The cpGuard captcha screen

Why visitors sometimes see a captcha before reaching your site, how long it lasts, and what to do if it loops.

You or a visitor see a captcha before reaching your site. Applies to shared and reseller hosting.

This is cpGuard, which protects URLs that attract automated abuse — login pages, xmlrpc.php, admin paths. It is not a sign that your site is compromised.

Why it appears

cpGuard challenges requests from IP addresses it has no established reputation for. Passing the captcha establishes that reputation, and the same address is not challenged again for several days.

Most visitors never see it. It shows up for:

First-time visitors from an address cpGuard has not seen
Traffic from VPNs and shared connections, where reputation is mixed
Anything that looks automated — rapid repeated requests, unusual patterns

What to do about it

Usually nothing. Pass the captcha and it will not reappear for days.

If it is affecting real customers at scale, open a ticket with your support PIN and the URLs involved. Protection is managed centrally, so it is adjusted on our side rather than in your cPanel.

If the captcha loops

Passing it repeatedly without ever getting through is a specific, known problem and it is not cpGuard's fault:

A Cloudflare page rule combining Cache Everything with Edge Cache TTL strips cookies from the origin response. The cookie recording that you passed the captcha never reaches your browser, so every request looks like a first visit.

The fix is on the Cloudflare side — see the "please wait while your request is being verified" loop, which documents the same cause.

If legitimate bots are blocked

Search engine crawlers, uptime monitors and payment webhooks can all be challenged, and none of them can pass a captcha. If a service that must reach your site is failing, open a ticket with the source IP addresses so they can be allowed.

This is worth checking if search traffic drops unexpectedly.