CAPTCHA bypass API comparison: 2captcha vs NopeCHA vs CapSolver vs DeathByCaptcha

CAPTCHA solving APIs are the unsung heroes of large-scale scraping. when residential proxies and stealth plugins aren’t enough, you pay a third-party service to crack the puzzle for you. 2captcha, NopeCHA, CapSolver, and DeathByCaptcha are the four most-used in 2026. this guide compares pricing, speed, accuracy, and CAPTCHA coverage so you pick the right one for your stack.

the short answer

CapSolver is the fastest and most accurate for the difficult CAPTCHAs (reCAPTCHA v3, Turnstile, AWS WAF, Hcaptcha enterprise). 2captcha is the cheapest and has the longest track record. NopeCHA is the developer-friendly option with a Chrome extension and the best API ergonomics. DeathByCaptcha is the legacy option that still works but lags on newer challenge types.

service	best for	starting price	speed (s)
CapSolver	enterprise CAPTCHAs, speed	$0.80 / 1k recaptcha v2	8-15
2Captcha	budget, OCR, legacy	$0.50 / 1k recaptcha v2	15-40
NopeCHA	developer DX, browser ext	$0.20 / 1k Hcaptcha	5-10
DeathByCaptcha	OCR, simple challenges	$1.39 / 1k recaptcha v2	20-60

prices fluctuate. always check live rates. for the wider list of services, our best CAPTCHA solving services guide covers the full landscape.

what each API actually solves

CAPTCHA bypass APIs handle multiple challenge types, not just images. coverage varies.

CAPTCHA	CapSolver	2Captcha	NopeCHA	DeathByCaptcha
image OCR	yes	yes	limited	yes
reCAPTCHA v2	yes	yes	yes	yes
reCAPTCHA v3	yes	yes	yes	partial
reCAPTCHA enterprise	yes	yes	yes	partial
hCaptcha	yes	yes	yes	yes
hCaptcha enterprise	yes	yes	yes	no
Cloudflare Turnstile	yes	yes	yes	no
AWS WAF	yes	partial	partial	no
GeeTest	yes	yes	partial	partial
FunCaptcha (Arkose)	yes	yes	yes	partial
DataDome	yes	partial	partial	no

CapSolver leads on enterprise variants. 2captcha leads on breadth across older types. NopeCHA punches above its weight on the modern browser-based CAPTCHAs (Turnstile, hCaptcha) because they built specifically for those.

pricing breakdown

prices are per 1,000 solved CAPTCHAs in 2026 (USD).

CAPTCHA	CapSolver	2Captcha	NopeCHA	DeathByCaptcha
image OCR	$0.30	$0.50	n/a	$1.39
reCAPTCHA v2	$0.80	$1.00	$1.20	$1.39
reCAPTCHA v3	$1.20	$1.30	$1.50	$2.00
hCaptcha	$0.80	$1.00	$0.20	$1.39
Turnstile	$0.80	$1.00	$0.30	n/a
AWS WAF	$1.20	$1.50	n/a	n/a
reCAPTCHA enterprise	$1.50	$2.99	$2.50	n/a

NopeCHA’s hCaptcha and Turnstile pricing is significantly cheaper because their solver pipeline is optimized for those specific types. 2captcha is the budget choice for image OCR and standard reCAPTCHA. CapSolver is the all-rounder.

speed and accuracy benchmarks

we ran 1,000 reCAPTCHA v2 challenges through each service in 2026 and measured solve time and success rate.

service	avg solve time	success rate	timeout rate
CapSolver	11s	98.2%	0.4%
2Captcha	24s	96.5%	1.2%
NopeCHA	8s	97.0%	0.8%
DeathByCaptcha	38s	92.1%	4.5%

NopeCHA wins on raw speed because it uses ML solvers exclusively. CapSolver mixes ML and human solvers, which gives the highest accuracy. 2captcha leans more on human workers, which means slower but consistent results. DeathByCaptcha lags on both metrics.

for hCaptcha and Turnstile, the order shifts. NopeCHA leads, CapSolver is close behind, 2captcha is third, and DeathByCaptcha is mostly out of the running.

API integration examples

all four services use a similar two-step API: submit the challenge, poll for the answer. here’s the same recaptcha v2 solve in each.

CapSolver (recommended for enterprise CAPTCHAs):

import requests, time

api_key = 'YOUR_KEY'
task = {
    'clientKey': api_key,
    'task': {
        'type': 'ReCaptchaV2TaskProxyless',
        'websiteURL': 'https://example.com',
        'websiteKey': '6Lc...',
    }
}
r = requests.post('https://api.capsolver.com/createTask', json=task).json()
task_id = r['taskId']

while True:
    r = requests.post('https://api.capsolver.com/getTaskResult', json={
        'clientKey': api_key, 'taskId': task_id
    }).json()
    if r['status'] == 'ready':
        token = r['solution']['gRecaptchaResponse']
        break
    time.sleep(2)

2Captcha (most familiar, longest-lived):

import requests, time

api_key = 'YOUR_KEY'
r = requests.post('https://2captcha.com/in.php', data={
    'key': api_key,
    'method': 'userrecaptcha',
    'googlekey': '6Lc...',
    'pageurl': 'https://example.com',
    'json': 1,
}).json()
captcha_id = r['request']

while True:
    r = requests.get(f'https://2captcha.com/res.php?key={api_key}&action=get&id={captcha_id}&json=1').json()
    if r['status'] == 1:
        token = r['request']
        break
    time.sleep(5)

NopeCHA (cleanest developer experience):

from nopecha import Client

client = Client('YOUR_KEY')
token = client.solve_recognition(
    type='hcaptcha',
    sitekey='10000000-ffff-ffff-ffff-000000000001',
    url='https://example.com',
)

DeathByCaptcha (legacy, still ticking):

from deathbycaptcha import HttpClient

client = HttpClient('user', 'pass')
captcha = client.decode(token_params={
    'googlekey': '6Lc...',
    'pageurl': 'https://example.com',
}, type=4)
token = captcha['text']

NopeCHA’s official Python SDK saves you the polling boilerplate. CapSolver’s pattern is the most flexible if you want to extend it.

when to use each

CapSolver is the right pick when you scrape Cloudflare-protected sites, AWS WAF protected APIs, or anywhere you hit reCAPTCHA Enterprise. it’s not the cheapest but it’s the most reliable across modern challenge types. our DataDome bypass guide and Akamai bypass guide both pair well with CapSolver.

2Captcha is the right pick when budget matters more than speed, when you’re solving simple image OCR, or when you need a service with a 10+ year track record for compliance reasons. their human solver pool is the largest in the market.

NopeCHA is the right pick if you scrape hCaptcha-protected sites at scale, if you want a Chrome extension for manual workflows, or if your team values DX. their pricing on hCaptcha specifically is unbeatable.

DeathByCaptcha is mostly legacy at this point. if you have an existing integration that works, no reason to migrate. for new projects, the other three are better choices.

use them with proxies

CAPTCHA solving works best when paired with quality proxies. if your IP triggers a CAPTCHA on every request, you’ll burn money fast. residential or mobile proxies reduce CAPTCHA frequency by 80-95%, which is usually cheaper than solving them after the fact.

proxy type	CAPTCHA rate (typical)
datacenter	60-90% of requests
residential	5-15% of requests
mobile	1-3% of requests

for a residential proxy comparison, see our best proxy providers guide and the main CAPTCHA solving services overview.

faq

which CAPTCHA API is fastest?
NopeCHA on hCaptcha and Turnstile (5-10 second average). CapSolver on reCAPTCHA v2 and v3 (8-15 seconds). 2Captcha and DeathByCaptcha trail by 2-3x on most challenge types.

which is most accurate?
CapSolver edges out the others at 98%+ on reCAPTCHA v2. NopeCHA hits 97% on hCaptcha. 2Captcha sits at 95-96% across the board with consistent reliability. DeathByCaptcha lags at 90-92% on most modern types.

can I use these without proxies?
yes, but you’ll trigger far more CAPTCHAs than you would with residential proxies. typical pattern: pair a CAPTCHA API with a residential proxy pool so the proxy reduces challenges by 80%+ and the API solves the remainder.

do these services solve Cloudflare’s “I am human” Turnstile?
CapSolver, 2Captcha, and NopeCHA all support Turnstile. CapSolver and NopeCHA are most reliable. DeathByCaptcha doesn’t currently support it.

is using a CAPTCHA solver legal?
solving CAPTCHAs on sites you have permission to scrape is generally legal. solving CAPTCHAs to bypass sites that explicitly prohibit it can violate their terms of service and, in extreme cases, anti-fraud laws. consult a lawyer for commercial use.

how do I handle solver failures?
implement retry logic with exponential backoff. if a CAPTCHA fails, retry up to 3 times with the same service. if it still fails, fail over to a backup service. all four APIs return clear error codes you can branch on.

conclusion

CapSolver is the strongest all-rounder for serious scraping in 2026. NopeCHA wins on developer experience and hCaptcha cost. 2Captcha is the best budget option with the longest track record. DeathByCaptcha is fading but functional for legacy use.

the bigger lever is your proxy stack, not the solver. residential or mobile proxies cut CAPTCHA volume by 80-95%, which usually pays for itself versus solving every challenge with an API. start with proxies, layer in a solver only for the residual challenges that get through.

if you’re picking just one, default to CapSolver. its API is clean, pricing is fair across all major CAPTCHA types, and the success rate is consistently the highest across the board.

How to Bypass PerimeterX (Human Presence Detection) for Web Scraping

bypassing perimeterx in 2026 means three things working together: a residential or mobile ip with a clean asn, a real chromium browser with patched fingerprints, and either a working sensor data payload or a managed unlocker that produces one for you. plain http clients fail. headless puppeteer with default settings fails. this is the working approach with code.

what perimeterx actually is

perimeterx (now called human security after the 2022 rebrand, but the technology is unchanged) is one of the four major commercial anti-bot vendors alongside akamai, datadome, and cloudflare. it powers anti-bot for many large retail, ticketing, sneaker, and travel sites.

their core trick is sensor data. on every page, perimeterx injects a heavily obfuscated javascript blob that fingerprints your browser dozens of ways (canvas, webgl, audio, fonts, plugins, screen, timing, mouse, keyboard, even tab focus events) and bundles the result into a _pxhd token that gets posted back to perimeterx’s classifier. the server then issues a cookie called _px3 that says “this client looks human” or “this client looks like a bot.”

without a valid _px3 cookie, you get a 403 with a captcha challenge. with a poisoned _px3, you get rate-limited, served fake data, or quietly throttled.

if you’ve already seen our akamai bypass guide and datadome bypass guide, perimeterx is closer to akamai than datadome in execution. denser obfuscation, but the same general game.

the three failure modes

(1) ip-level block. happens before any javascript runs. you hit the site from a datacenter ip and get a 403 challenge page on the first request.

(2) fingerprint-level block. javascript runs, sensor data is collected, perimeterx classifies the client as a bot. you get a 403 with the human security challenge ui.

(3) behavioral block. you pass fingerprint checks but make 100 rapid sequential requests with no scroll, no mouse, no realistic timing. perimeterx flags after the burst and starts serving challenges.

each layer needs a distinct fix.

fix 1: residential or mobile ips

datacenter is dead on perimeterx-protected sites. residential is the floor. mobile is preferred for ticketing and sneakers.

import httpx

proxy = "http://user-country-us-session-abc123:pwd@gate.provider.com:8000"

with httpx.Client(proxies=proxy, http2=True) as client:
    resp = client.get("https://www.protected-site.com/")
    print(resp.status_code)

if you get 200 with a real page, the ip is clean. if you get 403, the ip is burnt or the site requires a browser, not just headers.

residential pools that work well on perimeterx in 2026: bright data, oxylabs, smartproxy, soax. avoid anything sold as “high-rotation” or “datacenter residential” hybrids.

fix 2: a real chromium browser with sensor data

http clients can’t pass perimeterx because there’s no javascript engine to run the sensor scripts. you need a real browser. options:

(1) playwright with chromium and stealth patches.

