Skip to content
Akkrev
Get started

Why CAPTCHAs on hotel booking pages stop AI agents

USUpdated By Akkrev

AI agents are built not to solve CAPTCHAs, so a challenge on a US hotel's booking page hands the booking back to the guest, or to an OTA. Here's how to spot it.

Mainstream AI agents are designed to stop at CAPTCHAs and hand control back to the user. That’s a sensible safety choice. For hotels, it means a CAPTCHA on the booking page turns a smooth agent booking into “please finish this yourself”, and many guests would rather the agent book somewhere else.

Where hotel CAPTCHAs come from

  • The booking engine, protecting against scraping and card testing.
  • A CDN or web host applying a challenge to traffic it thinks is automated.
  • Fraud tools at the payment step.
  • Form plugins on enquiry and group booking forms.

Hotels often don’t know which layer is responsible, because each was set up by a different vendor.

Invisible challenges are worse

Modern bot protection often doesn’t show a puzzle. It scores the visitor and silently blocks or slows suspicious ones. An agent may see an endless spinner, a blank booking page or a generic error, and report that the hotel’s site isn’t working.

The direction of travel

Security vendors increasingly recognize verified agents. Major agents now sign their requests with Web Bot Auth, and Google identifies agent traffic on its infrastructure with the Google-Agent user agent. Whether that helps a given hotel depends on how its security is configured.

Why agents are designed to stop

AI companies build their agents to stop at CAPTCHAs on purpose. Solving them would mean deliberately getting around a site’s security, which agents are designed not to do. So when an agent meets a challenge, it pauses and asks the user to step in.

For the guest, that’s an interruption. They asked the agent to handle the booking. Some will take over and finish. Many will tell the agent to find somewhere else, and the agent knows where it can book without interruption: an OTA, or another hotel.

Card testing and scraping are real problems

Hotels and booking engines add challenges for good reasons:

  • Card testing: fraudsters use booking forms to test stolen card numbers.
  • Rate scraping: competitors and resellers copy prices and availability.
  • Fake bookings: bots hold inventory or submit spam reservations.

The goal isn’t to remove protection. It’s to protect the right steps (payment, repeated rapid searches) without challenging every visitor on the first page of the booking flow.

What our pilot saw

In our pilot of 28 independent UK hotels, no hotel showed our scripted agent a CAPTCHA challenge before prices appeared. Two engines showed a passive reCAPTCHA badge and still passed. We haven’t tested US hotels or payment pages yet, so a challenge may still appear later in the journey, or for other agents. See CAPTCHA badges vs challenges.

Questions to ask your vendors

  • Where in our booking flow do you show challenges, and to whom?
  • Do you allow verified AI agents and signed requests?
  • How many sessions were challenged last month, and how many of those then booked?

The last question is the revealing one: if most challenged sessions never book, the challenge may be costing more than it saves.

What this means for AI recommendations

CAPTCHAs on booking pages don’t only stop agents. Heavy bot protection across a site can also stop the AI crawlers that read your pages, leaving AI to describe you from OTA listings. Check what your protection blocks before assuming it only stops spam.

How to check

Ask an agent to book your hotel on your own site and stop before paying. If it reports a challenge, a “verify you are human” step or a page that won’t load, guests’ agents see the same. Ask your booking engine vendor and web host what bot protection they apply to booking pages. Our free agent check records exactly where the challenge appeared.

Questions

Can AI agents solve CAPTCHAs?

Mainstream agents are designed not to. They stop and hand control back to the user, who often asks the agent to book somewhere else instead.

Why do hotel booking engines use CAPTCHAs?

To stop card testing, rate scraping and fake bookings. The trade-off is that challenges on every search also stop guests' AI agents.

Will Web Bot Auth fix CAPTCHAs for agents?

It helps security tools recognize verified agents. Whether a hotel's site lets them through still depends on how its protection is configured.

Sources

Related