Summary: ◀▼
CAPTCHA protects your account by verifying that ticket submissions come from humans, not bots, reducing spam. It uses bot scores to assess risk and prompts verification only when needed. CAPTCHA is always on for anonymous users submitting tickets and can't be disabled. Issues with CAPTCHA often relate to browser compatibility or ad blockers. Good bots can be whitelisted by contacting support.
A CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a security test used by websites to verify that the user is a human, rather than a malicious automated bot. CAPTCHA helps protect Zendesk ticket submission forms from spam by verifying that anonymous users are human before they can submit a request.
This article explains when CAPTCHA appears, how Cloudflare’s Bot Management determines risk, and answers common questions about errors, bot scores, and supported submission methods.
This article contains the following sections:
About CAPTCHA
Allowing anyone to submit tickets can result in spam appearing in your Zendesk account. To help prevent this, Zendesk requires unregistered users who aren’t signed in to verify they’re human before they can submit a ticket.
Zendesk uses Cloudflare's bot detection and management software to help distinguish humans from bots and other abusive traffic. In most cases, users can simply confirm they’re human without solving a full CAPTCHA challenge. If Zendesk’s risk analysis engine can’t confidently determine whether the requester is human, it presents a CAPTCHA that must be completed before the ticket can be submitted.
Zendesk may prompt a user to complete a CAPTCHA based on signals such as:
- The request has a bot score below the threshold.
- The request doesn't match a verified bot such as a search crawler.
- The request is made on an
/hcpath for any of the following URLs:- Sign in:
https://yoursubdomain.zendesk.com/auth/v2/login/ - Register:
https://yoursubdomain.zendesk.com/auth/v2/login/registration - Ticket requests:
https://yoursubdomain.zendesk.com/hc/en-us/requests/new
- Sign in:
CAPTCHA is turned on by default and can't be turned off. It isn't available with the Web Widget (Classic).
CAPTCHA FAQs
The following sections answer frequently asked questions about CAPTCHA:
Why do I only see a CAPTCHA sometimes?
Cloudflare Bot Management analyzes Zendesk traffic and assigns a score based on how likely each request is to come from a human or a bot. CAPTCHA is triggered when traffic falls within a specific threshold, since CAPTCHA is mainly intended to challenge bot-like activity.
It is extremely rare for legitimate human traffic to be misclassified as bot traffic by Cloudflare.
What is a bot score?
Requesters are prompted to complete a CAPTCHA when their request meets certain criteria, such as falling within a specific bot score range.
A bot score is a value from 1 to 99 that indicates how likely a request is to have come from a bot:
- 1 = very likely automated
- 99 = very likely human
Why am I seeing an error when CAPTCHA is rendered?
Ad blockers can disable CAPTCHA in some browsers, and older browsers may have trouble displaying CAPTCHAs. For more information, see Cloudflare’s troubleshooting topics for Cloudflare bot products.
Why is my automation application or good bot being blocked?
If you are running a good bot and it's still being blocked, contact Zendesk Customer Support.
Is CAPTCHA on for host-mapped accounts?
Cloudflare Bot Management tracks traffic for host-mapped accounts. CAPTCHA is turned on by default when anyone is allowed to submit tickets, and it can't be turned off.