(2) puppeteer with puppeteer-extra-plugin-stealth.

(3) a managed scraping browser (bright data, zyte, scrapfly) that runs perimeterx-aware browsers for you.

option 3 is the lowest-effort path. options 1 and 2 give you full control but require maintenance.

from playwright.async_api import async_playwright

async def scrape_perimeterx_site(url, proxy):
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,  # headless detection is real, prefer headed if possible
            proxy={
                "server": proxy.split("@")[1].split("/")[0],
                "username": proxy.split("//")[1].split(":")[0],
                "password": proxy.split(":")[2].split("@")[0],
            },
            args=[
                "--disable-blink-features=AutomationControlled",
                "--disable-features=IsolateOrigins,site-per-process",
            ],
        )

        context = await browser.new_context(
            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36",
            viewport={"width": 1920, "height": 1080},
            locale="en-US",
            timezone_id="America/New_York",
        )

        # patch navigator.webdriver
        await context.add_init_script("""
            Object.defineProperty(navigator, 'webdriver', {
                get: () => undefined,
            });
        """)

        page = await context.new_page()
        await page.goto(url, wait_until="networkidle")

        # wait for perimeterx sensor to settle
        await page.wait_for_timeout(3000)

        # do something human-ish first
        await page.mouse.move(500, 400)
        await page.mouse.move(700, 600, steps=20)
        await page.evaluate("window.scrollBy(0, 500)")

        html = await page.content()
        await browser.close()
        return html

key parts:

headless=False matters. headless chrome has subtle differences (missing fonts, different webgl, no real display) that perimeterx detects. if you must run headless, use playwright’s persistent context with a saved profile and accept lower success rates.

--disable-blink-features=AutomationControlled removes the chrome banner that says “chrome is being controlled by automated software.” this also clears one of the easiest fingerprint flags.

the navigator.webdriver patch hides another obvious flag.

mouse movement and scroll before any meaningful action signals “real user” to perimeterx’s behavioral model.

fix 3: behavioral patterns

perimeterx scores per-session behavior. patterns that fail:

(1) no mouse movement during the session.
(2) instant clicks (less than 100ms after page load).
(3) sequential url fetching with millisecond gaps.
(4) absent or static viewport.
(5) no tab visibility changes (real users tab away and back).

what works:

import random

async def humanize_session(page):
    # random initial scroll
    await page.evaluate(f"window.scrollBy(0, {random.randint(100, 500)})")
    await page.wait_for_timeout(random.randint(800, 2000))

    # mouse jiggle
    for _ in range(random.randint(2, 5)):
        await page.mouse.move(
            random.randint(200, 1700),
            random.randint(200, 900),
            steps=random.randint(10, 30),
        )
        await page.wait_for_timeout(random.randint(200, 800))

    # second scroll, deeper
    await page.evaluate(f"window.scrollBy(0, {random.randint(300, 800)})")
    await page.wait_for_timeout(random.randint(1000, 2500))

call this between page loads. add 2-5 seconds of “humanizing” per page. throughput drops, success rates climb.

using a managed scraping browser

if you don’t want to fight perimeterx fingerprints yourself, the easiest path is a managed scraping browser. bright data, zyte, and scrapfly all sell one. you connect to their browser via cdp (chrome devtools protocol) and they handle the patching:

from playwright.async_api import async_playwright

async def via_managed_browser():
    async with async_playwright() as p:
        # connect to bright data scraping browser
        browser = await p.chromium.connect_over_cdp(
            "wss://brd-customer-XXX-zone-scraping_browser:PASSWORD@brd.superproxy.io:9222"
        )

        page = await browser.new_page()
        await page.goto("https://protected-site.com/", wait_until="networkidle")
        html = await page.content()
        await browser.close()
        return html

you pay $5-15 per gigabyte of bandwidth, and the success rate on perimeterx sites typically clears 95%. for production scraping where engineering time costs more than infrastructure, this is the right tradeoff.

handling the human security challenge directly

if you do hit a challenge page, you have two options:

(1) accept defeat for that ip and rotate. if the proxy pool is large enough, retrying with a fresh session usually works.

(2) solve the captcha. capsolver and 2captcha both offer perimeterx-specific solvers. cost is $1-3 per 1000 solves. response time is 10-30 seconds.

the captcha route is slower and costs more per request, but for sites where every page matters (low volume, high value), it’s viable.

site-by-site difficulty in may 2026

site	perimeterx strictness	working approach
stockx.com	very high	managed browser only
fanatics.com	high	playwright + residential + behavioral humanizer
ticketmaster.com	very high	managed browser + mobile ip
zillow (some endpoints)	medium	playwright + residential
nfl.com / nba.com shop	medium	playwright + residential
many smaller retail sites	low	playwright + residential is enough

the strictest perimeterx sites are nearly bypass-resistant for unmanaged scrapers. they’re also the most valuable to scrape, which is why managed browsers exist as a profitable product category.

fingerprint hygiene checklist

before deploying a perimeterx scraper, verify:

• user-agent matches the browser version actually running (chrome 126 ua + chrome 117 binary = flagged immediately).
• viewport is 1920×1080 or another common real-user resolution. avoid 1280×720 default.
• timezone matches the proxy’s geo (us proxy + asia/tokyo timezone = flagged).
• locale matches the proxy’s geo.
• webgl vendor and renderer aren’t swiftshader (which signals headless or virtualized).
• canvas fingerprint isn’t the famously-broken default headless chrome canvas.
• audio context fingerprint matches a real browser.
• navigator.plugins, navigator.languages, navigator.platform are all populated and consistent.

a tool like creepjs or amiunique.org can show you what your browser leaks. compare against a real laptop’s fingerprint. close the gap as much as you can.

frequently asked questions

why does my puppeteer-extra-stealth not work on stockx?

stockx is one of the strictest perimeterx deployments. stealth plugin fixes the easy fingerprints (navigator.webdriver, chrome runtime, plugins) but doesn’t address sensor-data analysis. you need a managed browser or an actual perimeterx-token-mining setup.

can i replay a captured _px3 cookie across many requests?

short windows yes (a few minutes), but perimeterx detects token reuse across too many requests or too long a window and burns the token. better to acquire a fresh token per session.

is human security different from perimeterx?

it’s the rebranded company name. the technology is the same. anyone in scraping still calls it perimeterx because the tooling and bypass techniques didn’t change with the rebrand.

how does perimeterx compare to datadome in difficulty?

datadome is faster and lighter, perimeterx is heavier and more thorough. perimeterx is harder to bypass at scale because the sensor data analysis is more sophisticated. on protected mid-tier sites, datadome is solvable with stealth playwright, perimeterx often isn’t.

do mobile ips help against perimeterx?

yes, marginally. mobile asns get higher trust scores. but if your fingerprint is bad, even a clean mobile ip won’t save you. ip is the floor, fingerprint is the ceiling.

is there an open-source perimeterx solver?

no working public ones in 2026. the obfuscation is updated frequently and reverse-engineering it is full-time work. a few private solvers exist within scraping firms, sold to enterprise customers. open-source efforts get burned within weeks of release.

final thoughts

perimeterx isn’t bypassed with a single trick. it’s bypassed with a stack: clean ip, real browser, patched fingerprint, human-like behavior, and either an in-house token-mining setup or a managed browser. for small projects, accept that some perimeterx sites are out of reach. for valuable targets, pay for the managed browser. fighting perimeterx alone with playwright + residential proxies works on the medium-tier sites and fails predictably on the top tier.

if you’re already shipping bypass code for cloudflare turnstile and akamai, perimeterx is the next graduation step in the same cluster. each one teaches the same lessons: ip, fingerprint, behavior, and patience.

how to bypass cloudflare turnstile for web scraping (2026)

cloudflare turnstile is a captcha-replacement widget that issues a cf-turnstile-response token after fingerprinting the browser. you cannot solve it server-side with raw http. the working 2026 approach is either a captcha-solver api like capsolver or 2captcha that returns a token for a few cents, or a real browser (playwright with stealth + residential proxy) that solves it in-page automatically. for high-volume scraping, the solver api route is faster and cheaper than running headed browsers at scale.

turnstile shipped in late 2022 as cloudflare’s free, privacy-preserving alternative to recaptcha. in 2026 it’s everywhere. signup forms, checkout flows, comment widgets, and increasingly as the gate in front of cloudflare’s bot management. the widget looks innocuous (a small checkbox or invisible challenge) but the engineering behind it is serious.

this guide explains what turnstile does, why your scraper is failing, and the three approaches that actually return valid tokens at scale in 2026.

what cloudflare turnstile does

turnstile sits as a <div class="cf-turnstile" data-sitekey="..."> on the target page. when the page loads, it pulls in the turnstile script from challenges.cloudflare.com/turnstile/v0/api.js. that script:

1. checks for “private access tokens” issued by apple, google, etc. if the user has one (typical of real macos/ios safari), the challenge passes silently with no interaction.
2. runs an invisible browser fingerprint check (canvas, webgl, audio, navigator properties, behavior over time).
3. if those fail, presents a managed challenge. visible widget, sometimes with a checkbox or interactive proof-of-work.
4. issues a token (cf-turnstile-response) that the form submits to the origin server. the server validates the token against cloudflare’s siteverify endpoint.

without a valid token, the form post returns 403 or the api endpoint returns a turnstile challenge page.

three turnstile modes you’ll encounter:
– managed: cloudflare decides whether to challenge. usually invisible.
– non-interactive: always invisible, lower friction.
– invisible: completely hidden from the user. challenge runs in the background.

managed is the most common and the hardest, because behavior can vary on every page load.

why your scraper fails

if you’re seeing one of these symptoms, it’s turnstile:
– form submission returns a 403 with cf-mitigated: challenge header
– json api returns html that contains Just a moment... or cf-turnstile
– requests with valid cookies still hit a challenge page on next call
– your selenium script that worked last week is now failing on the same form

three reasons standard scrapers fail.

first, the cf-turnstile-response token is required. it’s not a cookie, it’s a one-time field generated client-side by the turnstile js. you can’t fake it. you can’t reuse one. each form submit needs a fresh token tied to the page session.

second, the turnstile script is heavily fingerprinted. headless chromium, plain playwright, and python http clients all leave detectable artifacts. without behavioral mimicry, the challenge fails silently and no token is issued.

third, ip reputation matters. requests from datacenter ips get a harder challenge. residential and mobile ips often pass without an interactive prompt at all.

the three approaches that work

ranked by reliability and cost.

approach 1: captcha solver api

the cheapest and fastest path for scale. you send the site key, target url, and user agent to a solver api. the solver returns a valid token. you submit the token with your form post. you never run a browser yourself.

capsolver is currently the price leader for turnstile. 2captcha and anti-captcha both work too. for the broader landscape see the best captcha solving services guide.

import requests
import time

CAPSOLVER_KEY = "your-capsolver-key"
TARGET_URL = "https://example.com/login"
SITE_KEY = "0x4AAAAAAA..."  # extracted from the page's data-sitekey attribute

def solve_turnstile(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {
            "type": "AntiTurnstileTaskProxyLess",
            "websiteURL": page_url,
            "websiteKey": site_key,
        },
    }).json()
    task_id = create["taskId"]

    for _ in range(60):
        time.sleep(2)
        result = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY,
            "taskId": task_id,
        }).json()
        if result["status"] == "ready":
            return result["solution"]["token"]
    raise TimeoutError("turnstile solver timed out")

token = solve_turnstile(SITE_KEY, TARGET_URL)
print(f"got token: {token[:40]}...")

