwords, CAPTCHA answers, or session cookies.
For a single visit, a clean test in a supported browser without blockers followed by a mobile-hotspot test is a practical stopping point. If both fail, the site or CAPTCHA provider needs to investigate; repeatedly clicking the challenge will not repair a broken integration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.FAQ
Why does a CAPTCHA fail when I answer it correctly?
A CAPTCHA can fail because JavaScript or its iframe is blocked, the browser is unsupported, the challenge expired, the device clock is wrong, the network triggered an automated-traffic check, or the website used an invalid key or unauthorized domain. A wrong answer is only one possible cause.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Does Private or Incognito mode fix CAPTCHA problems?
It can help identify extension or cached-data conflicts, but it is not a guaranteed fix. If the CAPTCHA works privately, check extensions or clear the affected site’s data in the normal browser.
Can I complete a CAPTCHA with JavaScript disabled?
Usually not. Google recommends enabling JavaScript for reCAPTCHA, and Cloudflare Turnstile requires JavaScript.
What should I do if the Google image CAPTCHA is too difficult?
Select the reload button beside the image for another challenge. You can also choose Get an audio challenge, press PLAY, enter the numbers, and select Verify.
Why does a CAPTCHA work on my phone but not my computer?
The computer may have a conflicting extension, outdated browser, incorrect clock, blocked script, VPN, proxy, or stricter firewall policy. Compare both devices on the same network, then test the computer on a mobile hotspot.
Free tools Windows power users keep installed
One-click scans. No signup required.
Is a 401 error in the console proof that Cloudflare Turnstile is broken?
No. Cloudflare documents a benign 401 related to an unsupported Private Access Token. If Turnstile resolves and returns a token, that particular console message can generally be ignored.
The Bottom Line
Start with the least disruptive checks: reload the challenge, complete it last, enable JavaScript, disable blockers, and use a supported browser. Then test without a VPN or proxy and on another network. If the failure follows one website—or displays an invalid key, unauthorized-domain, or iframe error—the website owner must correct the CAPTCHA integration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
