CAPTCHA badges vs CAPTCHA challenges: what stops AI agents
Updated By Akkrev
A reCAPTCHA badge in the corner is not the same as a puzzle. In our pilot, no hotel showed our agent a CAPTCHA challenge. Two showed a passive badge.
When people talk about AI agents and hotel websites, CAPTCHAs come up first. The worry is that a puzzle will stop the agent cold. Our pilot suggests the picture is more nuanced, at least up to the point where prices appear.
What the pilot showed
We tested 28 independent UK hotels on 20 October 2026, stopping at the room list with prices. In that sample:
- No hotel showed a CAPTCHA challenge to our scripted agent.
- Two showed a passive reCAPTCHA badge. Both passed. We scored them slightly lower on friction because the check was present, not because it stopped anything.
- One homepage loaded slowly after a bot check, but it did load.
Other things caused far more trouble: missing booking engines, date pickers and hidden booking links. See what we learned testing 28 UK hotel booking engines.
Badges and challenges are different things
A passive check runs in the background. Google’s reCAPTCHA v3, for example, returns a score for each request without interrupting the user, and shows a small badge. The site decides what to do with low scores.
A challenge interrupts: pick the traffic lights, tick a box, wait on a “checking your browser” page. This is what stops agents, and it usually appears only when a passive check or firewall rule decides a visitor looks risky.
A hard block refuses the request outright, often with an “access denied” page.
A badge on your booking page doesn’t mean agents are blocked. It means a check is running, and its settings decide what happens next.
Where it may still bite
Our test stopped before guest details and payment. Payment pages often have stricter fraud checks, and card providers may add their own. An agent might reach prices and still struggle at checkout. We haven’t measured that yet, and we don’t want to claim more than we tested.
Results also depend on the agent. A consumer agent running in a cloud data centre may be scored differently from a person at home, or from our test browser. Newer standards such as Web Bot Auth aim to let well-behaved agents identify themselves so sites can treat them differently from scrapers.
Why this matters for your priorities
If you’re a hotelier worried about agents, CAPTCHAs may not be the first thing to look at. In our sample, the bigger risks were simpler: can an agent find your booking link, set dates and read prices? Fix your understanding of those first.
What this means for AI recommendations
Some bot protection blocks AI crawlers as well as agents. If AI can’t read your site, it relies on other sources to describe you. Check what your protection lets through.
How to check
Visit your booking page and look for a small badge in the corner, often bottom right. Ask your booking engine provider what bot protection runs on the booking and payment pages, and what happens to low-scoring visitors. Then ask an agent to reach your prices and see whether it meets a challenge. Our free agent check records any friction it hits.
Questions
What is a passive CAPTCHA?
A check that runs in the background, scoring whether a visitor looks automated, often shown only as a small badge. Most visitors never see a puzzle. If the score looks risky, the site may show a challenge or block the action.
Did CAPTCHAs stop agents in the pilot?
No. In our pilot of 28 UK hotels, no CAPTCHA challenge appeared before prices. Two engines showed a reCAPTCHA badge and still passed. We stopped before payment, where checks may be stricter.
Could that change?
Yes. Sites can tighten bot rules at any time, and results can differ by agent, location and time of day. That's why we plan to repeat the test.