Understanding how CAPTCHA protects your account

<body>
<p id="docs-hc-snippet" style="display: none;">A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security test used by websites to verify that the user is a human, rather than a malicious automated bot. CAPTCHA helps protect Zendesk ticket submission forms from spam by verifying that anonymous users are human before they can submit a request.</p>
<div class="article-banners">
<div id="docs-wmp-link">
<a href="https://support.zendesk.com/hc/en-us/articles/5411234991258-plan" rel="noopener" target="_blank">What's my plan?</a>
</div>

<div class="article-banner" id="suite_all">
<table>
<tbody>
<tr>
<td>
<strong>All Suites</strong>
</td>
<td>Team, Growth, Professional, Enterprise, or Enterprise Plus</td>
</tr>
</tbody>
</table>
</div>

<div class="article-banner" id="support_with_guide_all">
<table>
<tbody>
<tr>
<td>
<strong>Support with</strong>
</td>
<td>Knowledge Professional or Enterprise</td>
</tr>
</tbody>
</table>
</div>

</div>
<div id="docs-ai-summary">
<p id="docs-ai-summary-toggle">Summary: <span id="up-triangle">◀</span><span id="down-triangle">▼</span></p>
<p id="docs-ai-summary-content">CAPTCHA protects your account by verifying that ticket submissions come from humans, not bots, reducing spam. It uses bot scores to assess risk and prompts verification only when needed. CAPTCHA is always on for anonymous users submitting tickets and can't be disabled. Issues with CAPTCHA often relate to browser compatibility or ad blockers. Good bots can be whitelisted by contacting support.</p>
</div>

