A CAPTCHA page instead of your website: why it shows up and what to do
PrintThe main point: a page asking you to tick a box or solve a small test does not mean the website is broken. It is the protection system making sure a person, not a program, is sending the requests. A real visitor gets through in a few seconds and lands on the site.
How the filtering works
The server's protection watches how each IP address behaves. When an address sends a burst of requests in a short time, or appears on lists of addresses known for abuse, it is put under temporary watch. Rather than block it outright, the server shows it a CAPTCHA check: a person passes, a simple bot does not.
The usual reasons
A script or tool sending too many requests
An SEO crawler you started yourself, an uptime monitor checking the site every few seconds or an import script can look to the server exactly like a bot. Slow it down or ask for an exception for the tool's IP address.
An IP address with a poor reputation
VPNs, public Wi-Fi in cafes or hotels and some mobile networks put many people behind a single IP address. If one of them misbehaved, the others may see the check too. Solve the test or switch to another connection.
An attack in progress
While an attack is under way, filtering gets stricter for a while so the server stays available. Once the attack is over, the checks go away on their own.
A legitimate service talking to the website directly
Sometimes the filter catches a service that has no way to solve a CAPTCHA: a payment system posting payment confirmations to a shop, an outside application connected through an API, or a monitoring service. These need an exception.
Asking for an exception
- Find the public IP address the requests come from. For outside services, the address list is usually in their documentation.
- Open a ticket with the IP address, the website's domain and what the service does.
- If you only need the exception for a specific job, such as moving a website, say how long it will take. A temporary exception is safer than a permanent one.
Common questions
Are Google and other search engines affected?
Bots from genuine search engines should not be held up by the check. If crawl errors suddenly appear in Google Search Console, let us know and we will look at the logs.
My customers keep seeing the check. What now?
Send us the domain, the IP address of an affected customer if you have it, and the time the check appeared. We will find out why the filter fired and whether it needs adjusting.
Can I limit bots myself so it does not come to this?
Yes. Well-behaved bots can be kept out with robots.txt, and the ones that ignore it can be refused in .htaccess. The steps are in too many bots on your website.
Does the check appear in cPanel or for mail?
No, there is no test there. If you cannot connect to cPanel, FTP or mail at all, the firewall has most likely blocked your IP address after several wrong passwords. See why the firewall blocks an IP address.
