Download websites that use hCaptcha

About hCaptcha

Bot protection is usually whatever the form plugin or the platform happened to ship with. hCaptcha generally is not that default, and the deliberateness of the choice is what makes this population worth reading. Somebody replaced something that already worked, and replacements have reasons behind them.

hCaptcha is a Security service launched in 2019 by Intuition Machines, delivered as a Proprietary hosted widget and embedded through JavaScript on the page. The service presents a challenge, decides whether the visitor is human, and returns a token the site verifies before accepting a submission. Functionally it is interchangeable with the incumbent alternative, which is exactly why the decision to switch carries information.

The motives cluster into a few recognisable groups. Some operators want visitor signals to stop flowing to a large advertising company, either on principle or because a privacy assessment told them to. Some are in Europe and treat data transfer as a legal exposure. Some took the revenue share on offer. Some simply had a bad experience with abuse getting through the default. The resulting population skews toward privacy conscious operators, financial and cryptocurrency services, communities that attract determined abuse, and organisations whose legal function has an opinion about vendors. Anyone selling privacy tooling, European hosting, compliance services or anti abuse products is looking at an audience that has already demonstrated a willingness to swap a default vendor out.

As of October 2026 we detect the widget on 286,761 sites, 176,884 of them in United States, with .com carrying the largest block of suffixes. The country column complicates the privacy reading somewhat, which is worth saying rather than smoothing over. A heavy presence in the same market as the incumbent suggests the decision is driven as much by cost, by abuse performance and by tolerance for the challenge experience as by data protection concerns.

Version filtering does nothing useful on this technology. The service exposes an interface generation marker rather than a build number, so every detection looks alike and there is no upgrade curve to study.

Detection has one significant limit here. The widget only loads on pages that carry a protected form, so a site that uses it exclusively on a login screen, a registration step or a checkout page can be missed entirely by a crawl that sees the front page. The count is a floor, and it is a floor biased toward sites that expose a contact or comment form publicly.

The export gives one row per detected site with the domain, the country, the suffix and the detection date. That inverts the usual lookup, which starts from a domain you already know, and lets research start from the technology instead.