# The cpGuard captcha screen
Source: https://docs.webgee.com/en/security-ssl/cpguard-understanding-the-captcha-verification-screen



You or a visitor see a captcha before reaching your site. Applies to shared and
reseller hosting.

This is **cpGuard**, which protects URLs that attract automated abuse — login
pages, `xmlrpc.php`, admin paths. It is not a sign that your site is compromised.

## Why it appears [#why-it-appears]

cpGuard challenges requests from IP addresses it has no established reputation
for. Passing the captcha establishes that reputation, and the same address is not
challenged again for several days.

Most visitors never see it. It shows up for:

* First-time visitors from an address cpGuard has not seen
* Traffic from VPNs and shared connections, where reputation is mixed
* Anything that looks automated — rapid repeated requests, unusual patterns

## What to do about it [#what-to-do-about-it]

Usually nothing. Pass the captcha and it will not reappear for days.

If it is affecting real customers at scale, open a ticket with your
[support PIN](/en/account-billing/support-pin) and the URLs involved. Protection
is managed centrally, so it is adjusted on our side rather than in your cPanel.

## If the captcha loops [#if-the-captcha-loops]

Passing it repeatedly without ever getting through is a specific, known problem
and it is **not** cpGuard's fault:

A Cloudflare page rule combining **Cache Everything** with **Edge Cache TTL**
strips cookies from the origin response. The cookie recording that you passed the
captcha never reaches your browser, so every request looks like a first visit.

The fix is on the Cloudflare side — see
[the "please wait while your request is being verified" loop](/en/reseller/whmcs-connecting-to-servers-please-wait-while-your-request-is-being-verified),
which documents the same cause.

## If legitimate bots are blocked [#if-legitimate-bots-are-blocked]

Search engine crawlers, uptime monitors and payment webhooks can all be
challenged, and none of them can pass a captcha. If a service that must reach
your site is failing, open a ticket with the source IP addresses so they can be
allowed.

This is worth checking if search traffic drops unexpectedly.

## Related [#related]

* [Unblock an IP address from the firewall](/en/security-ssl/how-do-i-unblock-or-whitelist-an-ip-address-from-the-firewall)
* [Fix the "please wait while your request is being verified" loop](/en/reseller/whmcs-connecting-to-servers-please-wait-while-your-request-is-being-verified)