When hCaptcha is not working, keeps failing or loops, the usual causes are a failed challenge, which brings a new one by design, and blocked cookies. The hCaptcha FAQ says "when a user fails a captcha, a new one will also be presented to the user", and the number you see depends on the site and on hCaptcha's confidence in you. The hCaptcha accessibility page names cookie blocking as the typical reason challenges keep appearing.
If you run the site and your server gets success: false, check your tokens first. hCaptcha tokens are single-use and expire quickly (120 seconds by default).
Why does hCaptcha keep asking me to verify?
hCaptcha decides how many challenges to show based on several signals. Its FAQ says that whether more captchas appear "depends on computed confidence in the visitor's humanity, the site difficulty setting, and other security factors." The usual reasons for repeat challenges are:
- The site's difficulty setting. With Auto mode, "the user will always be presented with a challenge, with varying degrees of difficulty." A typical interaction takes "3-10 seconds depending on the difficulty mode." On some sites a second or third round is normal.
- Failed attempts. Each failed answer brings a fresh challenge.
- Cookie or extension blocking. The accessibility page covers users who have set its accessibility cookie and still see challenges. It says this "is typically due to using an aggressive ad blocker or anti-cookie extension, or a setting that blocks 'cross-site' cookies."
- Old browsers or systems. The FAQ says "the last two major versions of each browser are officially supported," that "IE8, IE9, and IE10 are no longer supported," and that "the OS root certificate store must trust ISRG Root X1." A very old browser or operating system can fail even when you answer correctly.
- Network errors. The configuration docs describe
network-erroras "network connection issues (e.g. offline)", after which "hCaptcha will automatically retry several times before closing."
What can you do as a visitor when hCaptcha keeps failing?
Start with cookies. The steps below come from the hCaptcha accessibility page. They are written for accessibility users whose challenges keep appearing, but they target the same cookie blocking described above.
- Allow hCaptcha cookies in your blocker. "Whitelist hcaptcha.com and *.hcaptcha.com cookies in your ad blocker or browser security extension."
- Check your browser's cookie setting:
- Chrome: "Make sure 'Block third-party cookies' is not enabled."
- Firefox: "Make sure you have unblocked hcaptcha.com."
- Safari on iPhone or iPad: "turn off 'Prevent Cross-Site Tracking' and 'Block All Cookies'."
- Brave: "go to Preferences -> Shields -> Cookies and choose 'Allow All Cookies.'" The page dates these Brave steps to April 2020, so the menu may have moved since.
- Update your browser and system. Only the last two major browser versions are officially supported, so an outdated browser is worth ruling out.
- Try the Accessibility Challenge if the site offers it. The accessibility page describes a text alternative, reached by "choosing the 'Accessibility Challenge' option in the hCaptcha widget menu when enabled on a given website or app." The option only appears if the site has enabled it. Users "will automatically pass or receive an accessibility challenge, depending on the site's settings and other factors."
- Contact the site, then hCaptcha. The site controls its own difficulty setting and configuration, so its support team is the first contact. hCaptcha's FAQ says: "Just send us an email at [email protected] and we'll be glad to help." Accessibility users can use the same address.
If you have developer tools open and see a 401 response to /authenticate, you can ignore it. The FAQ says it "has no effect on your ability to access hCaptcha."
Before you write to support, it helps to confirm which connection your browser is actually using, for example an office network rather than your home line. Note that result in your message.
What does your IP reveal right now?
What do hCaptcha error codes like rate-limited mean?
hCaptcha's error codes are for developers, not messages written for visitors. They still tell you who needs to act. The table maps each documented code to the person who can fix it.
| Code | What hCaptcha's docs say | Who acts |
|---|---|---|
| rate-limited | User has sent too many requests | Visitor: stop resubmitting and contact the site if it persists |
| network-error | Network connection issues (e.g. offline); retries several times before closing | Visitor: check the connection |
| script-error | SDK could not be loaded; user may be behind a firewall that blocks api.js | Visitor or network admin |
| challenge-expired | Time limit to answer the challenge has expired | Visitor: answer a fresh challenge |
| invalid-input-response | Requests from a hostname not on the list fail verification | Site owner |
| expired-input-response | Verification token is expired (120s default) | Site owner |
| already-seen-response | Token was already verified once | Site owner |
| sitekey-secret-mismatch | Sitekey is not registered with the provided secret | Site owner |
The configuration docs also tell site owners: "If you specify an error callback, you must inform the user that they should retry." If a site shows nothing after an error, the problem may sit in the site's code, not in your browser.
