---
title: "What Is CAPTCHA? Why Does Verification Fail?"
description: "CAPTCHA is a short test a site uses to tell people from bots. We explain reCAPTCHA, Verification Failed, Invalid and Expired messages, and what to try first."
url: https://proxynet.io/blog/what-is-captcha
date: 2026-09-25
author: "Enver Kaya"
category: "Proxies, Tutorial"
lang: en
---

# What Is CAPTCHA? Why Does Verification Fail?

You are filling in a sign-up form. You tick "I'm not a robot" first, then spend a few minutes getting a password past the site's rules. When you press Submit, the page answers "CAPTCHA verification failed. Please try again." You scroll back up and the tick is gone: the box now says "Verification expired. Check the checkbox again."

This article explains what CAPTCHA means, what runs behind that box and how reCAPTCHA v2 and v3 differ. It then decodes the common error messages and lists what to try in order, so you can tell whether the problem sits in your browser, your network or the site.

> **Note: Short answer**
>
> CAPTCHA is a short test a website uses to check whether a form is being filled in by a person or by a program. A "verification failed", "Invalid Captcha" or "expired" message does not necessarily mean you were taken for a robot. Common causes are an approval that ran out (reCAPTCHA gives it two minutes), an extension that blocked the box, or a shared IP address that lowered your score. Reload, tick the box last, submit once and pause your ad blocker on that site.

## What does CAPTCHA mean?

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. A Turing test, named after the mathematician Alan Turing, asks whether a machine can pass for a person. A CAPTCHA turns the idea around: a computer sets the test, and a person should pass it while a program fails.

You meet it on sign-up and login forms, password resets, comment boxes and checkout pages, where it stops programs that open fake accounts in bulk, post spam or try thousands of passwords. It comes in four common forms:

- **Distorted text** typed from a warped image. This is what people mean by "CAPTCHA code".
- **Picture tasks**, such as picking every square that shows a bus.
- **A checkbox or slider**: one tick on "I'm not a robot", or a handle dragged to the right.
- **An invisible score** worked out in the background.

On many sites these are stages of one check: the more doubt, the more work you are asked to do. How that decision is made is covered in [CAPTCHA types and how they trigger](/blog/puppeteer-captcha), and the signals behind it in [Why does a CAPTCHA appear?](/blog/best-captcha-proxies-2026).

## How does a CAPTCHA work behind the scenes?

The box is usually not part of the site but a small window loaded from another company's servers. With Google's reCAPTCHA, these steps run between your click and the accepted form:

1. **The page loads the box from Google**, from `www.google.com/recaptcha` or the alternative address `www.recaptcha.net`. If an extension or network filter blocks that address, the box never appears.
2. **The box reads signals from your browser,** such as how the pointer moves, which cookies are present, how the browser describes itself. [How Bot Detection Works](/blog/how-bot-detection-works) explains how such signals become a decision.
3. **If in doubt, it sets a task**, usually a picture grid with an audio option.
4. **You receive a one-time approval code**, called a token. It works like the one-time code your bank sends by text message: it runs out quickly and works only once.
5. **The site asks Google about the code.** When you press Submit, the site's server sends the token to Google. Google's [response verification documentation](https://developers.google.com/recaptcha/docs/verify) states that each token is valid for two minutes and can be verified only once.
6. **The site accepts the form or prints its own error.**

Step 5 is where many forms fail. The check fails if more than two minutes pass between the tick and Submit, or if the same code arrives twice after a double click or the Back button.

## What is reCAPTCHA, and how do v2 and v3 differ?

reCAPTCHA is Google's CAPTCHA service, and sites choose between two main versions.

### reCAPTCHA v2: the checkbox

Version 2 is the "I'm not a robot" box. Many visitors pass with one click; when the box is unsure, it asks you to select all images with buses or bicycles. An invisible variant shows no box and opens the picture task only when it has doubts.

### reCAPTCHA v3: the invisible score

Version 3 never shows a task. It gives each action a score from 0.0 to 1.0: Google's v3 documentation (checked in September 2026) says 1.0 is very likely a person, 0.0 very likely a bot, and sites can start with a threshold of 0.5. Below its threshold, a site may reject the form or ask for an extra step, which is how you get "verification failed" without seeing a puzzle. A small reCAPTCHA badge in a corner, or the line "This site is protected by reCAPTCHA", marks an invisible version.

In April 2026 Google placed reCAPTCHA inside a wider product, Google Cloud Fraud Defense. Google says existing site keys and integrations stay as they are, so the box you see does not change.

### What is recaptcha.net?

`www.recaptcha.net` serves the same reCAPTCHA from a second address, which Google's [reCAPTCHA FAQ](https://docs.cloud.google.com/recaptcha/docs/faq) says sites can use when `www.google.com` is not accessible to their users. It is not spyware; if it appears in your iPhone's privacy report, a site you opened loaded its CAPTCHA from there.

