How to Fix reCAPTCHA v3 Low Scores (0.1–0.3) in CloakBrowser: Complete Guide

Avoid CDP-based waits like page.wait_for_timeout(), spend at least 15 seconds on the page before triggering the challenge, and use Playwright with a fixed fingerprint seed to achieve scores around 0.9.

CloakBrowser is an open-source automation framework designed to mask Chromium-based browser signals, yet users often encounter reCAPTCHA v3 low scores ranging from 0.1 to 0.3 despite the stealth measures. This occurs because reCAPTCHA v3 analyzes subtle behavioral cues and Chrome DevTools Protocol (CDP) traffic patterns that standard automation commands inadvertently expose. Understanding how CloakBrowser's mitigation strategies interact with Google's detection algorithms is essential for achieving human-like scores of ~0.9.

Why CloakBrowser Triggers reCAPTCHA v3 Low Scores

While CloakBrowser hides most Chromium automation signatures, reCAPTCHA v3 specifically targets behavioral anomalies and protocol leaks that bypass standard fingerprint randomization.

CDP Traffic from Explicit Wait Commands

The most common cause of low scores is CDP traffic generated by page.wait_for_timeout() and similar explicit Playwright or Puppeteer commands. Each call produces a detectable CDP message that reCAPTCHA JavaScript can observe, flagging the session as automated bot traffic. According to the source documentation in README.md L93-L104, you must avoid wait_for_timeout entirely and substitute native sleep functions to eliminate the CDP round-trip.

Insufficient Page Dwell Time

reCAPTCHA expects human visitors to remain on a page for a meaningful duration before interacting with challenges. Fast page loads of 5 seconds or less trigger low scores because the timing appears mechanical rather than organic. The README recommends spending 15+ seconds on the page before invoking grecaptcha.execute() L117-L119.

Excessive evaluate() Calls Before Challenges

Every invocation of page.evaluate() injects a CDP command and may reveal the presence of a script-injection layer. Minimizing these calls prior to the reCAPTCHA challenge reduces detectable automation artifacts, as noted in the README's mitigation tips L124-L126.

Backend Protocol Differences: Puppeteer vs Playwright

Puppeteer generates more CDP traffic than Playwright, providing reCAPTCHA with additional data points to detect automation. CloakBrowser defaults to Playwright specifically to reduce this signal leakage. For maximum stealth, use the Patchright backend that strips extra signals, or ensure you are using Playwright rather than Puppeteer L115-L117.

Missing Human-Like Input Events

reCAPTCHA analyzes mouse movement trajectories, scroll physics, and typing cadence. Absent or "instant" input events signal automation. CloakBrowser's human module.inject realistic mouse-move steps, typing delays, and scroll physics through predefined configurations. The default preset applies these automatically, while the careful preset slows interactions further for higher scrutiny environments cloakbrowser/human/config.py#L4-L73.

IP Reputation and Fingerprint Consistency

Even perfect browser fingerprints fail when paired with datacenter IP addresses known to cloud providers. Additionally, randomizing fingerprints across sessions makes the browser appear as a new device each visit, which raises suspicion when accessing the same account repeatedly. Fix a seed parameter to maintain consistent device identity across visits L118-L120.

Step-by-Step Fix for High reCAPTCHA v3 Scores

Implement the following workflow to resolve reCAPTCHA v3 low scores consistently.

1. Configure Launch Parameters

Use Playwright (or Patchright) with a fixed seed and appropriate human configuration:

from cloakbrowser import launch, resolve_config

# Fix fingerprint consistency across sessions

browser = launch(
    headless=True,
    seed=42,  # Stable device identity

    human_config=resolve_config(preset="default")  # Or "careful" for extra slowness

)
page = browser.new_page()

2. Implement Native Delays Instead of CDP Waits

Replace page.wait_for_timeout() with native sleep functions to avoid CDP traffic:

Python:

import time

page.goto("https://recaptcha-demo.appspot.com/recaptcha-v3-request-scores.php")
page.wait_for_load_state("networkidle")

