Why reCAPTCHA Keeps Asking You to Click Images
Short answer
reCAPTCHA scores every session before showing anything. The image grid appears only when that score is too low to pass you silently, and it repeats because each hesitant or slow answer lowers the score further. Disconnecting a VPN, allowing cookies for the site, or switching from office Wi-Fi to mobile data usually breaks the loop within one attempt.
On this page
The loop is familiar. Click the checkbox, get a grid of blurry crosswalks, solve it, get another grid, solve that, get a third. Nothing you clicked was wrong.
reCAPTCHA is not testing whether you can recognise a bus. It decided you were probably suspicious before the grid appeared, and the grid is what it shows when it cannot resolve that suspicion any other way.
The checkbox is not the test
When a page loads reCAPTCHA, the script starts collecting signals immediately, long before you touch anything. By the time you click I’m not a robot, the engine already has a risk score and the click simply tells it to act on that score.
Three outcomes follow:
| Score | What happens |
|---|---|
| High confidence you are human | Checkbox ticks green, no puzzle |
| Borderline | One image grid, usually passed on first attempt |
| Low | Repeated grids, often the fading-tile variant |
If you have ever watched someone else tick the box and sail through on the same page that has trapped you for five minutes, this is why. The page is identical. The session is not.
What drags the score down
The engine is looking for signals that distinguish a long-lived, ordinary browsing session from freshly spun-up automation.
No cookie history. This is the big one. reCAPTCHA sets cookies on
google.com and reads them across every site using the service. Block
third-party cookies, browse in a private window, or clear cookies regularly, and
every visit looks like a first visit from an unknown party.
A shared or disreputable IP address. VPN exit nodes, data-centre ranges, corporate NAT and some mobile carriers aggregate huge numbers of users behind one address. Automated traffic from any of those users degrades the address’s reputation for everyone else on it.
An unusual browser fingerprint. Anti-fingerprinting extensions, spoofed user agents, headless-browser markers, and unusual font or canvas behaviour all reduce confidence. Hardened privacy configurations score poorly precisely because they succeed at their goal.
Interaction that reads as scripted. Perfectly linear cursor movement, form fields filled instantly, or no pointer movement at all before the click. Touch devices are handled differently, so this matters more on desktop.
Not being signed in to Google. Not required, but a signed-in session with account history is the strongest positive signal the engine has access to.
Why solving correctly does not always help
Here is the mechanic that produces the loop. Each challenge returns not just “right or wrong” but a measurement of how you solved it: timing per tile, pointer path, hesitation, corrections.
A clean solve at human pace raises the score. A solve that is very fast, very slow, or mouse-less lowers it. So a low-scoring session can answer three grids perfectly and still be asked for a fourth, because the answers were correct but the behaviour around them did not move the needle.
The fading-tile variant, where solved squares are replaced by new images, is the engine explicitly buying more observation time. It is a sign the score is low, not that the first answer was wrong.
Breaking the loop
Try these in order. Stop as soon as one works.
- Disconnect the VPN. The single highest-yield change. Reconnect after the form is submitted.
- Allow cookies for the site and for
google.com. In Chrome, Settings → Privacy and security → Third-party cookies → Allow for the specific site. Not globally. - Leave the private window. Incognito discards exactly the history reCAPTCHA wants to read, which is worth understanding alongside what incognito mode genuinely hides.
- Switch networks. Mobile data instead of office Wi-Fi, or home broadband instead of a hotspot. A different result confirms the address was the issue.
- Disable anti-fingerprinting extensions for that tab only.
- Wait ten minutes and reload. Scores have a time component and borderline sessions frequently clear on their own.
Pause on step three if you are on a shared or public machine. The reason you opened a private window may matter more than the convenience.
What has no effect
- Clearing your cache. reCAPTCHA reads cookies, not cached files, and clearing a cache fixes a narrower set of problems than the internet generally believes.
- Reinstalling the browser. This destroys cookie history, which makes the score worse.
- Changing your password or Google account. No input to the scoring.
- Clicking faster. Past a point, speed is itself a negative signal.
- CAPTCHA-solving browser extensions. Most are either ineffective or are harvesting your browsing data, and some violate the site’s terms outright.
The accessibility route
Every reCAPTCHA widget includes a headphone icon that switches to an audio challenge: a short spoken sequence of digits you type in. It exists for users who cannot use the visual grid, and it is usually quicker.
It is also the challenge most vulnerable to automated transcription, so sites under heavy attack sometimes rate-limit or disable it. If the audio option is greyed out, that is why.
The honest limitation
You cannot have both strong browser privacy and a smooth CAPTCHA experience. The two goals are in direct opposition: one works by making you unrecognisable across sites, the other by recognising you across sites.
The workable compromise for most people is a hardened default browser plus one stock profile kept for banking, ticketing and government forms, the places that run the strictest thresholds and where a failed challenge costs you something real.
What normal looks like
On home broadband in a stock browser, reCAPTCHA should be invisible most of the time, with an occasional single grid on high-risk pages such as account creation or ticket sales. One grid, solved once, is working as designed.
Three or more grids per attempt, every time, means the score is persistently low. The cause is nearly always the VPN or the cookie policy. Change one of those and the difference is immediate rather than gradual — which is a useful way to confirm you found the right cause.