## What is Yandex SmartCaptcha?

SmartCaptcha is Yandex's CAPTCHA service. According to its [description of the challenge types](https://yandex.cloud/en/docs/smartcaptcha/concepts/tasks), the main challenge is an "I am not a robot" checkbox or a slider. If the attempt looks suspicious, a second task follows: typing distorted text, marking icons in order or rebuilding a picture with a slider. Most of the steps below apply to it too.

Cloudflare's "Verifying you are human" screen and Turnstile box are a separate system, covered in [Cloudflare Verifying You Are Human](/blog/cloudflare-verify-you-are-human).

## What do CAPTCHA error messages mean?

Messages inside the box, such as "Verification expired. Check the checkbox again.", come from Google. Messages around the form, such as "Invalid Captcha" or "Captcha Required", are written by each site, so one problem turns up under many phrasings.

| Message | Meaning | Usual source | Try first |
|---|---|---|---|
| "Verification expired", "Invalid-Expired Captcha", "timeout-or-duplicate" | Code older than two minutes, or already used | You: form left open, Submit pressed twice | Tick again, submit once |
| "Captcha Required", "This field is required" | Form arrived with no code | You, or a browser that blocked the box | Tick the box, or pause the ad blocker |
| "CAPTCHA verification failed" | Code expired, reused or scored too low | You, your network (shared IP, VPN) or the site | Tick again, submit once, then VPN off |
| "Invalid Captcha", "Incorrect Captcha" | Typed text wrong, or code damaged | You, or a half-loaded box | New image, type carefully |
| "Cannot contact reCAPTCHA", endless spinner | Google's address unreachable | Browser or network filter | Private window, other network |
| "ERROR for site owner: Invalid domain for site key" | reCAPTCHA set up wrongly | The site | Send the site a screenshot |

### "CAPTCHA verification failed"

The site asked Google about your code and did not get a clear yes. With the checkbox, the code likely expired or was reused. With the v3 score, your visit fell under the threshold, and your network is the first place to look.

### "Captcha Required" and "This field is required"

The form arrived without an approval code: you pressed Submit before ticking the box, or the box never loaded. If there is no box on the page at all, suspect an ad blocker or privacy extension.

### "Invalid Captcha" and "Incorrect Captcha"

On text forms, what you typed did not match the image. On checkbox forms, the code arrived damaged or empty.

### "Verification expired" and "timeout-or-duplicate"

When the approval runs out, the box clears your tick and shows the expired line. "timeout-or-duplicate" is Google's reply when the site sends it a code that is too old or already used, and some sites print it as it is.

### "Cannot contact reCAPTCHA" or a box that never loads

The full line is "Cannot contact reCAPTCHA. Check your connection and try again." Your browser cannot reach Google's servers, usually because of an extension, disabled JavaScript or a work or school network filter.

### "ERROR for site owner"

A line in the box such as "ERROR for site owner: Invalid domain for site key" means the site configured reCAPTCHA wrongly. Nothing in your browser fixes it; send the site a screenshot.

## Why does CAPTCHA verification fail?

The causes fall into three groups: your browser, your network and the site.

**Your browser.** Ad blockers and privacy extensions block scripts from other companies' servers, including the CAPTCHA box. JavaScript may be off, or strict settings may block every cookie. Google's reCAPTCHA help also lists support only for the two most recent major versions of Chrome, Firefox, Safari and Edge on desktop.

**Your network.** On dormitory, office and many mobile connections, a large group of people shares one IP address, and if some run automated tools, everyone on it can score lower ([What Is CGNAT?](/blog/what-is-cgnat)). VPN exit addresses are shared the same way and draw more checks ([VPN or Proxy Detected Error](/blog/vpn-or-proxy-detected)). Many attempts in a short time lower the score further.

**The site.** A wrong key, a domain missing from the site's reCAPTCHA settings or a form that submits itself twice fails for every visitor. A box that returns on every Google search is a different page, covered in [Google Unusual Traffic Error](/blog/google-unusual-traffic-error).

## What should you try, in order, when CAPTCHA verification fails?

1. **Reload and tick the box last.** Fill in every field, tick "I'm not a robot" at the end and press Submit once, within two minutes.
2. **Pause the ad blocker for this site.** Most blockers have a per-site switch under their toolbar icon. To test, open a private window, where extensions are usually off (Chrome: three-dot menu > **New Incognito window**).
3. **Allow JavaScript.** In Chrome, go to **Settings > Privacy and security > Site settings > JavaScript** and allow it, at least for this site.
4. **Update the browser** from the "About" page in its menu.
5. **Turn off your VPN** app or extension and reload the form.
6. **Try another network.** Use mobile data instead of Wi-Fi. If the form goes through, the first network's address was likely the issue; [How to Change Your IP Address](/blog/how-to-change-ip-address) lists your options.
7. **Test another page with reCAPTCHA.** If the box works elsewhere and fails only here, the problem is on the site: send its support team a screenshot, the time and your browser name.

