Bot mitigation in China is an end-to-end availability problem#
A bot-control service protects an action only when the whole verification path is reachable. That path includes the client script, challenge or passive evaluation, token delivery, the application’s server-side verification call, and the response shown to the user. A successful test from an office outside China does not establish that a login, checkout, signup, or recovery flow will work for users inside the networks that matter to the business.
Treat China and every restricted network as a deployment requirement. Name the journeys, regions, browsers, devices, network providers, and failure conditions to test. Then test a real action through the production-like path. A widget that loads on a test page does not prove that the application can receive and verify a token during a sensitive request.
Why reCAPTCHA can fail in China#
reCAPTCHA depends on Google-hosted services. When a client network cannot reach the required Google domains, the script, widget, or challenge frame can fail to load. The user sees a stalled form or cannot continue. If a server cannot reach the verification service, the application cannot validate the returned token and must reject or hold the action.
hCaptcha’s published comparison guide describes reCAPTCHA as limited or unavailable in markets such as China. It also notes that recaptcha.net can replace a Google domain in some integrations, but availability can remain limited. That leaves a production team with a reachability risk even when an alternate URL appears to work in an isolated test.
The operational consequence is simple: a CAPTCHA dependency can become a sign-in, payment, registration, or support outage for part of the customer base. Security teams need bot protection that can be delivered and verified in the target network, with a defined response if a dependency fails.
Teams replacing reCAPTCHA can use the companion migration guide for the client, server, score, and rollout changes, then apply the regional test plan in this article.
hCaptcha options for China and restricted networks#
hCaptcha works without Google domains. Its documentation states that Enterprise customers can use regional endpoints and First-Party Hosting to support low-latency access across China and the rest of the world. The right design depends on application delivery, data controls, and the journeys being protected.
| hCaptcha option | What it supports | Questions for the deployment review |
|---|---|---|
| Regional endpoints | A regional delivery design for China and worldwide traffic | Which client and backend paths use the endpoint? What latency, retry, and failure behavior does the application show from each target network? |
| First-Party Hosting | Delivery under the organization’s own domain for an Enterprise deployment | Which domain, DNS, certificate, CDN, cache, and release controls own the path? How will changes be monitored? |
| First-Party Proxy | Requests and assets through a domain such as hcaptcha.your.com; it can also pre-blind data before it reaches hCaptcha |
Which request metadata should remain under the organization’s control? What routing and incident owners are required? |
| Enterprise risk and policy controls | Risk scoring, adaptive verification, and rules for high-value actions | Which actions should allow, verify, limit, or block activity when risk changes? Who approves and tests those rules? |
The hCaptcha Enterprise overview describes First-Party Proxy and the data controls that can accompany it. It also describes decisioning and adaptive verification. These options bring availability, privacy, and fraud-response choices into the same architecture.
Build the hCaptcha path for the networks you serve#
Start with a normal hCaptcha integration, then add the regional or first-party configuration needed for the deployment. The Developer Guide explains the client script, form token, and siteverify flow. Its Content Security Policy guidance allows https://hcaptcha.com and https://*.hcaptcha.com for relevant directives. Do not hard-code an individual asset subdomain: hCaptcha documents that subdomains can vary by region.
Use a separate sitekey for each meaningful journey or environment when that improves reporting and policy control. A team might isolate login, signup, payment, and account recovery so it can measure errors and abuse without mixing their outcomes. Confirm hostname controls, secret handling, token verification, error handling, and support escalation before traffic moves to the new path.
Localization should be part of the test plan. hCaptcha can detect a visitor’s locale automatically, and its language codes include Chinese, Simplified Chinese (zh-CN), and Traditional Chinese (zh-TW). Test the language that appears in the real browser and the assistance path for anyone who cannot complete a visible challenge.
Test the full customer journey from China#
Run tests from representative China networks and any other restricted networks in scope. Include production-like DNS, TLS, Content Security Policy, caching, client delivery, iframe or challenge display, form submission, server-side siteverify, and the application response. Record timing and error details at each point.
| Test case | What it proves |
|---|---|
| Normal user completes login, signup, checkout, or recovery | The entire verification path is available and the application accepts a valid token |
| A visible challenge is required | The challenge can display, complete, and return a token in the target network |
| Token is missing, invalid, or expired | The server protects the action and gives the user a useful retry or support path |
| Client, DNS, or verification service is unavailable | The fallback protects the action without silently accepting an unverified request |
| High-risk automation reaches the action | The policy can add verification, limit the request, or block it without harming normal traffic |
Repeat the checks after CDN, DNS, application, or policy changes. Network availability is a property of the deployed system, not a one-time vendor test.
Use availability without losing bot protection#
Regional reachability must still lead to a useful security decision. hCaptcha Bot Detection evaluates behavioral, device, network, and intent signals in real time. hCaptcha Enterprise adds risk data, rules, account and transaction protection, and adaptive verification for high-value actions.
Set the response by journey. A public comment form may receive a challenge or a rate limit. Login and recovery may need a stronger verification step. A payment change or payout request may need a hold and an investigation signal. Test those policies against ordinary traffic and known abuse cases before asking a regional deployment to carry production risk.
Frequently asked questions#
Does hCaptcha work in China?
Yes. hCaptcha documents regional endpoints and First-Party Hosting for Enterprise customers who need low-latency access across China and the rest of the world. The required architecture should be confirmed and tested with hCaptcha for the organization’s target networks and user journeys.
Why can reCAPTCHA fail in China?
reCAPTCHA relies on Google-hosted services. If a target network cannot reach its client or verification dependencies, the widget may not load or the application may be unable to validate a token. hCaptcha’s comparison guide says availability can remain limited in markets such as China even when an alternate domain is used.
What should a China bot-mitigation test include?
Test client delivery, DNS, TLS, Content Security Policy, challenge display, token return, server-side verification, error handling, and the final application decision from representative networks. Run both normal and high-risk paths for every protected journey.
What is First-Party Proxy?
hCaptcha Enterprise’s First-Party Proxy lets users connect through a domain such as hcaptcha.your.com, keeping requests and assets under the organization’s domain. It can also pre-blind data before it reaches hCaptcha.
Can hCaptcha protect more than a registration form in China?
Yes. An Enterprise deployment can apply bot detection, risk scoring, rules, and adaptive verification across login, account recovery, checkout, APIs, and other high-value actions. Start with the routes that have the greatest availability and abuse risk, then expand based on measured results.
Sources and references
- Frequently Asked Questions hCaptcha Docs
- Enterprise Overview hCaptcha Docs
- Developer Guide hCaptcha Docs
- Language Codes hCaptcha Docs
- hCaptcha vs. reCAPTCHA: A Side-by-Side Comparison for 2026 hCaptcha
- Enterprise hCaptcha
- Bot Detection hCaptcha
- How to Migrate from reCAPTCHA: Rollout, Testing, Fallbacks, and Monitoring hCaptcha