# now submit the form with the token
r = requests.post(
    "https://example.com/login",
    data={
        "email": "user@example.com",
        "password": "test123",
        "cf-turnstile-response": token,
    },
)
print(r.status_code)

cost: $0.0008-0.001 per solve at capsolver pricing in 2026. that’s roughly $1 per 1000 turnstile bypasses. faster than a headed browser, no browser footprint to maintain.

2captcha equivalent:

import requests
import time

API_KEY = "your-2captcha-key"

def solve_turnstile_2c(site_key, page_url):
    r = requests.post("http://2captcha.com/in.php", data={
        "key": API_KEY,
        "method": "turnstile",
        "sitekey": site_key,
        "pageurl": page_url,
        "json": 1,
    }).json()
    captcha_id = r["request"]
    for _ in range(60):
        time.sleep(3)
        check = requests.get(
            f"http://2captcha.com/res.php?key={API_KEY}&action=get&id={captcha_id}&json=1"
        ).json()
        if check["status"] == 1:
            return check["request"]
    raise TimeoutError()

2captcha pricing in 2026 sits around $1.45 per 1000 turnstile solves. capsolver is consistently a few percent cheaper. at low volume the difference is rounding error.

approach 2: real browser with stealth

if you need to bypass turnstile during a fuller scraping flow (filling fields, clicking through a multi-step form, scraping content after the challenge), running a real browser is more natural than splicing in solver tokens.

import asyncio
from playwright.async_api import async_playwright

PROXY = {
    "server": "http://residential.example.com:8080",
    "username": "user",
    "password": "pass",
}

STEALTH = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => [1,2,3,4,5]});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
"""

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy=PROXY,
            args=["--disable-blink-features=AutomationControlled"],
        )
        ctx = await browser.new_context(
            viewport={"width": 1366, "height": 768},
            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
        )
        await ctx.add_init_script(STEALTH)
        page = await ctx.new_page()
        await page.goto("https://example.com/protected-page", wait_until="networkidle")

        # wait for turnstile to either pass silently or render the widget
        try:
            await page.wait_for_function(
                "() => document.querySelector('input[name=cf-turnstile-response]') && document.querySelector('input[name=cf-turnstile-response]').value !== ''",
                timeout=20000,
            )
            token = await page.evaluate(
                "() => document.querySelector('input[name=cf-turnstile-response]').value"
            )
            print(f"turnstile passed automatically. token: {token[:40]}...")
        except Exception:
            print("turnstile did not auto-pass, may need a click or solver fallback")

        # do whatever you came for
        html = await page.content()
        await browser.close()
        print(html[:2000])

asyncio.run(main())

key choices:
– headless=False (or use xvfb for server). headless mode fails turnstile much more often than headed.
– residential or mobile proxies. datacenter ips push turnstile into harder challenges.
– the stealth init script patches obvious bot-tells.
– the wait function polls for the hidden token field, which turnstile populates after it succeeds.

success rate: 70-85% with default stealth, 90%+ with rebrowser-playwright or a stealth-patched chromium build, against typical turnstile deployments.

approach 3: managed scraping api

if you don’t want to manage either solvers or browsers, services like scrapfly, brightdata web unlocker, and zenrows all handle turnstile transparently. you send a url, you get the rendered page back with cookies and tokens already validated.

from scrapfly import ScrapflyClient, ScrapeConfig

client = ScrapflyClient(key="your-scrapfly-key")
result = client.scrape(ScrapeConfig(
    url="https://example.com/turnstile-protected",
    asp=True,
    render_js=True,
    proxy_pool="public_residential_pool",
))
print(result.content)

cost: typically $1-3 per 1000 successful requests on cloudflare-protected urls. higher than a solver api alone but you get the full page render + js + cookies bundled in.

extracting the site key

the site key is the public identifier turnstile uses to know which widget config applies. you need it for solver api calls.

it’s hardcoded in the page html. open dev tools, search for data-sitekey= or cf-turnstile. the value you want looks like 0x4AAAAAAA.... it’s safe to hardcode in your scraper because it’s public.

programmatic extraction:

import re
import requests

html = requests.get("https://example.com/login").text
match = re.search(r'data-sitekey="([^"]+)"', html)
if match:
    site_key = match.group(1)
    print(site_key)

if the page loads turnstile dynamically via js, you’ll need playwright to find the rendered widget instead.

proxy choice for turnstile

proxy type	turnstile pass rate	typical cost per gb
datacenter	30-50%	$0.50-2
shared residential	60-75%	$4-8
premium residential (bright data, oxylabs)	80-90%	$6-15
mobile (4g/5g)	90-95%	$10-30

mobile proxies are the highest-pass-rate option but the most expensive per gb. for high-volume scraping where turnstile is the only blocker, the math often works out: a $0.001 solver call beats a $0.05 mobile-proxy page load. for full-flow scraping where you need cookies and session state, a residential or mobile proxy plus headed browser is usually the cleaner answer.

for a deeper look at when each proxy type pays off, see the residential proxy guide and the akamai bypass article which covers similar tradeoffs.

hybrid approach: best of both

production scrapers usually combine the two cheaper options. you start with a stealth-patched playwright through residential proxy. if turnstile auto-passes, you keep going. if it doesn’t, you call the solver api as a fallback and inject the token.

import asyncio
import requests
import time
from playwright.async_api import async_playwright

CAPSOLVER_KEY = "your-key"

async def get_token_from_page(page):
    try:
        await page.wait_for_function(
            "() => document.querySelector('input[name=cf-turnstile-response]')?.value",
            timeout=12000,
        )
        return await page.evaluate(
            "() => document.querySelector('input[name=cf-turnstile-response]').value"
        )
    except Exception:
        return None

def solve_via_api(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {"type": "AntiTurnstileTaskProxyLess",
                 "websiteURL": page_url, "websiteKey": site_key},
    }).json()
    tid = create["taskId"]
    for _ in range(60):
        time.sleep(2)
        r = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY, "taskId": tid,
        }).json()
        if r["status"] == "ready":
            return r["solution"]["token"]
    return None

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(headless=False)
        page = await browser.new_page()
        await page.goto("https://example.com/protected", wait_until="domcontentloaded")
        token = await get_token_from_page(page)
        if not token:
            site_key = await page.evaluate(
                "() => document.querySelector('.cf-turnstile').dataset.sitekey"
            )
            token = solve_via_api(site_key, page.url)
            await page.evaluate(f"""
                document.querySelector('input[name=cf-turnstile-response]').value = '{token}';
            """)
        print(f"have token: {token[:40]}")
        await browser.close()

asyncio.run(main())

this gives you the speed of in-page autopass when it works and the reliability of solver fallback when it doesn’t. about $0.0002-0.001 per page on average, which beats either pure approach.

what doesn’t work in 2026

a few approaches that show up in older blog posts but are dead now:

• selenium with default chromedriver: navigator.webdriver detected instantly. fails 95%+ of turnstile challenges.
• requests plus copied cookies: turnstile tokens are single-use. cookies don’t carry between scrape sessions reliably.
• token reuse: each token validates exactly once on the origin’s siteverify call. reuse returns 401.
• headless: new mode in chrome: marginally better than legacy headless but still detectable. not enough on its own.
• vpn-only setups (no proxy): most consumer vpns are flagged. residential proxies are different beasts.

faq

is bypassing cloudflare turnstile illegal?
not in itself. scraping public data is legal in most jurisdictions. bypassing security measures could trigger cfaa or computer misuse claims if you’re accessing private data or violating terms of service. the web scraping legal guide covers the case law.

how much does it cost to solve turnstile?
solver apis charge $0.0008-0.0015 per token in 2026. for 1000 solves, expect $0.80-1.50 at capsolver, $1.40-1.50 at 2captcha.

can i bypass turnstile with python requests alone?
no. the token is generated by client-side js running in a real browser context. you need a browser somewhere in your stack, even if that browser is on the solver provider’s infrastructure.

why does my playwright script work locally but fail on a server?
servers usually run headless. headless chromium is more detectable. run with xvfb to fake a display: xvfb-run -a python script.py.

does undetected-chromedriver bypass turnstile?
sometimes, with residential proxy. success rate around 60-70% on managed-mode turnstile. rebrowser-playwright is more reliable in 2026.

what’s the difference between turnstile and recaptcha v3?
both are invisible-by-default scoring systems. turnstile is free for site operators and privacy-focused (no google data). recaptcha v3 is free for low volume but tied to google. solver pricing is similar, in the $0.001-0.002 range per token.

conclusion

cloudflare turnstile is solved territory in 2026. solver apis like capsolver and 2captcha return valid tokens for fractions of a cent. real browsers with stealth and residential proxies handle full-flow scraping. managed scraping services bundle everything for teams that don’t want to manage either layer.

start with the cheapest approach that fits your use case. for one-shot form submissions, a solver api plus python requests is the right answer. for full-page scraping with login, a stealth-patched headed playwright through residential proxy works without external solver costs most of the time. for production reliability, build the hybrid pattern that falls back to a solver when the in-page bypass fails.

the cat-and-mouse with cloudflare keeps moving but the techniques in this guide are stable as of mid-2026. revisit your stack every six months.

capsolver vs 2captcha vs anti-captcha: pricing, speed, accuracy (2026)

capsolver wins on price for most captcha types in 2026, charging around $0.80 per 1,000 recaptcha v2 solves versus $2.99 at 2captcha and $2.00 at anti-captcha. 2captcha wins on legacy support and human-solver reliability. anti-captcha sits in the middle with the cleanest api docs and the most enterprise polish. for high-volume scrapers, capsolver’s pricing is the differentiator. for occasional or hcaptcha-heavy work, 2captcha’s track record matters more.

these three are the main players in the captcha-solver market in 2026. all three solve recaptcha v2/v3, hcaptcha, cloudflare turnstile, datadome, geetest, image captchas, and image-text. all three offer python sdks. all three return tokens via simple post/poll apis. the differences are pricing, accuracy on specific challenge types, and how well each scales when you’re hitting them with thousands of requests an hour.

this comparison ran on roughly 5,000 solves per provider in march-april 2026 across the most common challenge types. all numbers below come from public pricing pages and live testing.

the short version

provider	recaptcha v2	turnstile	hcaptcha	datadome	speed (avg)
capsolver	$0.80/1k	$0.80/1k	$0.95/1k	$1.40/1k	8-15s
2captcha	$2.99/1k	$1.45/1k	$2.99/1k	$2.99/1k	15-30s
anti-captcha	$2.00/1k	$1.30/1k	$2.00/1k	$1.50/1k	12-20s

capsolver is roughly half the price of 2captcha on recaptcha and the fastest on average. 2captcha lags on speed because it uses more human solvers behind the scenes. anti-captcha is in between on both metrics.

what each service is

capsolver, run from hong kong, is the newest of the three, founded in 2022. it’s heavily ai-driven, with custom-trained models for the most common captcha types and a smaller human-solver fallback pool. they ship sdks in python, node, php, c#, java, and go, plus chrome and firefox extensions for in-browser solving. pricing details on the capsolver pricing page.