<div class="body">

<p class="p">A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is
a security test used by websites to verify that the user is a human, rather than a
malicious automated bot. CAPTCHA helps protect Zendesk ticket submission forms from spam
by verifying that anonymous users are human before they can submit a request. </p>
<p class="p">This article explains when CAPTCHA appears, how Cloudflare’s Bot Management determines
risk, and answers common questions about errors, bot scores, and supported submission
methods.</p>
<p class="p">This article contains the following sections:</p>
<div class="p">
<ul class="ul" id="zug_hc_captcha_faqs__ul_f43_3dg_dpb">
<li class="li"><a class="xref" href="#topic_zsl_t41_n3c">About CAPTCHA</a></li>
<li class="li"><a class="xref" href="#topic_pkp_v41_n3c">CAPTCHA FAQs</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title2" class="topic nested1" id="topic_zsl_t41_n3c">
<h2 class="title topictitle2" id="ariaid-title2">About CAPTCHA</h2>
<div class="body">
<p class="p">Allowing anyone to submit tickets can result in spam appearing in your Zendesk
account. To help prevent this, Zendesk requires <em class="ph i">unregistered users who aren’t
signed in</em> to verify they’re human before they can submit a ticket.</p>
<p class="p"><img class="image img-screenshot" id="topic_zsl_t41_n3c__image_bvx_vdq_lj" src="https://zen-marketing-documentation.s3.amazonaws.com/docs/en/captcha_request2.png" width="300"></p>
<p class="p"> Zendesk uses <a class="xref" href="https://www.cloudflare.com/products/bot-management/" target="_blank">Cloudflare's bot detection and management
software</a> to help distinguish humans from bots and other abusive traffic.
In most cases, users can simply confirm they’re human without solving a full CAPTCHA
challenge. If Zendesk’s risk analysis engine can’t confidently determine whether the
requester is human, it presents a CAPTCHA that must be completed before the ticket
can be submitted.</p>
<p class="p" dir="ltr">Zendesk may prompt a user to complete a CAPTCHA based on signals such
as:</p>
<ul class="ul" id="topic_zsl_t41_n3c__ul_qkq_r4j_xjc">
<li class="li">The request has a <a class="xref" href="#topic_aqr_hdg_dpb">bot score</a>
below the threshold.</li>
<li class="li">The request doesn't match a verified bot such as a search crawler.</li>
<li class="li">The request is made on an <code class="ph codeph">/hc</code> path for any of the following
URLs:<ul class="ul" id="topic_zsl_t41_n3c__ul_xjn_cqj_xjc">
<li class="li">Sign in:
<code class="ph codeph">https://<em class="ph i">yoursubdomain</em>.zendesk.com/auth/v2/login/</code>
</li>
<li class="li">Register:
<code class="ph codeph">https://<em class="ph i">yoursubdomain</em>.zendesk.com/auth/v2/login/registration</code>
</li>
<li class="li">Ticket requests:
<code class="ph codeph">https://<em class="ph i">yoursubdomain</em>.zendesk.com/hc/en-us/requests/new</code>
</li>
</ul>
</li>
</ul>
<p class="p">CAPTCHA is turned on by default and can't be turned off. It isn't available with the
Web Widget (Classic).</p>
</div>
</div>
<div aria-labelledby="ariaid-title3" class="topic nested1" id="topic_pkp_v41_n3c">
<h2 class="title topictitle2" id="ariaid-title3">CAPTCHA FAQs</h2>
<div class="body">
<p class="p">The following sections answer frequently asked questions about CAPTCHA:</p>
<div class="p">
<ul class="ul">
<li class="li"><a class="xref" href="#topic_wyr_fdg_dpb">Why do I only see a CAPTCHA
sometimes?</a></li>
<li class="li"><a class="xref" href="#topic_aqr_hdg_dpb">What is a bot
score?</a></li>
<li class="li"><a class="xref" href="#topic_kzh_gdg_dpb">Why am I seeing an error when CAPTCHA is rendered?</a></li>
<li class="li"><a class="xref" href="#topic_e5n_gdg_dpb">Why is my automation application or good bot being blocked?</a></li>
<li class="li"><a class="xref" href="#topic_qcg_hdg_dpb">Is CAPTCHA on for host-mapped accounts?</a></li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title4" class="topic nested2" id="topic_wyr_fdg_dpb">
<h3 class="title topictitle3" id="ariaid-title4">Why do I only see a CAPTCHA sometimes?</h3>
<div class="body">
<p class="p" dir="ltr">Cloudflare Bot Management analyzes Zendesk traffic and assigns a score
based on how likely each request is to come from a human or a bot. CAPTCHA is
triggered when traffic falls within a specific threshold, since CAPTCHA is
mainly intended to challenge bot-like activity.</p>
<p class="p" dir="ltr">It is extremely rare for legitimate human traffic to be misclassified
as bot traffic by Cloudflare.</p>
</div>
</div>
<div aria-labelledby="ariaid-title5" class="topic nested2" id="topic_aqr_hdg_dpb">
