Stall library · Buy
CAPTCHA stops the AI agent at checkout
A CAPTCHA at checkout is a human verification challenge placed between the cart and the payment step, and it ends an AI agent journey by design, because the whole purpose of the control is to distinguish a human from an automated client. The agent may have chosen your product correctly, added the right variant and reached the checkout, and none of that survives the challenge.
Why the agent stops
A CAPTCHA is not a bug that an agent works around. It is a working control doing exactly what it was installed to do, and it does not distinguish between a card testing script and an assistant buying a jumper for a named customer.
The cost lands entirely at the end of the funnel, which is what makes it the most expensive stall in the taxonomy per occurrence. Every fetch, every comparison and every decision already happened. Only the payment remained.
How often we see this
Not stated here. A frequency means nothing without the cohort it was counted over, and this page is about one stall rather than one category. Where a category has enough stores measured at every stage, the share of them showing this stall is published on its benchmark page, with the methodology beside it.
See it for yourself
- Complete a checkout yourself in a private window and note whether a challenge appears, and at which step.
- Fetch the checkout page and search the source for recaptcha, turnstile, hcaptcha or a data-sitekey attribute.
- Check whether the challenge fires on every checkout or only on a risk trigger, by trying from a different network.
What to change
- Move the challenge to a risk based trigger rather than applying it to every checkout.
- Exempt verified or allowlisted agent traffic from the challenge.
- Where fraud pressure is the reason, prefer controls that act on the payment attempt rather than on the ability to reach the form.
- Review this after any change to your fraud tooling, since challenge scope is commonly widened by default in an update.
What Ottom looks at
Ottom looks for CAPTCHA widgets and their frames on the checkout path and raises this finding when one stands between the cart and the payment step. The evidence records the URL where the challenge appeared.
Questions
Do I have to remove the checkout CAPTCHA for agents?
No. The recommendation is to scope it. A challenge that fires on a risk signal protects you from the traffic it was bought for, and a challenge that fires on every checkout also blocks the purchases you want.
Can an agent solve a CAPTCHA?
An honest one does not try, and Ottom does not. Solving it would defeat a control the merchant chose deliberately, which is not a thing a measurement tool should do to a store it is measuring.