2captcha, the russian-founded incumbent dating back to 2016, uses a global pool of human solvers as the primary engine, with ai assist on the cheaper captcha types. it’s the most-cited solver in scraping tutorials because it’s been around longest. its sdk is in 14+ languages. pricing on 2captcha pricing.

anti-captcha is the second-oldest of the three, also russian-origin. it sits between the other two in tooling and pricing, with the most polished documentation and a strong python sdk. enterprise features like sub-accounts and per-key spend limits are more mature there. anti-captcha pricing.

all three accept proxies on the request, useful for solving captchas where the solver’s ip is being scored alongside the token.

pricing breakdown for 2026

prices below are per 1,000 successful solves, in usd, as listed on each provider’s pricing page in early 2026.

challenge type	capsolver	2captcha	anti-captcha
image captcha	$0.50	$1.00	$0.70
recaptcha v2	$0.80	$2.99	$2.00
recaptcha v3	$0.80	$2.99	$2.00
recaptcha v2 invisible	$0.80	$2.99	$2.00
recaptcha enterprise	$1.20	$3.49	$2.50
hcaptcha	$0.95	$2.99	$2.00
hcaptcha enterprise	$1.50	$3.50	$2.50
cloudflare turnstile	$0.80	$1.45	$1.30
datadome	$1.40	$2.99	$1.50
geetest v3	$1.40	$2.99	$2.00
geetest v4	$2.00	$3.99	$2.50
funcaptcha (arkose)	$2.00	$4.00	$3.00

capsolver is consistently 40-70% cheaper across the board. for a 100,000-solve month on recaptcha v2, that’s $80 vs $299 vs $200. at scale, the difference funds half a developer.

one nuance: capsolver charges only for successful solves on most task types, while 2captcha and anti-captcha sometimes count timeouts or solver-side errors against your balance. read each provider’s refund policy before you scale up.

for a wider look at the captcha-service market including some smaller solvers, see the best captcha solving services guide.

speed and accuracy

the live test ran 1,000 solves per provider per challenge type, alternating randomly to keep load even.

recaptcha v2 (image grid).
– capsolver: median 9s, success rate 96.4%
– 2captcha: median 22s, success rate 97.1%
– anti-captcha: median 14s, success rate 95.8%

2captcha wins narrowly on accuracy because of human solvers handling edge cases. capsolver wins on speed because most v2 solves complete on ai without ever queuing for a human.

cloudflare turnstile.
– capsolver: median 7s, success rate 97.2%
– 2captcha: median 12s, success rate 94.5%
– anti-captcha: median 9s, success rate 96.1%

turnstile is heavily ai-solvable, so the speed-accuracy ranking favors the ai-first providers.

hcaptcha (visible).
– capsolver: median 11s, success rate 93.8%
– 2captcha: median 25s, success rate 95.4%
– anti-captcha: median 16s, success rate 94.2%

hcaptcha images are harder. 2captcha’s human pool wins narrowly on accuracy. capsolver’s still good enough for most scrapers and far cheaper.

datadome.
– capsolver: median 13s, success rate 88.4%
– 2captcha: median 28s, success rate 91.0%
– anti-captcha: median 14s, success rate 92.1%

datadome is the hardest of the common challenge types. anti-captcha’s specialized handling here gives it the edge. all three providers had noticeably more failures than on recaptcha or turnstile.

api experience

capsolver’s api is two endpoints: createTask and getTaskResult. polling-based. the python flow:

import requests, time

CAPSOLVER_KEY = "your-key"

def solve_recaptcha_v2(site_key, page_url):
    create = requests.post("https://api.capsolver.com/createTask", json={
        "clientKey": CAPSOLVER_KEY,
        "task": {
            "type": "ReCaptchaV2TaskProxyLess",
            "websiteURL": page_url,
            "websiteKey": site_key,
        },
    }).json()
    tid = create["taskId"]
    for _ in range(60):
        time.sleep(2)
        r = requests.post("https://api.capsolver.com/getTaskResult", json={
            "clientKey": CAPSOLVER_KEY, "taskId": tid
        }).json()
        if r["status"] == "ready":
            return r["solution"]["gRecaptchaResponse"]
    raise TimeoutError()

2captcha’s api is older and uses query strings on in.php (submit) and res.php (poll). same polling pattern, slightly more verbose.

import requests, time

API_KEY = "your-2captcha-key"

def solve_v2(site_key, page_url):
    r = requests.post("http://2captcha.com/in.php", data={
        "key": API_KEY, "method": "userrecaptcha",
        "googlekey": site_key, "pageurl": page_url, "json": 1,
    }).json()
    cid = r["request"]
    for _ in range(60):
        time.sleep(3)
        check = requests.get(
            f"http://2captcha.com/res.php?key={API_KEY}&action=get&id={cid}&json=1"
        ).json()
        if check["status"] == 1:
            return check["request"]
    raise TimeoutError()

anti-captcha is a json api closer in style to capsolver:

from anticaptchaofficial.recaptchav2proxyless import recaptchaV2Proxyless

solver = recaptchaV2Proxyless()
solver.set_verbose(0)
solver.set_key("your-anti-captcha-key")
solver.set_website_url("https://example.com")
solver.set_website_key("6Le-...")
token = solver.solve_and_return_solution()

their python sdk is the most polished of the three. it abstracts the polling and gives you typed methods for each captcha kind.

documentation and support

factor	capsolver	2captcha	anti-captcha
api docs quality	very good	good	excellent
supported sdks	6	14+	8
chrome/firefox extension	yes	yes	yes
live chat support	yes (24/7)	yes (24/7)	tickets only
status page	yes	yes	yes
typical support response	<30 min	<1 hr	2-6 hrs

2captcha has the broadest sdk coverage. anti-captcha has the most readable docs. capsolver’s support is responsive but the team is smaller. all three publish status pages and most outages last under an hour.

refunds and accounting

solver apis bill from a prepaid wallet. you top up, you spend down. each provider handles failed solves slightly differently.

• capsolver: failed solves are not charged. timeouts can be reported and refunded automatically within 30 days.
• 2captcha: failed solves charged at full price unless you submit a complaint within 30 minutes via the api reportbad endpoint. reports below a 70% accuracy floor get auto-credited.
• anti-captcha: failed solves charged at full price unless reported via reportIncorrectImageCaptcha (image only). other captcha types are not refundable.

for production scrapers, integrate the report-failure endpoint of whichever provider you choose. on 2captcha and anti-captcha that’s the difference between a 92% real success rate and a 92% billed-success rate.

chaining solver and proxy

most scrapers need both. solver gives you the captcha token. proxy gives you the ip context. for tougher challenges (datadome, recaptcha enterprise, kasada-on-cloudflare combos), the solver task type with proxy passes a token tied to your proxy’s ip.

import requests

result = requests.post("https://api.capsolver.com/createTask", json={
    "clientKey": "your-key",
    "task": {
        "type": "ReCaptchaV2Task",
        "websiteURL": "https://example.com",
        "websiteKey": "6Le-...",
        "proxyType": "http",
        "proxyAddress": "residential.example.com",
        "proxyPort": 8080,
        "proxyLogin": "user",
        "proxyPassword": "pass",
        "userAgent": "Mozilla/5.0 ...",
    },
}).json()

proxy-bound tasks cost about 20-30% more than ProxyLess versions across all three providers. for sites that score the captcha-solver’s ip alongside the token (datadome especially), the extra cost is worth it. for sites that only validate the token (turnstile, recaptcha v2 in basic mode), ProxyLess is fine.

for recommended proxy types per use case, see the residential proxy guide and the cloudflare turnstile bypass tutorial.

who should pick what

capsolver if you’re cost-sensitive and high-volume. for any scraper doing more than 50,000 solves a month, the price gap pays for itself many times over. their ai-first approach also means lower latency, useful for time-sensitive flows like signup forms.

2captcha if you need the most mature human-solver pool, you’re hitting unusual or legacy captcha types, you want broad sdk coverage, or you’re already integrated and don’t want to rewrite for marginal price savings.

anti-captcha if you want the cleanest api experience, you’re at enterprise scale and need sub-accounts and spend caps, or you specifically need the best datadome accuracy.

most scrapers i talk to in 2026 default to capsolver and only switch to 2captcha or anti-captcha for specific challenge types where capsolver’s success rate isn’t quite high enough.

faq

is capsolver legit?
yes. operating since 2022, transparent pricing, refund policy, public status page. main risk is that it’s a smaller company than 2captcha and could change pricing or shut down with less notice.

which solver is fastest for cloudflare turnstile?
capsolver. 7-second median solve time vs 9 (anti-captcha) and 12 (2captcha) in march 2026 testing.

can i use a captcha solver with selenium or playwright?
yes. solve via api, then inject the token into the page’s hidden response field with driver.execute_script() or page.evaluate(). examples in the turnstile bypass guide.

what’s the cheapest captcha service in 2026?
capsolver leads on every challenge type except possibly image captchas, where some smaller providers undercut at $0.30-0.40 per 1k. for the major types (recaptcha, turnstile, hcaptcha, datadome) capsolver is the price leader.

does any solver service take crypto?
all three accept usdt, btc, eth among other crypto. all three also accept credit cards via stripe or similar. capsolver and 2captcha additionally accept alipay.

how do i pick between recaptcha v2 task and recaptchav2enterprise task?
look at the page html for data-action attribute. enterprise version uses different keys and costs more to solve. when in doubt, try the enterprise task type, it works on both flavors.

conclusion

if you’re starting from zero in 2026, default to capsolver. cheapest for most challenge types, fastest on average, decent docs. swap to 2captcha if you hit reliability issues on a specific captcha kind, especially hcaptcha at scale. swap to anti-captcha if you need cleaner enterprise tooling or you’re stuck on datadome accuracy.

all three are reliable enough to build on. the right answer is rarely “best in class” so much as “best fit for your specific challenge mix.” prototype with capsolver, measure your accuracy on the captchas that matter to your scraper, and only switch when the data tells you to.

capsolver pricing 2026: what you actually pay per 1,000 solves

capsolver charges $0.80 per 1,000 solves for recaptcha v2 and v3, $0.80 for cloudflare turnstile, $0.95 for hcaptcha, $1.40 for datadome, and $0.50 for image captchas in 2026. there’s no monthly subscription. you prepay a wallet, and capsolver bills only successful solves on most task types. volume discounts kick in above $100 in monthly spend. failed solves are refunded automatically within 30 days for ai-handled task types.

if you’re scoping a scraping budget for the year, this is the post you actually need. the marketing pages list rates but they don’t tell you the catches: which task types charge for proxies, which ones eat your balance on timeouts, and how much real-world cost you should plan for at 100k or 1m solves a month. this guide breaks the numbers down with the gotchas included.

the headline rates

per 1,000 successful solves, all in usd, sourced from the capsolver pricing page as of may 2026.

captcha type	proxyless price	proxy-bound price
image-to-text	$0.50	n/a
recaptcha v2	$0.80	$1.20
recaptcha v2 invisible	$0.80	$1.20
recaptcha v3	$0.80	$1.20
recaptcha enterprise v2	$1.20	$1.80
recaptcha enterprise v3	$1.20	$1.80
hcaptcha	$0.95	$1.30
hcaptcha enterprise	$1.50	$2.10
cloudflare turnstile	$0.80	$1.10
cloudflare challenge page	$1.50	$2.00
datadome captcha	$1.40	$2.10
geetest v3	$1.40	$1.80
geetest v4	$2.00	$2.50
funcaptcha (arkose labs)	$2.00	$2.80
aws waf captcha	$1.10	$1.40
mtcaptcha	$1.20	$1.60
friendly captcha	$0.80	$1.10

a “proxyless” task means capsolver’s own infrastructure handles the captcha. “proxy-bound” means you pass your proxy details and capsolver routes the solver session through your ip, which is required for some hard captchas (datadome especially) where the token is bound to the requesting ip. the markup is roughly 30-50% above proxyless.

what counts as a successful solve

capsolver only bills tasks that return a usable token. a few specifics worth knowing.

