Skip to content

TRX-002Buy

No CAPTCHA before the payment step

Checks that no CAPTCHA a person has to solve stands on your cart or checkout entry before the payment step.

What we check

We look at the markup and text of your cart and checkout entry pages for CAPTCHA widgets and scripts (reCAPTCHA, hCaptcha, Cloudflare Turnstile, Friendly Captcha, Arkose Labs/FunCaptcha, GeeTest, PerimeterX, DataDome) and challenge wording such as "I'm not a robot" or "press and hold". We tell apart an interactive challenge, an invisible score-based one, and a mere mention such as the footer line "This site is protected by reCAPTCHA".

Why it matters

An AI shopping agent cannot tick "I'm not a robot" or solve a puzzle for the shopper. A CAPTCHA on the cart or checkout entry stops the purchase before payment. Invisible, score-based checks do not stop the flow outright, but they can turn an agent away without explanation.

How we check

We read the cart and checkout pages from the crawl, or request each once, as an anonymous visitor. FAIL when either page has a CAPTCHA container not marked invisible, challenge wording, or a CAPTCHA script without an invisible marker; a bot-management challenge page served in place of your checkout counts too. WARN when only an invisible or score-based CAPTCHA is present (for example reCAPTCHA v3 loaded with render=, or data-size="invisible"). PASS when there is no CAPTCHA, or only a mention. We SKIP when the checkout entry could not be read (refused, blocked without a challenge, behind a consent, age or geo wall, or an error status), because a clean cart says nothing about a checkout we never saw. A 404 on the cart alone does not cause a SKIP.

How to fix it

  1. Remove the interactive CAPTCHA from the cart and checkout entry. If you need a challenge, put it on the final payment submission.
  2. Prefer a risk-based, invisible check (reCAPTCHA v3, Turnstile in managed mode, or your bot-management vendor's scoring mode) over a widget a visitor has to click.
  3. If your bot-management service challenges every anonymous visitor on checkout, add an allow rule for verified agent traffic.
  4. A footer notice that mentions reCAPTCHA is fine.

What good looks like

<!-- checkout entry: a form and no challenge widget -->
<form action="/checkout" method="post">
  <input type="email" name="email" autocomplete="email">
  <input name="address1" autocomplete="address-line1">
  <input name="postcode" autocomplete="postal-code">
  <button type="submit">Continue to payment</button>
</form>
<footer>This site is protected by reCAPTCHA and the Google
Privacy Policy and Terms of Service apply.</footer>

Sources