How to Know If Your Playwright Script Is Being Flagged by a CAPTCHA

You know your Playwright script is being flagged by a CAPTCHA when the page shows a challenge: a checkbox like 'I am not a robot', an image grid, a puzzle, a 'Verify you are human' overlay, or an access-denied page. You can also confirm it from inside Playwright by inspecting frames and network traffic. If a frame or request points to a known CAPTCHA provider, your script is being challenged.

Do not trust only one sign. A visible CAPTCHA is the strongest signal, but some challenges are invisible and appear only in network logs, cookies, or browser behavior. Use the ordered checks below to build a repeatable diagnostic.

What a CAPTCHA flag actually looks like

A CAPTCHA flag is any response designed to separate automated visitors from humans. The most common forms are:

• A checkbox widget that asks you to confirm you are human.
• An image grid that asks you to select certain objects.
• A puzzle, a slider, or a rotating circle challenge.
• A page that says 'Your traffic looks automated' or 'Verify you are human'.
• A silent challenge that stores a cookie or token without showing a visible widget.

The script does not have to click anything first. Detection can happen on page load, before your Playwright code touches a button. So a challenge in the first screenshots is still a flag.

How to check for a CAPTCHA in Playwright: a diagnostic sequence

Use this sequence when you suspect a challenge. It is designed to give you evidence before you change your script.

1. Stop the script at the moment behavior changes. Take a screenshot and save the page HTML. You need a record of what the browser actually saw.
2. Check the main document for challenge text. Look for words like 'captcha', 'verify', 'robot', 'automated', or 'security check'. Search the page content, not just the visible area.
3. List every frame. CAPTCHAs often load inside an iframe. In Playwright, inspect all frames on the page and read each frame's URL. If the URL contains a CAPTCHA provider or challenge endpoint, that is a flag.
4. Use a frame locator for hidden iframes. A CAPTCHA iframe may have display:none. The frame still exists in the browser, so a frame locator can find it even when the widget is not visible.
5. Watch network requests. Log requests for scripts and resources from CAPTCHA domains. A challenge token request is strong evidence even without a visible widget.
6. Check cookies and console messages. Challenge cookies often appear after a proof-of-work check. Console errors may also appear when a challenge script fails.
7. Re-run in a clean context. If the challenge disappears with a fresh browser profile or different network, the flag may be tied to cookies, IP reputation, or previous session data.

Each check adds one piece of evidence. Do not make a final call after the first step.

Other signals that point to a challenge

CAPTCHA flags do not always announce themselves. Watch for these less obvious signs:

• Unexpected navigation. The page redirects to a verify or challenge URL.
• Missing elements. A button you expected never appears, even with a long wait.
• Behavior changes between runs. The script works once and fails the next time, or works in one browser and fails in another.
• HTTP 403 or 429 responses. The server refuses access after a challenge is issued.
• Changed browser properties. Detection systems can inspect browser APIs. BotRefund's Playwright Init Scripts check looks for 'a mismatch that a real browsing session does not normally create' when automation tools patch or hide APIs.

These signals are useful evidence, but none of them alone proves a CAPTCHA flag.

What is not a CAPTCHA flag

Not every failure means a CAPTCHA. Confusing ordinary failures with a flag will waste your time.

• A timeout is not a flag. The page may be slow, the selector may be wrong, or the server may be overloaded.
• A missing element is not a flag. The selector may have changed after a redesign.
• A generic 403 is not always a CAPTCHA. The server may block the path, the IP, or the user agent for other reasons.
• A consent popup is not a CAPTCHA. Cookie banners and age gates look like obstacles but are not bot challenges.

Genuine visitors can also trigger security checks. According to BotRefund's detection notes, privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for real people. So treat a challenge as evidence to investigate, not a proof that your script is the cause.

Why one anomaly is not a bot verdict

The most common mistake is to see one strange response and assume the script was caught. Bot detection services rarely work that way. BotRefund describes the Playwright Init Scripts signal as one of 106 independent checks. It is evidence, not a verdict.

The same source explains why this matters: 'Automation tools often patch or hide browser APIs, but those changes can break when the browser is checked from another angle.' One check can produce a mismatch. Another check can behave normally. Good detection systems cross-check the signal against independent browser, network, device, and behavior data before deciding.

For you, that means a CAPTCHA appears only after enough signals agree. If you are testing a script, collect the full picture before changing your approach.

Key facts: how bot detection treats Playwright traffic

The following facts come from BotRefund's public materials about bot detection and the Playwright Init Scripts check.

Use this table as a reference. It explains why your Playwright run can trigger a challenge even when the page looks normal.

Limitations and when this advice does not apply

This article is about diagnosis, not bypass. If you are trying to make a Playwright script pass a CAPTCHA, this is the wrong goal. Automating past a challenge can violate a site's terms of service and, in some cases, the law. For a site you do not own, stop at detection.

This advice also does not apply to every CAPTCHA. Providers change their DOM, frame structure, and challenge flow. A selector that works today can fail tomorrow. Use the general diagnostic steps instead of hard-coded names.

Finally, do not assume a visible CAPTCHA is always aimed at your script. It can be a random safety check for all visitors, a reaction to a shared IP, or a response to a browser profile with unusual settings. Gather evidence across multiple runs before concluding your Playwright code is the reason.

Frequently asked questions

Why does my Playwright script get a CAPTCHA right after the page loads?

Detection can happen before any interaction. In BotRefund's model, automation tools often patch or hide browser APIs, and those changes can be detected when the browser is checked from another angle. The challenge is not always caused by what your script did after loading; it can be caused by how the browser behaves on load.

Can a CAPTCHA flag be invisible?

Yes. Some challenges run silently and only set a cookie or trigger a network request. If you only look for a visible widget, you can miss the flag. Check frames, network requests, and challenge cookies as part of your diagnostic.

Does every CAPTCHA mean my script was detected?

No. A CAPTCHA can appear for reasons unrelated to Playwright: shared IP address, unusual device, privacy tools, or random security checks. As BotRefund puts it, a single anomaly is not a bot verdict.

What should I record when I see a CAPTCHA?

Save the page title, page HTML, screenshot, frame URLs, network requests, cookies, and console errors. The more context you keep, the easier it is to see whether the challenge repeats or disappears.

How can I tell whether the challenge is about my script or the network?

Re-run the same script from a different network and browser profile. If the challenge disappears, the flag may be tied to the IP or session. If it follows, the browser automation itself is likely the trigger.

Should I use a CAPTCHA-solving service with Playwright?

Before choosing that route, check the website's terms and the laws that apply to you. CAPTCHA-solving services may violate terms of service or local computer-misuse laws. This article is not guidance on bypassing a challenge.