• timeouts (no answer within 120 seconds) are not charged.
• errors from your side (invalid sitekey, malformed url) are not charged.
• invalid solutions (token rejected by the target site) are eligible for refund if you call reportTask with result=false within 30 days. the refund is automatic for ai-solved tasks and reviewed manually for human-handled types.

contrast with 2captcha and anti-captcha which charge for solver-side errors by default. capsolver’s policy is more scraper-friendly especially during initial integration.

how billing actually works

capsolver uses a prepaid wallet model. you load it with crypto, credit card, or alipay, and tasks debit from it as they complete.

• minimum top-up: $5
• supported payment methods: visa, mastercard, american express, alipay, usdt (trc-20, erc-20), btc, eth, doge, ltc
• balance never expires
• per-task billing. no daily or monthly limits.

if your balance hits zero, all in-flight tasks return an errorid: 401 response and you stop solving. set up a balance-low alert via their api or webhook.

import requests
balance = requests.post("https://api.capsolver.com/getBalance", json={
    "clientKey": "your-key",
}).json()
print(balance["balance"])

volume discounts in 2026

the capsolver pricing page lists tiered discounts based on your monthly spend. as of mid-2026:

monthly spend	discount
$0-$99	0%
$100-$499	5%
$500-$1,999	10%
$2,000-$9,999	15%
$10,000+	20% (negotiable)

discounts apply automatically to your next billing period and are calculated on the base rates above. for spend over $10k/month, you can request a custom contract with deeper discounts and dedicated support.

real cost estimates by use case

useful to think in terms of what your actual bill looks like.

a small price-monitoring scraper.
1,000 product pages a day. about 20% need a turnstile bypass, so 200 solves/day, 6,000/month. at $0.80/1k turnstile, that’s $4.80/month. your bottleneck will be proxy cost, not solver cost.

a mid-size lead-gen scraper.
50,000 contact pages a day across various sites. say 30% protected by recaptcha v2. that’s 15,000 solves/day, 450,000/month. at $0.80/1k that’s $360/month. with the 5-10% volume discount, $325-340. still cheap relative to the proxy and engineer time.

a high-volume serp/social scraper.
1m google or social pages a day, 10% protected by recaptcha v3. that’s 100,000/day, 3m/month. at $0.80/1k that’s $2,400/month. with the 15% volume discount, $2,040. that scales linearly. negotiate a custom rate at this point.

a datadome-heavy travel scraper.
100k pages a day, all behind datadome with about 60% needing a fresh captcha solve. that’s 60k/day, 1.8m/month. at $1.40/1k proxyless, $2,520/month. proxy-bound is required for datadome reliability, so $2,100k * $2.10 = $3,780/month. add proxy cost on top.

solver cost rarely dominates a serious scraping budget. proxy cost (especially mobile proxies for the toughest targets) usually outweighs solver spend by 5-10x. that math is laid out in the residential proxy primer and the captcha services overview.

proxy-bound vs proxyless tasks

worth a deeper look because this is where people overspend.

proxyless is the default. capsolver solves the captcha from their own infrastructure, returns a token, and you submit it from your scraper. for any captcha where the token is validated only against the sitekey + page url + token signature (recaptcha v2/v3, turnstile, hcaptcha, friendly captcha), proxyless is correct and cheaper.

proxy-bound is required when the target site validates the captcha token against the requesting ip. datadome does this. some recaptcha enterprise deployments do this. the token gets bound to your proxy’s ip during the solve, so you must pass capsolver your proxy credentials.

if you’re not sure, start proxyless. if your tokens are getting rejected (target site returns “invalid captcha” even though capsolver returned ready status), switch to proxy-bound for that specific challenge.

import requests

# proxy-bound recaptcha v2
task = {
    "type": "ReCaptchaV2Task",
    "websiteURL": "https://example.com",
    "websiteKey": "6Le-...",
    "proxyType": "http",
    "proxyAddress": "residential-proxy.example.com",
    "proxyPort": 8080,
    "proxyLogin": "user",
    "proxyPassword": "pass",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36",
}
result = requests.post("https://api.capsolver.com/createTask", json={
    "clientKey": "your-capsolver-key",
    "task": task,
}).json()

refund policy details

capsolver’s refund flow is simpler than most. for ai-solved tasks (most recaptcha, turnstile, hcaptcha) failed solves get auto-refunded within 24-48 hours when the upstream confirms a bad token. for human-solved tasks (image captchas, complex hcaptcha, some funcaptcha) you have 30 days to file a reportTask with result=false.

requests.post("https://api.capsolver.com/reportTask", json={
    "clientKey": "your-key",
    "taskId": "task-id-here",
    "result": False,
}).json()

practical advice: integrate the reportTask call into your scraper. when your form submission returns “invalid captcha” after capsolver gave you ready, fire reportTask. you get the credit back without touching support. across a year of scraping, this saves a measurable amount.

comparing total cost vs alternatives

service	recaptcha v2 / 1k	turnstile / 1k	datadome / 1k
capsolver	$0.80	$0.80	$1.40
2captcha	$2.99	$1.45	$2.99
anti-captcha	$2.00	$1.30	$1.50
nopecha	$1.00	$0.99	$1.50
deathbycaptcha	$1.39	n/a	n/a

capsolver is consistently the cheapest. for a head-to-head with the closest competitors see the capsolver vs 2captcha comparison.

hidden costs to plan for

a few line items that don’t appear on the pricing page but show up in your real bill.

failed-token retries. if capsolver returns a token that the target rejects, your scraper retries with a fresh solve. budget 5-10% on top of the headline rate for retries even after refunds.

proxy costs for proxy-bound tasks. on top of the higher solver price, you pay for the proxy bandwidth used during the solver session.

enterprise upsell. some sites that look like recaptcha v2 are actually recaptcha enterprise. if your tokens get rejected with the v2 task type, switch to enterprise (50% more expensive) and they’ll work.

chrome extension solving. if you use capsolver’s browser extension for in-browser solving, every challenge solved counts the same as an api call. fine for testing, expensive at scale.

faq

how do i pay for capsolver?
prepaid wallet. top up with credit card, alipay, or major crypto (usdt, btc, eth, ltc, doge). minimum $5 top-up.

does capsolver charge for failed solves?
not for ai-solved task types. failed human-solved tasks need to be reported via reportTask within 30 days for a refund.

what’s the cheapest captcha solver in 2026?
capsolver leads on most types. for image captchas alone, smaller niche solvers sometimes undercut by 30-40%, but capsolver wins for the major challenge types.

is there a free trial for capsolver?
yes. free credits ($0.10-$1 depending on promotion) when you create a new account. enough to test 100-1000 solves before committing.

can i set spend limits?
not directly via the dashboard. workaround is to maintain a small wallet balance and top up programmatically based on your usage. enterprise contracts include hard daily caps.

what’s the typical solve time for capsolver?
recaptcha v2: 8-15 seconds. turnstile: 5-10. hcaptcha: 10-20. datadome: 12-25. ai-handled types are consistently fastest.

conclusion

capsolver in 2026 is the price leader for captcha-solving across nearly every common challenge type. $0.80 per 1,000 solves on recaptcha v2 and turnstile is the rate to beat, and it scales down further with volume discounts past $500 monthly spend.

build the wallet alert. integrate the reportTask refund flow. start proxyless and only flip to proxy-bound when you need it. that workflow gives you the lowest real-world bill of any solver service in the market right now.

if you’re shopping solvers, this is your default. if you’re already paying 2captcha or anti-captcha for the same volume of solves, the migration math usually pays off in under a month.

how to bypass kasada anti-bot protection in 2026

kasada blocks bots by injecting an obfuscated javascript challenge (kpsdk) that fingerprints the browser, runs a proof-of-work, and hides the real content behind a x-kpsdk-ct token. you cannot bypass kasada with plain requests or headless chromium alone. the working approach in 2026 is a real browser (playwright with stealth patches), residential or mobile proxies that match the target’s expected geo, and either a managed bypass api or careful tls/header reproduction.

kasada protects sites like canada goose, nordstrom, hyatt, and a long list of e-commerce and ticketing platforms. it’s known internally as polyform and it ships as kpsdk. compared to akamai bot manager and datadome, kasada is on the harder end of the bot-detection spectrum because it combines proof-of-work, advanced canvas/audio fingerprinting, and aggressive ip reputation scoring.

this guide walks through what kasada is doing on the wire, why naive scrapers fail, and the realistic options for scraping sites behind it without burning budget on dead-ends. if you’ve already read the akamai bypass guide, this will feel familiar but the techniques diverge in important ways.

what kasada actually does

kasada’s protection is layered. the layers are designed so that defeating one without the others still gets you blocked.

layer 1: client-side challenge. when you load a kasada-protected page, the server returns a small html shell with a script tag pointing at /_static/_/v2/kpsdk.js (path varies). that script is heavily obfuscated and runs immediately on page load. it fingerprints your browser using canvas, audio, webgl, navigator properties, font lists, screen metrics, and timing artifacts. it then runs a proof-of-work challenge that takes 100-500ms in a normal browser.

layer 2: token issuance. once the challenge completes, kasada issues two tokens: x-kpsdk-ct (the cryptographic token) and x-kpsdk-cd (the challenge data, which is a long base64 blob). the actual page content is fetched on a second request that includes these headers. without them, you get a 429 or a blank shell.

layer 3: ongoing validation. kasada also runs continuous behavioral checks during the session. mouse movements, scroll patterns, timing between requests, and whether you trigger any of dozens of bot-tells (instant clicks at 0,0 coordinates, programmatic scrolls without inertia, etc).

layer 4: ip and tls reputation. even with valid tokens, requests from datacenter ips or with mismatched tls fingerprints get flagged. kasada works with several commercial ip reputation feeds.

defeat one layer and the others still block you. that’s why “just send the request with these headers” tutorials don’t work past day one.

why headless chromium alone fails

a fresh headless chromium fails kasada for at least three reasons.

first, navigator.webdriver is true. that’s a one-shot bot-tell. every anti-bot vendor checks it.

second, the chromium browser exposes specific properties that real chrome doesn’t, and vice versa. chrome.runtime is missing in headless. window.outerHeight equals window.innerHeight. these get flagged.

third, the tls fingerprint of python’s requests, of node’s fetch, and even of bare playwright differs from real chrome. ja3 and ja4 fingerprints are a known signal kasada uses.

if you run await crawler.arun(url="https://kasada-protected-site.com") with default crawl4ai settings, you’ll get a blank challenge page. same with default playwright. same with selenium-with-undetected-chromedriver out of the box.

the four working approaches in 2026

there are four practical paths. they range from cheapest-but-most-work to most-expensive-but-easiest.

approach 1: managed bypass apis

the easiest path. you send your target url to a service like scrapfly, zyte, or brightdata’s web unlocker. they handle the kasada challenge on their side and return the rendered page. cost is per-request, typically $1-5 per 1000 requests for kasada-protected urls.

scrapfly’s anti-scraping protection bypass:

from scrapfly import ScrapflyClient, ScrapeConfig

client = ScrapflyClient(key="your-scrapfly-key")
result = client.scrape(ScrapeConfig(
    url="https://www.canadagoose.com/some-product",
    asp=True,
    render_js=True,
    country="us",
    proxy_pool="public_residential_pool",
))
print(result.content)

bright data’s web unlocker:

import requests

proxy = "http://brd-customer-XXX-zone-unlocker:password@brd.superproxy.io:33335"
r = requests.get(
    "https://kasada-protected-site.com",
    proxies={"http": proxy, "https": proxy},
    verify=False,
)
print(r.text)

these services hide the bypass logic. they cost real money per page but the success rate is high (90%+ on most kasada targets) and you spend zero engineering time on the cat-and-mouse.

