What a CAPTCHA measures before it shows you anything
Cloudflare Turnstile, reCAPTCHA v3 and AWS WAF challenge are scoring systems first and puzzles second. On every request they look at the IP's history, the TLS/JA3 fingerprint of the client, the order and timing of the requests, and dozens of browser signals. A high score passes silently; a low one gets a managed challenge; a very low one is blocked with no puzzle at all.
This is why 'CAPTCHA solving services' that only return a token underperform: by the time you need the token the request has already been marked as automation, and the token is issued to a session the target does not trust.
Why the IP is half the score, not all of it
A datacenter address fails the reputation check immediately, so residential and mobile exits are necessary. They are not sufficient. A residential IP with a Python TLS fingerprint and no JavaScript execution scores about as badly as a datacenter one, because the fingerprint says 'script' regardless of where the packet came from.
# The same request, two fingerprints curl -x http://user:pass@gw.datafuel.ai:8686 https://target.example/ # residential IP, curl TLS → challenged # vs. a real browser profile behind the same exit → passes silently
Passing consistently means matching three things at once: an exit the target trusts, a TLS fingerprint that belongs to a real browser, and behaviour that looks like a page load rather than an API call.
The unlocker pipeline
An unlocker does the coordination for you: pick the exit tier, rotate the JA3 fingerprint per request, run a real browser only when the page needs it, and if a challenge still appears, solve it inside the same request and retry on a fresh identity. We handle exactly this in the Unlocker API; a blocked attempt is retried automatically and never billed, so the cost of a hard target is bounded by success, not by attempts.
What still fails
Targets that require an authenticated session, hardware-attested clients or interactive multi-step flows are not CAPTCHA problems; they are access problems, and no amount of solving fixes them. Be honest with stakeholders about that boundary.
Practical checklist
Use residential or mobile exits in the target's country. Rotate TLS fingerprints. Render only when the page needs JavaScript. Keep sessions sticky through multi-step flows. Measure success per domain, not per run, and stop paying for failures.