## What if you cannot see the images or hear the audio?

On a reCAPTCHA picture task, press the audio challenge button under the images, press PLAY and type the numbers you hear. Google's help pages say reCAPTCHA works with the ChromeVox, JAWS, NVDA and VoiceOver screen readers.

Audio is not a full answer. The W3C note [Inaccessibility of CAPTCHA](https://www.w3.org/TR/turingtest/) (December 2021) explains that visual tests shut out blind and low-vision users and people with dyslexia, while audio tests shut out deaf, hard-of-hearing and deaf-blind users. If neither works for you, ask the site for another check, such as a phone call or an email link, rather than installing a "solver" extension.

## Where will you run into CAPTCHA and similar checks?

- **Google search:** an "unusual traffic" page, explained in [Google Unusual Traffic Error](/blog/google-unusual-traffic-error).
- **Cloudflare:** a "Verifying you are human" screen, explained in [Cloudflare Verifying You Are Human](/blog/cloudflare-verify-you-are-human).
- **YouTube:** a request to sign in and confirm you are not a bot, explained in [YouTube Confirm You're Not a Bot Error](/blog/youtube-not-a-bot-error).
- **A block with no box:** entry refused outright, explained in [Sorry, You Have Been Blocked](/blog/sorry-you-have-been-blocked).
- **"Access Denied":** a refusal page with a reference number, explained in [Access Denied Error on Websites](/blog/access-denied-error).
- **VPN warnings:** sites that refuse a VPN address instead of testing it, explained in [VPN or Proxy Detected Error](/blog/vpn-or-proxy-detected).
- **Businesses collecting data with software:** here a CAPTCHA is a stop sign. The legitimate route is a slower request rate, the official API and the site owner's permission; our [data scraping](/data-scraping) page shows how that work is set up. No proxy or tool removes CAPTCHA, and none should be used to try.

## Common mistakes

- **Installing a "CAPTCHA solver" extension.** Such extensions usually ask to read and change your data on every website, your bank and email included.
- **Pressing Submit several times.** The code works once, so the second press sends a used one.
- **Ticking the box before filling in the form.** Slow typing lets the two minutes run out.
- **Resubmitting with the Back button.** The browser may send the already checked code again.
- **Turning on a VPN to fix it.** A shared VPN address usually brings more checks; [Proxy vs. VPN](/blog/proxy-vs-vpn) explains what a VPN changes.
- **Following a check that asks you to paste a command.** A real CAPTCHA never tells you to press Windows+R or paste text into a terminal; fake check pages use that step to install malware.

## Decision guide

| Need | Recommendation |
|---|---|
| The box was ticked, but Submit brought "expired" | Reload, tick the box last, submit once within two minutes |
| The box never appears or keeps spinning | Pause blockers for the site, allow JavaScript, update the browser |
| "Verification failed" with no task, VPN on | Turn off the VPN or try mobile data |
| Error on one site only, or "ERROR for site owner" | Send the site's support team a screenshot |
| You cannot see the images or hear the audio | Try the audio task, then ask the site for another check |

For any other case, work through the numbered steps above in order.

## Frequently asked questions

### What is CAPTCHA used for?

It stops programs at the door of a form: bots that open fake accounts, post spam or try stolen passwords. It protects the site and its users rather than judging you, which is why real visitors see it too.

### What is a CAPTCHA code?

It is the distorted string of letters and numbers in an image that some forms ask you to type. Whether capitals count depends on the site; if you cannot read it, press the reload button next to the image.

### What is recaptcha.net, and why does it appear on my iPhone?

Google uses it as an alternative address to serve reCAPTCHA. Apple's [App Privacy Report](https://support.apple.com/en-us/102188), under Settings > Privacy & Security on iOS 15.2 or later, lists domains contacted by websites you visited within apps in the past seven days.

### What does "timeout-or-duplicate" mean?

Google sends this reply to a site when the approval code is more than two minutes old or has already been checked. It is not a ban. Reload the form, tick the box last and press Submit once.

### The CAPTCHA will not load and the box never appears. What should I do?

Pause your ad blocker for the site, allow JavaScript and try a private window, then another network. If the box works on other sites but not on this one, the site's setup is the likely cause.

### Why is one click on "I'm not a robot" enough?

The click is not the whole test. Before and while you click, the box reads signals from your browser and your connection. When nothing looks unusual it lets you through; when something does, it opens a picture or audio task.

## Summary

CAPTCHA is a short test that separates people from programs at a site's forms. Common causes of failure are an approval code that expired or was sent twice, an extension that blocked the box, or a shared address that lowered the score. Reload, tick the box last, submit once and pause your blocker; if the box says "ERROR for site owner", tell the site. If your team works with IP addresses for business, our [proxy services](/proxy) page explains the address types.