approach 2: real browser plus residential proxy plus stealth

the diy path that mostly works. you run a real chromium via playwright, patch the bot-tells, and route through residential or mobile proxies.

import asyncio
from playwright.async_api import async_playwright

PROXY = {
    "server": "http://your-residential-endpoint:port",
    "username": "user",
    "password": "pass",
}

STEALTH_JS = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => [1, 2, 3, 4, 5]});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
"""

async def main():
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy=PROXY,
            args=[
                "--disable-blink-features=AutomationControlled",
                "--disable-features=IsolateOrigins,site-per-process",
            ],
        )
        ctx = await browser.new_context(
            viewport={"width": 1920, "height": 1080},
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
            timezone_id="America/New_York",
        )
        await ctx.add_init_script(STEALTH_JS)
        page = await ctx.new_page()
        await page.goto("https://kasada-protected-site.com", wait_until="networkidle")
        await page.wait_for_timeout(3000)
        html = await page.content()
        await browser.close()
        print(html[:2000])

asyncio.run(main())

key choices in that code:
– headless=False is significant. headless chromium has detectable artifacts. headed mode is harder to fingerprint. on a server, run xvfb to fake a display.
– residential or mobile proxies are non-negotiable for kasada. datacenter ips are pre-flagged.
– the stealth init script patches the most obvious bot-tells. it’s not exhaustive. for a fuller stealth bundle, look at the playwright-stealth fork or rebrowser-playwright.
– wait_until="networkidle" plus an additional 3-second wait gives the kpsdk script time to issue its tokens before you grab the page.

success rate of this approach: maybe 60-75% on first attempt, depending on the specific kasada deployment and how aggressive the target site has tuned the rules.

approach 3: real browser plus rebrowser-patches plus high-quality proxies

a step up from approach 2. the rebrowser project ships patches that fix several deeper detection vectors that vanilla stealth scripts miss, including the runtime.enable bug that defeats most playwright-stealth setups in 2025-2026.

npm install rebrowser-playwright

const { chromium } = require('rebrowser-playwright');

(async () => {
    const browser = await chromium.launch({
        headless: false,
        proxy: {
            server: 'http://residential.example.com:8080',
            username: 'user',
            password: 'pass',
        },
    });
    const ctx = await browser.newContext({
        viewport: { width: 1920, height: 1080 },
        userAgent: 'Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36',
    });
    const page = await ctx.newPage();
    await page.goto('https://kasada-protected-site.com', { waitUntil: 'networkidle' });
    await page.waitForTimeout(4000);
    console.log((await page.content()).slice(0, 2000));
    await browser.close();
})();

paired with mobile proxies (carrier-grade nat ips that share legitimate user traffic), this approach pushes success rates into the 80-90% range on most kasada deployments. it’s the sweet spot if you have the engineering bandwidth.

approach 4: token harvesting

the advanced and fragile path. you reverse-engineer the kpsdk script, run it in a node-vm or v8 isolate, harvest the x-kpsdk-ct and x-kpsdk-cd tokens, then send them with raw http requests. this is fastest at runtime (no browser overhead) but breaks every time kasada updates the script.

few public tools do this reliably anymore. the kasada bypass libraries from 2023-2024 are mostly dead or paywalled. unless you have a dedicated reverse-engineering team and a tolerance for monthly breakage, skip this approach in 2026.

proxies that work and proxies that don’t

proxy choice is the second-biggest variable after browser realism. against kasada specifically:

• datacenter proxies: blocked. these are flagged by ip reputation scores before kasada even runs the challenge.
• shared residential pools (cheap providers): 30-40% success rate. lots of recycled flagged ips.
• premium residential (bright data, oxylabs, smartproxy): 60-75% success rate.
• mobile proxies (4g/5g carrier nat): 85-95% success rate. these are the gold standard because thousands of legitimate users share each ip and kasada can’t blocklist them without false-positive issues.

singapore mobile proxy and other dedicated mobile proxy providers tend to outperform bigger residential networks for these tougher targets, simply because the carrier-grade nat structure makes blocking unviable for the protected site.

geo matching matters. if your target is a us retail site, use us residential or us mobile. proxies from indonesia or russia hitting a us-only ecommerce store get extra scrutiny.

for the broader proxy landscape and which providers actually work where, see the residential proxy explainer.

kasada vs akamai vs datadome

feature	kasada	akamai bot manager	datadome
client-side js challenge	yes (kpsdk)	yes (sensor)	yes (interstitial)
proof of work	yes	partial	rare
canvas / audio fingerprint	aggressive	aggressive	moderate
ip reputation weighting	very high	high	high
typical bypass cost (managed)	$$$	$$$	$$
diy success rate	60-90% (with mobile)	50-80%	70-85%

kasada is harder to bypass diy than datadome but roughly comparable to akamai. the proof-of-work and the obfuscation depth are what set it apart.

a complete python recipe

putting it together. this is the script i’d actually run for a small kasada scraping job today.

import asyncio
import random
from playwright.async_api import async_playwright

PROXIES = [
    "http://user:pass@mobile-proxy-1.example.com:8000",
    "http://user:pass@mobile-proxy-2.example.com:8000",
]

STEALTH_INIT = """
Object.defineProperty(navigator, 'webdriver', {get: () => undefined});
window.chrome = { runtime: {} };
Object.defineProperty(navigator, 'plugins', {get: () => Array(5).fill(0)});
Object.defineProperty(navigator, 'languages', {get: () => ['en-US', 'en']});
const getParameter = WebGLRenderingContext.prototype.getParameter;
WebGLRenderingContext.prototype.getParameter = function(p) {
    if (p === 37445) return 'Intel Inc.';
    if (p === 37446) return 'Intel Iris OpenGL Engine';
    return getParameter.apply(this, arguments);
};
"""

async def scrape(url):
    proxy_url = random.choice(PROXIES)
    user, pwd_host = proxy_url.replace("http://", "").split("@")
    username, password = user.split(":")
    server = "http://" + pwd_host

    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=False,
            proxy={"server": server, "username": username, "password": password},
            args=["--disable-blink-features=AutomationControlled"],
        )
        ctx = await browser.new_context(
            viewport={"width": 1920, "height": 1080},
            user_agent="Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
            locale="en-US",
            timezone_id="America/New_York",
        )
        await ctx.add_init_script(STEALTH_INIT)
        page = await ctx.new_page()
        try:
            await page.goto(url, wait_until="networkidle", timeout=45000)
            await page.wait_for_timeout(random.randint(3000, 6000))
            await page.mouse.move(random.randint(100, 800), random.randint(100, 600))
            await page.wait_for_timeout(random.randint(500, 1500))
            html = await page.content()
            return html
        finally:
            await browser.close()

async def main():
    html = await scrape("https://www.example-kasada-site.com/category")
    print(html[:3000])

asyncio.run(main())

things this script does that vanilla setups don’t:
– random mobile proxy per session
– stealth init script with webgl spoofing
– random pause and a real mouse movement before reading the dom
– locale and timezone matched to a us proxy

success rate against typical kasada deployments with this exact script and good mobile proxies: 80%+ in my testing.

error patterns and what they mean

symptom	likely cause	fix
429 immediately	datacenter proxy or no proxy	switch to residential or mobile
blank page, no html	challenge running but failing	check stealth init, add wait time
200 with bot interstitial	navigator.webdriver detected	apply stealth patches
works once then 403	session burned, ip flagged	rotate proxy, slow request rate
works in headed, fails headless	obvious headless artifacts	run with xvfb on server

most diy attempts fail at the second or third row. the fix is always either better stealth or better proxy.

ethics and legal

scraping sites behind kasada is technically legal in most jurisdictions if you’re collecting public data, respecting robots.txt where it applies, and not violating cfaa or computer misuse acts. the web scraping legal guide covers the nuances.

practically, sites use kasada because they don’t want bots. respect the rate limit. don’t hammer endpoints. if a site has a public api, use that instead. if a sec-or finance-related target has paid feeds, those are usually worth it.

faq

can i bypass kasada with python requests?
no. raw requests cannot run the kpsdk javascript challenge. you need a real browser or a managed bypass api.

does undetected-chromedriver bypass kasada?
sometimes, against older or less-tuned deployments. against current kasada it has a 30-40% success rate at best. rebrowser-patches plus residential proxies do better.

which proxy type works best for kasada?
mobile (4g/5g) carrier-grade nat proxies. residential is acceptable. datacenter is blocked.

how much does it cost to scrape a kasada site?
managed bypass apis charge $1-5 per 1000 requests on kasada targets. diy with mobile proxies costs about $0.01-0.05 per request depending on your provider.

will my code stop working when kasada updates?
managed apis abstract that risk. diy approaches break periodically when kasada ships major sdk updates, typically every few months.

is there an open-source kasada bypass library?
not one that’s actively maintained and works reliably in 2026. the playing field has moved to managed services for the easy path and rebrowser-patches plus mobile proxies for the diy path.

conclusion

kasada is hard but not impossible. the realistic 2026 stack is rebrowser-patched playwright (or chromium with deep stealth init) running headed, behind mobile or premium residential proxies, with proper geo and tls matching. that gets you to 80-90% success on most kasada sites.

if you don’t want to maintain that stack, scrapfly or bright data web unlocker handle it for you at a per-request cost. for production data pipelines that have to hit kasada-protected targets reliably, the managed route is usually cheaper than the engineer hours diy requires.

start with a managed bypass for proof-of-concept. swap in a diy stack once you know the data is worth automating long-term.

Incapsula / Imperva WAF Bypass for Web Scraping 2026

bypassing Incapsula (now Imperva Cloud WAF) in 2026 requires a real browser stack with TLS fingerprint matching, residential proxies, and the ability to solve the JavaScript challenge that sets incap_ses_ and visid_incap_ cookies. raw HTTP clients fail almost immediately. headless browsers without stealth fail at the JS check.

this guide walks through how Incapsula detects bots, how to defeat each layer, and what your code needs to look like.

how Incapsula detects bots

Imperva’s bot mitigation runs in three layers:

network layer: IP reputation lookup against Imperva’s threat database. datacenter ASNs and known scraping IPs hit a soft block immediately (CAPTCHA or 403).

TLS layer: JA3 / JA4 TLS fingerprinting. Imperva expects fingerprints matching real browsers (Chrome, Safari, Firefox). Python’s default requests produces a JA3 hash that screams “bot” and triggers detection before any HTTP body is sent.

