CAPTCHA (en web scraping)
Una prueba de desafío-respuesta que los sitios usan para distinguir usuarios humanos de bots; se activa con frecuencia por la actividad de scraping.
CAPTCHA significa Completely Automated Public Turing test to tell Computers and Humans Apart. En la práctica, es una barrera que los sitios ponen ante los usuarios que sospechan que son bots - exigiendo reconocimiento de imágenes, resolución de puzles o interacción con una casilla.
Los CAPTCHA se activan durante el scraping por varias razones: demasiadas solicitudes desde una IP, rangos de IP de centros de datos, cabeceras de navegador ausentes, huellas TLS inconsistentes y patrones de tiempo de solicitud inusuales.
La forma más eficaz de reducir la frecuencia de CAPTCHA es usar proxies residenciales o móviles en lugar de IPs de centro de datos. El tipo de ASN es una de las primeras señales que comprueban los sistemas de CAPTCHA. Las IP residenciales de ISP reales activan CAPTCHA mucho menos que las de centro de datos.
Cuando aparecen CAPTCHA, hay dos enfoques principales: servicios de resolución de CAPTCHA (2Captcha, Anti-Captcha) que usan humanos o modelos de ML para resolverlos de forma programática, y la evasión basada en comportamiento que imita los patrones de navegación humanos lo suficiente como para no activar el desafío.
reCAPTCHA v3 de Google evalúa las solicitudes de forma invisible, sin mostrar un desafío - asigna una puntuación de riesgo (0-1) basada en el comportamiento. Una puntuación por debajo de 0,5 puede activar comprobaciones adicionales. Los proxies residenciales combinados con huellas de navegador realistas mantienen altas las puntuaciones de reCAPTCHA v3.
A challenge is a score, not a verdict
A CAPTCHA appears when a site is uncertain. Systems like reCAPTCHA and Turnstile score every visit on address reputation, TLS fingerprint, browser consistency and behaviour, then challenge the requests that land in the middle band. Confident blocks return 403 instead.
That makes a CAPTCHA useful information: you are close to passing. Something in your setup is off, but not so far off that the site refuses outright.
Modern challenges are frequently invisible. A score high enough passes without any interaction, which is why the same page shows a puzzle to one client and nothing to another. Solving services address the visible ones and do nothing about the score that produced them.
Moving the score instead of solving the puzzle
Most CAPTCHA problems in scraping come from one of three places, and only one of them is the address:
What to change first
Datacenter address on a protected site -> switch to residential or ISP
Python TLS fingerprint -> use a real browser or curl-impersonate
Too many requests too fast -> slow down, spread across addresses
# Verify the address is not the problem:
curl -x login_c_US:password@proxy.sotaproxy.com:10000 https://ipinfo.io/json- Test with a real browser through the same address. If the browser passes and your script does not, the address was never the issue.
- Residential and mobile addresses score better than hosting ranges, which is often enough to move a borderline case under the threshold.
- Solving services are a cost per challenge and do nothing to stop the next one. Fixing the score reduces how often you meet them.
- Persistent profiles help: an account with history and cookies scores better than a fresh visitor every time.
CAPTCHA misconceptions
A CAPTCHA is not a ban
It is an uncertain score. The same setup often passes after a small change in pacing or fingerprint.
Better proxies do not always help
If your client announces itself as a script in the handshake, the address cannot rescue it.
Solving them is not a strategy
It treats the symptom at a per-challenge price and leaves the cause untouched.
Invisible challenges exist
Not seeing a puzzle does not mean you were not scored. Silent failures often mean you scored badly and got reduced content.
Términos relacionados
Ver esto en práctica
¿Listo para usar captcha (en web scraping)?
SotaProxy te da acceso a proxies residenciales rotativos, móviles, de centro de datos e ISP. Sin compromiso mínimo.
Empezar