<h3 class="title topictitle3" id="ariaid-title5">What is a bot score?</h3>
<div class="body">
<p class="p" dir="ltr">Requesters are prompted to complete a CAPTCHA when their request meets
certain criteria, such as falling within a specific bot score range.</p>
<p class="p">A bot score is a value from 1 to 99 that indicates how likely a request is to
have come from a bot:</p>
<ul class="ul" id="topic_aqr_hdg_dpb__ul_l2k_crj_xjc">
<li class="li">1 = very likely automated</li>
<li class="li">99 = very likely human</li>
</ul>
</div>
</div>
<div aria-labelledby="ariaid-title6" class="topic nested2" id="topic_kzh_gdg_dpb">
<h3 class="title topictitle3" id="ariaid-title6">Why am I seeing an error when CAPTCHA is rendered?</h3>
<div class="body">
<p class="p" dir="ltr">Ad blockers can disable CAPTCHA in some browsers, and older browsers
may have trouble displaying CAPTCHAs. For more information, see Cloudflare’s
<a class="xref" href="https://support.cloudflare.com/hc/en-us/articles/360035387431#5KX8t3C6SObnoWs5F6YOlU" target="_blank">troubleshooting topics for Cloudflare bot
products</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title7" class="topic nested2" id="topic_e5n_gdg_dpb">
<h3 class="title topictitle3" id="ariaid-title7">Why is my automation application or good bot being blocked?</h3>
<div class="body">
<p class="p" dir="ltr">If you are running a good bot and it's still being blocked, <a class="xref" href="https://support.zendesk.com/hc/en-us/articles/4408843597850" target="_blank">contact Zendesk Customer Support</a>.</p>
</div>
</div>
<div aria-labelledby="ariaid-title8" class="topic nested2" id="topic_qcg_hdg_dpb">
<h3 class="title topictitle3" id="ariaid-title8">Is CAPTCHA on for host-mapped accounts?</h3>
<div class="body">
<p class="p" dir="ltr">Cloudflare Bot Management tracks traffic for host-mapped accounts.
CAPTCHA is turned on by default when anyone is allowed to submit tickets, and it
can't be turned off.</p>
</div>
</div>
</div>
<script id="docs-schema-markup" type="application/ld+json">{
"@context": "https://schema.org",
"@type": "TechArticle",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408839088794-About-CAPTCHA-and-CAPTCHA-FAQs",
"url": "https://support.zendesk.com/hc/en-us/articles/4408839088794-About-CAPTCHA-and-CAPTCHA-FAQs",
"headline": "Understanding how CAPTCHA protects your account",
"description": "You learn how CAPTCHA verifies human users to protect ticket submission forms from spam by using risk analysis and bot detection to prompt verification only when necessary.",
"articleSection": "Using the knowledge base in help center",
"datePublished": "2021-10-16T05:34:15+00:00",
"dateModified": "2026-07-31T14:52:04.835939+00:00",
"inLanguage": "en-US",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://support.zendesk.com/hc/en-us/articles/4408839088794-About-CAPTCHA-and-CAPTCHA-FAQs"
},
"author": {
"@type": "Organization",
"name": "Zendesk",
"url": "https://www.zendesk.com"
},
"publisher": {
"@type": "Organization",
"name": "Zendesk"
},
"isPartOf": {
"@type": "WebSite",
"name": "Zendesk Help",
"url": "https://support.zendesk.com/hc/en-us"
},
"about": {
"@type": "SoftwareApplication",
"name": "Zendesk"
}
}</script><script id="ai-summary-script">
//<![CDATA[
const ai_summary_style = document.createElement('style');
ai_summary_style.innerHTML = `#styled-article-body{padding:0 0 0}#article-body #docs-ai-summary{background-color:#f3f3f3;border:1px solid #d3d3d3;padding:10px 10px 6px;margin-bottom:16px}#article-body #docs-ai-summary #docs-ai-summary-toggle{font-size:.9em;font-weight:700;margin-bottom:4px;cursor:pointer;display:flex;justify-content:space-between;align-items:center}#article-body #docs-ai-summary #docs-ai-summary-toggle #up-triangle{margin-left:auto;padding-right:10px;display:none}#article-body #docs-ai-summary #docs-ai-summary-toggle #down-triangle{margin-left:auto;padding-right:10px}#article-body #docs-ai-summary #docs-ai-summary-content{font-size:.9em;padding-left:25px;padding-right:25px;margin-bottom:12px}`;
document.head.appendChild(ai_summary_style);

const toggleAISummary = () => {
const summary = document.getElementById("docs-ai-summary-content");
const upTriangle = document.getElementById("up-triangle");
const downTriangle = document.getElementById("down-triangle");
if (summary.style.display === "none") {
summary.style.display = "block";
upTriangle.style.display = "none";
downTriangle.style.display = "inline";
} else {
summary.style.display = "none";
upTriangle.style.display = "inline";
downTriangle.style.display = "none";
}
};

document.getElementById("docs-ai-summary-toggle").addEventListener("click", toggleAISummary);
//]]>
</script>
</body>