Why does hCaptcha verification fail on your own site?
Server-side verification that returns success: false almost always traces back to how the token is handled. The hCaptcha developer docs state the core rule: "Tokens are single-use: obtain a new token after each submission, expiration, or error."
Work through these causes in order:
- Reused tokens. A double-submitted form, a retry after a server error, or a second verification call on the same token returns
already-seen-response. Reset the widget after every failed submission so the visitor gets a new token. - Expired tokens.
expired-input-responsemeans the token aged out (120 seconds by default). This happens when the visitor solves the challenge and then fills in a long form before submitting. Render the challenge close to the submit step, or ask for a new token when the old one expires. - Wrong request format. "Do not send JSON data: the endpoint expects a standard URL-encoded form POST." A JSON body is a common reason a correct token fails verification.
- Hostname not allowlisted. Requests from a hostname that is not on your list fail with
invalid-input-response. Add every production and staging hostname you serve the widget from. - Testing on localhost. "The hCaptcha API also prohibits localhost and 127.0.0.1 as supplied hostnames." Test on a hostname that is on your list.
- Mismatched keys.
sitekey-secret-mismatchmeans the sitekey on the page and the secret on your server belong to different registrations. Check for mixed environment variables between staging and production.
If the widget never initializes and the console shows an error, check script-error first: the SDK did not load, which is often caused by a blocked api.js. Other bot checks fail in different ways. See Cloudflare's verify you are human loop, the press and hold captcha and reCAPTCHA v3 scores.
Visitor or owner?
Codes about tokens, hostnames and keys can only be fixed on the site's server. Codes about cookies, scripts and the network can usually be fixed in the visitor's browser or network.
What if you need a stable mobile connection for work?
A mobile proxy is not a captcha fix. VoidMob: mobile proxies on real 4G/5G devices, non-VoIP SMS verification and eSIM. Readers who need a steady mobile connection for legitimate work can rent a dedicated device. Each dedicated device is one real 4G/5G device per customer, and every session stays sticky until you rotate it yourself.
The shared pay-per-GB pool starts at $3.99 per GB, and dedicated devices start at $49 per month (VoidMob pricing, as of October 2026). If the proxy connection itself fails, with timeouts or authentication errors, see mobile proxy not working.
Why does hCaptcha give me a new challenge after I solve one?
hCaptcha's FAQ says a failed captcha is followed by a new one. Whether more appear depends on hCaptcha's confidence in the visitor, the site's difficulty setting and other security factors. With the Auto setting, a challenge is always shown, at varying difficulty.
Is hCaptcha down if the widget will not load?
A widget that never loads is a different problem from one that loops. hCaptcha's configuration docs describe script-error, where the SDK could not be loaded because the user may be behind a firewall that blocks api.js, and network-error, where hCaptcha retries several times before closing. Check that no extension or network firewall blocks hcaptcha.com, then contact the site.
How long does an hCaptcha rate limit last?
rate-limited is a developer code meaning the user has sent too many requests. Stop resubmitting the challenge, since each attempt is another request. If the site stays blocked, contact the site's support team or email [email protected].
Where do I appeal if I am stuck on someone else's site?
Contact the site first, because it controls its own difficulty and configuration. You can also email hCaptcha at [email protected]. Accessibility users can use the same address.
What does hCaptcha verification failed mean on my site?
On the server it usually points to the token. Tokens are single-use and expire after 120 seconds by default. The endpoint expects a URL-encoded form POST, not JSON. Hostnames must be on your list, localhost is not accepted, and the sitekey must match the secret.
Mobile connections on real 4G/5G devices
Dedicated devices you rotate on demand, or a pay-per-GB pool, for legitimate work that needs a stable mobile connection.