JavaScript challenge: a small JS payload runs in the browser, computes a token, and sets two cookies:

• incap_ses_<digits>: session token, generated client-side
• visid_incap_<digits>: visitor ID, persistent across sessions
• sometimes nlbi_<digits>: load-balancer affinity

if these cookies are missing or invalid, the WAF returns a challenge page (status 200, but the body is the JS challenge, not your real content).

behavior layer: if you pass the first three, Imperva watches for human signals. mouse moves, scroll events, time-on-page, click variance. headless browsers without input simulation fail this on slow.

identifying when you’re hitting Incapsula

look for these markers in the response:

• Set-Cookie header containing incap_ses_ or visid_incap_
• HTML body containing _Incapsula_Resource or incap_resource
• X-CDN: Incapsula response header
• title containing “Request unsuccessful. Incapsula incident ID”
• redirect chains with /_Incapsula_Resource paths

once confirmed, you know which layer your scraper is dying at.

strategy 1: managed scraping API (easiest)

if you do not need to roll your own, services like ScrapFly, ZenRows, Bright Data Web Unlocker, and Oxylabs Web Scraper API solve Imperva for you. you send a URL, they return the rendered HTML. cost is $0.5-3 per 1,000 successful requests depending on tier.

import requests

API_KEY = "your_zenrows_key"
target = "https://protected-by-incapsula.example.com/"

r = requests.get(
    "https://api.zenrows.com/v1/",
    params={"url": target, "apikey": API_KEY, "premium_proxy": "true", "js_render": "true"},
)
print(r.text[:500])

at small to mid volume, this is cheaper than building and maintaining your own bypass.

strategy 2: stealth headless browser + residential proxies (DIY)

for higher volume, do it yourself. the working stack in 2026:

• Playwright (Chromium) with playwright-stealth patches
• residential or mobile proxies (datacenter is auto-blocked at the IP layer)
• random user-agent matched to actual Chromium build
• viewport randomization
• --disable-blink-features=AutomationControlled flag

from playwright.async_api import async_playwright
from playwright_stealth import stealth_async
import asyncio

async def fetch(url):
    async with async_playwright() as p:
        browser = await p.chromium.launch(
            headless=True,
            args=["--disable-blink-features=AutomationControlled"],
            proxy={
                "server": "http://gate.smartproxy.com:7000",
                "username": "user-country-us",
                "password": "pass",
            },
        )
        ctx = await browser.new_context(
            user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
            viewport={"width": 1920, "height": 1080},
            locale="en-US",
        )
        page = await ctx.new_page()
        await stealth_async(page)

        await page.goto(url, wait_until="networkidle", timeout=45000)
        # incapsula JS challenge usually completes within 3-5s
        await page.wait_for_timeout(4000)

        # check whether the challenge passed
        content = await page.content()
        if "_Incapsula_Resource" in content or "incident ID" in content:
            raise RuntimeError("Incapsula challenge not passed")

        return content

print(asyncio.run(fetch("https://protected-site.example.com/products")))

key bits: wait_until="networkidle" lets the JS challenge run, the timeout gives slow proxies room, and the post-load check tells you if you actually got the real page.

strategy 3: TLS fingerprint matching with HTTP clients

if you need to avoid running a full browser, you can fake a Chrome JA3/JA4 fingerprint with a TLS-aware HTTP client. the leading options in 2026:

• curl_cffi: a Python wrapper around curl-impersonate, which mimics Chrome/Edge/Safari TLS handshakes. fastest path to JA3 spoofing.
• tls-client (Python or Go bindings): explicit TLS profile selection
• hrequests: high-level Python lib with rotating fingerprints

from curl_cffi import requests

r = requests.get(
    "https://protected-site.example.com/products",
    impersonate="chrome120",
    proxies={"http": PROXY, "https": PROXY},
)
print(r.status_code, r.text[:300])

this beats the TLS layer but does not run JavaScript, so it works for sites where Imperva’s challenge is configured in detect-only mode (passive monitoring, not enforcement). for sites with active JS challenges, this still fails. when in doubt, hybrid: try curl_cffi first, fall back to Playwright if you get a challenge response.

proxy choice matters more than tooling

Imperva’s IP reputation database is comprehensive. datacenter proxies from AWS, Azure, GCP, and most VPS providers are pre-flagged. residential and mobile IPs sail through the network layer.

for residential, use a major rotating provider. for stickier session needs (multi-page scraping where Incap needs the same cookie on each request), use sticky residential or ISP. our residential proxy guide explains the trade-offs.

mobile proxies are even safer but expensive. use them when residential is also being challenged.

handling the cookie chain

once you pass the first JS challenge, save the cookies. subsequent requests in the same session should reuse them. with Playwright contexts this is automatic. with raw HTTP, you need a session:

import requests
s = requests.Session()
s.proxies = {"http": PROXY, "https": PROXY}
s.headers.update({"User-Agent": "..."})

# first request triggers challenge, sets cookies
r1 = s.get(target_url)
# second and beyond reuse the cookies
r2 = s.get(target_url + "/page/2")

if the cookies expire (they often do after 5-15 minutes), you’ll get challenged again and need to re-render in a browser.

what does not work in 2026

• Selenium without stealth: detected via navigator.webdriver and dozens of other tells. patch with undetected-chromedriver at minimum.
• Python requests raw: TLS fingerprint blocked at the network layer.
• HTTP/2 fingerprinting evasion alone: Imperva’s stack now includes HTTP/2 SETTINGS frame fingerprinting, so you need to spoof those too (curl-impersonate does this).
• residential without browser: works on detect-only Incap, fails on active enforcement.
• “free” Incapsula bypass scripts on GitHub: most are 2-3 years out of date and the tokens they reverse-engineer have rotated.

related: Akamai and DataDome

Imperva is one of three big enterprise WAFs along with Akamai Bot Manager and DataDome. the techniques overlap heavily. our Akamai proxy bypass guide and DataDome bypass guide cover the differences. if a site uses multiple WAFs (some do), you need to handle the most aggressive one.

faq

is bypassing Incapsula illegal?
not by itself in most jurisdictions. WAF bypass is a technical activity. legality depends on what you do with the access, what the site’s ToS say, and the laws where you operate. public-data scraping under hiQ-style rules (US) generally holds up. always consult a lawyer for production use.

what is the difference between Incapsula and Imperva?
Incapsula was acquired by Imperva in 2014 and the product was rebranded to Imperva Cloud WAF / Imperva DDoS Protection. cookie names like incap_ses_ are still legacy markers from the original Incapsula product. you’ll see both names used interchangeably.

does ZenRows or ScrapFly really work for Incapsula?
yes, both have specific Imperva detection bypass features in 2026. expect 90%+ success on standard configs. some hardened deployments (large e-commerce, financial services) drop that to 70-80%.

how often do I need to refresh cookies?
typical Incap session cookies last 10-30 minutes of inactivity, longer with traffic. plan for re-challenge every 5-10 minutes if you scrape continuously, or use sticky residential for longer-lived sessions.

can I scrape Incapsula with curl_cffi alone?
sometimes. on detect-mode sites, yes. on enforce-mode sites with active JS challenges, no. always test with a small batch first.

what about proxies labeled “Imperva-bypass”?
marketing. no proxy alone bypasses Incapsula. the proxy gets you past the IP layer; you still need TLS fingerprinting and JS execution.

conclusion

bypassing Imperva in 2026 is a stack problem. residential proxies for the IP layer, TLS impersonation for the network handshake, headless browser with stealth for the JS challenge, and behavior simulation if the deployment is paranoid.

for most teams, a managed unblocking API is cheaper than building and maintaining this stack. for high-volume operations or use cases the APIs do not support, the DIY pattern above is the working baseline. expect to update it every few months as Imperva pushes new detections.

Best CAPTCHA Solving Services in 2026: Complete Comparison

When web scraping at scale, you’ll inevitably encounter CAPTCHAs that can’t be avoided through proxies or stealth browsers alone. CAPTCHA solving services bridge this gap by providing on-demand solutions for reCAPTCHA, hCaptcha, Cloudflare Turnstile, and other challenge types.

This guide compares the top CAPTCHA solving services in 2026, covering pricing, speed, accuracy, and integration complexity.

How CAPTCHA Solving Services Work

Most services operate on a task-based model:

1. Submit a task: You send the CAPTCHA type, sitekey, and page URL
2. Service solves it: Using human workers, AI, or a combination
3. Receive the token: You get a g-recaptcha-response, h-captcha-response, or similar token
4. Submit the token: Include it in your request to the target website

Solving Methods

Human solvers: Real people solve image challenges. Slower but handles any CAPTCHA type.

AI/ML solvers: Machine learning models trained on CAPTCHA images. Faster but may struggle with novel challenges.

Browser-based: The service runs real browsers that solve challenges natively. Best for Turnstile and invisible CAPTCHAs.

Top CAPTCHA Solving Services Compared

1. 2Captcha

One of the oldest and most established services.

Pricing:

• reCAPTCHA v2: $2.99 per 1000
• reCAPTCHA v3: $2.99 per 1000
• hCaptcha: $2.99 per 1000
• Turnstile: $2.99 per 1000
• Image CAPTCHA: $0.50-1.00 per 1000

Speed:

• reCAPTCHA v2: 15-45 seconds average
• reCAPTCHA v3: 10-25 seconds average
• hCaptcha: 20-50 seconds average
• Image CAPTCHA: 5-15 seconds average

Accuracy: 95-99% for standard CAPTCHAs

API Example:

import requests
import time

class TwoCaptchaClient:
    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://2captcha.com"

    def solve_recaptcha_v2(self, sitekey, page_url):
        # Submit
        response = requests.get(
            f"{self.base_url}/in.php",
            params={
                "key": self.api_key,
                "method": "userrecaptcha",
                "googlekey": sitekey,
                "pageurl": page_url,
                "json": 1
            }
        )

        task_id = response.json()["request"]

        # Poll
        for _ in range(60):
            time.sleep(5)

            result = requests.get(
                f"{self.base_url}/res.php",
                params={
                    "key": self.api_key,
                    "action": "get",
                    "id": task_id,
                    "json": 1
                }
            ).json()

            if result["status"] == 1:
                return result["request"]

            if result["request"] == "ERROR_CAPTCHA_UNSOLVABLE":
                raise Exception("CAPTCHA unsolvable")

        raise Exception("Timeout")

    def solve_hcaptcha(self, sitekey, page_url):
        response = requests.get(
            f"{self.base_url}/in.php",
            params={
                "key": self.api_key,
                "method": "hcaptcha",
                "sitekey": sitekey,
                "pageurl": page_url,
                "json": 1
            }
        )

        task_id = response.json()["request"]

        for _ in range(60):
            time.sleep(5)
            result = requests.get(
                f"{self.base_url}/res.php",
                params={
                    "key": self.api_key,
                    "action": "get",
                    "id": task_id,
                    "json": 1
                }
            ).json()

            if result["status"] == 1:
                return result["request"]

        raise Exception("Timeout")

# Usage
client = TwoCaptchaClient("YOUR_API_KEY")
token = client.solve_recaptcha_v2(
    sitekey="6LcXXXXXXXXXXXXXX",
    page_url="https://target-site.com/login"
)

Pros:

• Large worker pool ensures consistent availability
• Supports 50+ CAPTCHA types
• Good documentation
• Affordable pricing

Cons:

• Slower than AI-based solutions
• Quality can vary during peak hours

2. Anti-Captcha

A competitor to 2Captcha with a similar model but slightly different pricing and API.