# Native sleep - no CDP round-trip

time.sleep(15)

JavaScript/TypeScript:

await page.goto(
  "https://recaptcha-demo.appspot.com/recaptcha-v3-request-scores.php",
  { waitUntil: "networkidle" }
);

// Native sleep without CDP traffic
await new Promise(r => setTimeout(r, 15000));

3. Minimize evaluate() and Use Type Actions

Avoid page.evaluate() before the challenge triggers. When entering data, prefer page.type() over page.fill() to emit realistic typing events with human-like delays:

# Prefer this:

page.type("#email", "user@example.com")

# Instead of:

page.fill("#email", "user@example.com")  # Instant, no intermediate events

4. Complete Working Example

The repository includes a reference implementation in examples/recaptcha_score.py that demonstrates the full pattern:

# examples/recaptcha_score.py

import time
from cloakbrowser import launch

browser = launch(headless=True, seed=42)
page = browser.new_page()

page.goto("https://recaptcha-demo.appspot.com/recaptcha-v3-request-scores.php")
page.wait_for_load_state("networkidle")

# Critical: 15+ second dwell time without CDP waits

time.sleep(15)

# Read results after challenge completes

score_text = page.content()
print(score_text)  # Contains "score": 0.9 when configured correctly

browser.close()

Using the Careful Preset for Maximum Stealth

When operating in high-security environments, switch to the careful preset defined in cloakbrowser/human/config.py to introduce additional delays between actions:

from cloakbrowser import launch, resolve_config

human_cfg = resolve_config(preset="careful")
browser = launch(
    headless=True,
    human_config=human_cfg,
    seed=123
)

The careful preset extends mouse movement duration and increases typing delays beyond the baseline default configuration, further reducing reCAPTCHA v3 low scores.

Summary

reCAPTCHA v3 low scores in CloakBrowser stem primarily from detectable CDP traffic and insufficient human-like timing:

• Never use page.wait_for_timeout(); substitute time.sleep() (Python) or new Promise(r => setTimeout(r, ms)) (JavaScript)
• Maintain 15+ seconds of page dwell time before triggering challenges
• Choose Playwright over Puppeteer to minimize protocol chatter
• Set a fixed seed parameter to maintain consistent fingerprints across sessions
• Leverage human presets (default or careful) to generate realistic input events
• Use residential proxies to avoid IP-based reputation penalties

Following these configurations consistently yields reCAPTCHA v3 scores of approximately 0.9, matching genuine user behavior profiles.

Frequently Asked Questions

Why does page.wait_for_timeout() cause reCAPTCHA v3 low scores specifically?

page.wait_for_timeout() generates explicit CDP (Chrome DevTools Protocol) traffic that reCAPTCHA JavaScript can observe in the browser context. Unlike native sleep functions that pause execution locally, CDP-based waits broadcast automation signals across the protocol layer, allowing detection algorithms to flag the session as bot-controlled.

How does the careful preset differ from the default human configuration?

The careful preset, defined in cloakbrowser/human/config.py, extends the duration of mouse movements and increases delay variance between keystrokes compared to the default preset. This creates more conservative timing patterns that better mimic hesitant human behavior under scrutiny, reducing the probability of triggering reCAPTCHA v3 low scores in sensitive environments.

Should I use a fixed seed for every reCAPTCHA challenge or rotate fingerprints?

Use a fixed seed when accessing the same account or service repeatedly. Consistent fingerprints prevent reCAPTCHA from flagging your traffic as multiple new devices accessing one account, which appears suspicious. Only rotate fingerprints when you need distinct identities for different accounts or sessions.

Can I achieve high scores with Puppeteer instead of Playwright?

While possible, Puppeteer generates significantly more CDP traffic than Playwright, providing reCAPTCHA with additional detection vectors. The CloakBrowser source specifically recommends Playwright or the Patchright backend to strip these extra signals. If you must use Puppeteer, implement strict CDP traffic minimization and extended dwell times to compensate for the protocol verbosity.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}