You expect the captcha to be pointless friction

The picture people have

On the ordinary web a captcha usually guards a form against spam, and a site that throws one at every visitor feels badly built. The comparison is unfair here because the threat is different. What arrives at this door is not a spammer with a script. It is sustained flooding aimed at making the service unusable, sometimes for competitive reasons, sometimes for reasons nobody outside will ever know.

What the gate is actually doing

Three jobs, all of them boring.

Making requests cost something

A flood works because each request is free to send. A puzzle at the front makes automated arrival expensive enough that volume stops being trivial.

Keeping the expensive parts cold

Anything past the gate involves databases and session state. The gate is a cheap wall standing in front of costly machinery.

Shaping the crowd

When more people arrive than can be served, someone has to wait. Waiting at the door is better than a half loaded page that fails after you log in.

Why it keeps changing

The gate mutates because the pressure against it mutates. A puzzle that worked last month gets solved automatically, so the shape changes. That is why people find a different style of challenge on different visits and read the change as a sign something is wrong. The relationship runs the other way. A gate that never changed would mean nobody was bothering to attack it.

The part that matters for you

A gate is also the easiest thing in the world to imitate. A fake front page can present a challenge, accept whatever you type, and then show you a login form. The challenge costs the attacker nothing and buys enormous credibility, because people treat it as a checkpoint rather than as decoration.

• Solving a captcha proves nothing about where you are. It only proves you were willing.
• Never enter credentials because the gate felt convincing. Check the address you arrived on, not the ritual it showed you.
• A gate that fails repeatedly is usually load. Change circuit, try another address from your set, wait.
• A gate that asks for anything other than a puzzle answer is not a gate. Nothing at the door needs an email, a phone number or a recovery phrase.

The right attitude is to treat the gate as weather. It is not a service, it is not an insult, and it is not evidence. It is the price of a door that stays open under pressure, and the reason a busy address is often the slow one.

Related: a slow page means a fake and the login screen looks the same.