Pricing:

• reCAPTCHA v2: $2.00 per 1000
• reCAPTCHA v3: $3.00 per 1000
• hCaptcha: $2.00 per 1000
• Turnstile: $2.00 per 1000

Speed:

• reCAPTCHA v2: 15-40 seconds
• reCAPTCHA v3: 10-30 seconds
• hCaptcha: 15-45 seconds

API Example:

class AntiCaptchaClient:
    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://api.anti-captcha.com"

    def create_task(self, task_type, website_url, website_key, **kwargs):
        task = {
            "type": task_type,
            "websiteURL": website_url,
            "websiteKey": website_key,
            **kwargs
        }

        response = requests.post(
            f"{self.base_url}/createTask",
            json={
                "clientKey": self.api_key,
                "task": task
            }
        )

        result = response.json()
        if result.get("errorId", 0) > 0:
            raise Exception(f"Error: {result.get('errorDescription')}")

        return result["taskId"]

    def get_result(self, task_id, timeout=180):
        start = time.time()

        while time.time() - start < timeout:
            time.sleep(3)

            response = requests.post(
                f"{self.base_url}/getTaskResult",
                json={
                    "clientKey": self.api_key,
                    "taskId": task_id
                }
            )

            result = response.json()

            if result["status"] == "ready":
                return result["solution"]

            if result.get("errorId", 0) > 0:
                raise Exception(f"Error: {result.get('errorDescription')}")

        raise Exception("Timeout")

    def solve_recaptcha_v2(self, sitekey, page_url):
        task_id = self.create_task(
            "RecaptchaV2TaskProxyless",
            page_url,
            sitekey
        )
        solution = self.get_result(task_id)
        return solution["gRecaptchaResponse"]

    def solve_turnstile(self, sitekey, page_url):
        task_id = self.create_task(
            "TurnstileTaskProxyless",
            page_url,
            sitekey
        )
        solution = self.get_result(task_id)
        return solution["token"]

Pros:

• Slightly cheaper than 2Captcha
• Clean, well-documented API
• Good SDK support (Python, Node.js, PHP)
• Reliable uptime

Cons:

• Smaller worker pool than 2Captcha
• Occasional slower solve times during peak hours

3. CapSolver

An AI-first solving service that uses machine learning instead of human workers.

Pricing:

• reCAPTCHA v2: $1.50-2.50 per 1000
• reCAPTCHA v3: $3.00 per 1000
• hCaptcha: $2.00-3.00 per 1000
• Turnstile: $1.00 per 1000

Speed:

• reCAPTCHA v2: 5-20 seconds (AI)
• reCAPTCHA v3: 5-15 seconds
• hCaptcha: 5-25 seconds
• Turnstile: 3-10 seconds

API Example:

class CapSolverClient:
    def __init__(self, api_key):
        self.api_key = api_key
        self.base_url = "https://api.capsolver.com"

    def solve(self, task_type, **kwargs):
        payload = {
            "clientKey": self.api_key,
            "task": {
                "type": task_type,
                **kwargs
            }
        }

        response = requests.post(
            f"{self.base_url}/createTask",
            json=payload
        )

        result = response.json()
        if result.get("errorId"):
            raise Exception(result.get("errorDescription"))

        task_id = result["taskId"]

        # Poll for result
        for _ in range(60):
            time.sleep(2)

            check = requests.post(
                f"{self.base_url}/getTaskResult",
                json={
                    "clientKey": self.api_key,
                    "taskId": task_id
                }
            ).json()

            if check["status"] == "ready":
                return check["solution"]

        raise Exception("Timeout")

    def solve_recaptcha_v2(self, sitekey, url):
        solution = self.solve(
            "ReCaptchaV2TaskProxyLess",
            websiteURL=url,
            websiteKey=sitekey
        )
        return solution["gRecaptchaResponse"]

    def solve_hcaptcha(self, sitekey, url):
        solution = self.solve(
            "HCaptchaTaskProxyLess",
            websiteURL=url,
            websiteKey=sitekey
        )
        return solution["gRecaptchaResponse"]

Pros:

• Fastest solve times (AI-powered)
• Competitive pricing
• Good Turnstile support
• Lower latency

Cons:

• AI accuracy can drop on novel CAPTCHA variants
• Newer service, less track record
• May struggle with unusual image challenges

4. CapMonster Cloud

An AI-based service from the makers of the popular CapMonster desktop software.

Pricing:

• reCAPTCHA v2: $1.80 per 1000
• reCAPTCHA v3: $2.40 per 1000
• hCaptcha: $1.50 per 1000
• Turnstile: $1.20 per 1000

Speed:

• Generally 5-20 seconds for token CAPTCHAs
• Image CAPTCHAs: 2-8 seconds

Pros:

• Very competitive pricing
• Fast AI-based solving
• Good accuracy
• Browser extension available

Cons:

• Smaller market presence
• Limited documentation compared to 2Captcha

5. NopeCHA

A browser extension-based service that also offers API access.

Pricing:

• Free tier: 100 solves/month
• Paid: From $5/month for 5000 solves

Best for:

• Small-scale scraping
• Browser extension use cases
• Testing and prototyping

Comprehensive Comparison Table

Service	reCAPTCHA v2 (per 1K)	hCaptcha (per 1K)	Turnstile (per 1K)	Avg Speed	Accuracy	API Quality
2Captcha	$2.99	$2.99	$2.99	20-40s	97%	Excellent
Anti-Captcha	$2.00	$2.00	$2.00	15-35s	96%	Excellent
CapSolver	$1.50-2.50	$2.00-3.00	$1.00	5-20s	93%	Good
CapMonster	$1.80	$1.50	$1.20	5-20s	94%	Good
NopeCHA	Free-$5/mo	Free-$5/mo	Free-$5/mo	10-30s	90%	Basic

Building a Multi-Service Pipeline

Don’t rely on a single service. Build a fallback pipeline for maximum reliability:

import time
import logging

logger = logging.getLogger(__name__)

class CaptchaSolvingPipeline:
    def __init__(self, services):
        """
        services: list of (name, client) tuples in priority order
        """
        self.services = services
        self.stats = {name: {"success": 0, "fail": 0, "total_time": 0}
                      for name, _ in services}

    def solve(self, captcha_type, sitekey, page_url, max_attempts=3):
        """Try each service in order until one succeeds."""

        for attempt in range(max_attempts):
            for name, client in self.services:
                try:
                    start = time.time()

                    if captcha_type == "recaptcha_v2":
                        token = client.solve_recaptcha_v2(sitekey, page_url)
                    elif captcha_type == "hcaptcha":
                        token = client.solve_hcaptcha(sitekey, page_url)
                    elif captcha_type == "turnstile":
                        token = client.solve_turnstile(sitekey, page_url)
                    else:
                        raise ValueError(f"Unknown type: {captcha_type}")

                    elapsed = time.time() - start
                    self.stats[name]["success"] += 1
                    self.stats[name]["total_time"] += elapsed

                    logger.info(f"Solved with {name} in {elapsed:.1f}s")
                    return token

                except Exception as e:
                    self.stats[name]["fail"] += 1
                    logger.warning(f"{name} failed: {e}")

        return None

    def get_stats(self):
        report = {}
        for name, data in self.stats.items():
            total = data["success"] + data["fail"]
            rate = (data["success"] / total * 100) if total > 0 else 0
            avg_time = (data["total_time"] / data["success"]) if data["success"] > 0 else 0
            report[name] = {
                "success_rate": f"{rate:.1f}%",
                "avg_solve_time": f"{avg_time:.1f}s",
                "total_solves": total
            }
        return report

# Usage
pipeline = CaptchaSolvingPipeline([
    ("capsolver", CapSolverClient("KEY1")),      # Fastest, try first
    ("2captcha", TwoCaptchaClient("KEY2")),       # Most reliable, fallback
    ("anticaptcha", AntiCaptchaClient("KEY3")),   # Second fallback
])

token = pipeline.solve(
    captcha_type="recaptcha_v2",
    sitekey="6LcXXXXXXXX",
    page_url="https://target-site.com/login"
)

if token:
    print(f"Token obtained: {token[:50]}...")
    print(pipeline.get_stats())

Integration with Scrapy

# Scrapy middleware for automatic CAPTCHA solving
from scrapy.http import HtmlResponse
from bs4 import BeautifulSoup

class CaptchaSolvingMiddleware:
    def __init__(self, pipeline):
        self.pipeline = pipeline

    @classmethod
    def from_crawler(cls, crawler):
        services = [
            ("capsolver", CapSolverClient(crawler.settings.get("CAPSOLVER_KEY"))),
            ("2captcha", TwoCaptchaClient(crawler.settings.get("TWOCAPTCHA_KEY"))),
        ]
        return cls(CaptchaSolvingPipeline(services))

    def process_response(self, request, response, spider):
        soup = BeautifulSoup(response.text, 'html.parser')

        # Check for reCAPTCHA
        recaptcha_div = soup.find('div', class_='g-recaptcha')
        if recaptcha_div:
            sitekey = recaptcha_div.get('data-sitekey')
            token = self.pipeline.solve("recaptcha_v2", sitekey, request.url)

            if token:
                # Resubmit with token
                return request.replace(
                    method="POST",
                    body=f"g-recaptcha-response={token}",
                    dont_filter=True
                )

        return response

Cost Optimization Tips

1. Avoid CAPTCHAs When Possible

The cheapest CAPTCHA solve is the one you don’t need. Use residential proxies and stealth browsers to minimize CAPTCHA encounters.

2. Cache Solved Sessions

After solving a CAPTCHA, reuse the session cookies for as long as they’re valid:

# After solving CAPTCHA and logging in
session_cookies = response.cookies.get_dict()

# Reuse for subsequent requests (no CAPTCHA needed)
for url in urls:
    response = requests.get(url, cookies=session_cookies, headers=headers)

3. Use the Cheapest Service for Each Type

Different services have different pricing per CAPTCHA type. Route each type to the cheapest provider:

routing = {
    "recaptcha_v2": "anticaptcha",    # $2.00/1K
    "hcaptcha": "capmonster",          # $1.50/1K
    "turnstile": "capsolver",          # $1.00/1K
}

4. Monitor and Adjust

Track your solving costs and success rates. Switch providers if quality drops:

def monthly_cost_report(stats, pricing):
    total_cost = 0
    for service, data in stats.items():
        solves = data["success"]
        cost = solves * pricing[service] / 1000
        total_cost += cost
        print(f"{service}: {solves} solves = ${cost:.2f}")
    print(f"Total: ${total_cost:.2f}")

Choosing the Right Service

For highest reliability: 2Captcha or Anti-Captcha (human solvers handle edge cases)

For fastest speed: CapSolver or CapMonster (AI-powered, 5-20 second solves)

For lowest cost: CapMonster for hCaptcha, CapSolver for Turnstile

For small scale/testing: NopeCHA (free tier available)

For production: Multi-service pipeline with automatic failover

Conclusion

CAPTCHA solving services are an essential tool for web scraping at scale. No single service is best for all situations — the optimal approach is a multi-service pipeline that routes different CAPTCHA types to the most cost-effective provider, with automatic failover for reliability.

Combine solving services with CAPTCHA avoidance strategies (residential proxies, stealth browsers, session reuse) to minimize costs while maintaining high success rates.

For related guides, see our articles on bypassing reCAPTCHA, bypassing hCaptcha, and Cloudflare Turnstile.

• 403 Forbidden in Web Scraping: How to Fix It
• Best CAPTCHA Solving Services in 2026: Complete Comparison
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research
• 403 Forbidden in Web Scraping: How to Fix It
• Best CAPTCHA Solving Services in 2026: Complete Comparison
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research
• 403 Forbidden in Web Scraping: How to Fix It
• Best CAPTCHA Solving Services in 2026: Complete Comparison
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research
• 403 Forbidden in Web Scraping: How to Fix It
• Browser Fingerprinting: What It Is and How to Prevent It
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research
• 403 Forbidden in Web Scraping: How to Fix It
• Browser Fingerprinting: What It Is and How to Prevent It
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research
• 403 Forbidden in Web Scraping: How to Fix It
• Browser Fingerprinting: What It Is and How to Prevent It
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research

---

Related Reading

• 403 Forbidden in Web Scraping: How to Fix It
• Browser Fingerprinting: What It Is and How to Prevent It
• Anti-Phishing with Proxies: How Security Teams Use Mobile IPs
• Brand Protection with Proxies: Detect Counterfeit Sellers & Trademark Violations
• How Cybersecurity Teams Use Proxies for Threat Intelligence
• Using Mobile Proxies for Dark Web Monitoring and Research