Notifications
Clear all
Topic starter
19/08/2026 3:29 pm
TL;DR: SiteGround’s SGCaptcha returns HTTP 202 with a JavaScript proof-of-work challenge that can make tools like Nuclei and WPScan finish cleanly with zero findings, according to Sprocket Security. The issue is not blocking access, but suppressing scanner visibility and distorting what security teams think they have validated.
NHIMG editorial — based on content published by Sprocket Security: SiteGround SGCaptcha and the scanner blind spot it creates
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What breaks when proof-of-work CAPTCHA controls sit in front of security scanners?
A: Scanners may treat challenge responses as normal success conditions and stop probing before they reach the protected surface.
Q: Why do challenge-based bot controls create visibility risk for identity and access testing?
A: They can hide whether login pages, delegated access paths, and other identity-linked endpoints were actually reached.
Q: How do security teams know whether a CAPTCHA or challenge system is working as intended?
A: Look for evidence that challenge state is being issued, solved, and cleared consistently across different clients, source IPs, and sessions.
Practitioner guidance
- Validate scanner behaviour against challenge flows Test your external scanners, authenticated checks, and synthetic monitoring against 202 challenge responses, JavaScript redirects, and cookie-based unlock states, not just against successful page loads.
- Separate reachability from assurance Require a second verification path for endpoints protected by anti-bot controls so that a clean scan report does not get treated as proof of exposure assessment.
- Instrument challenge-state observability Log when clients receive challenge pages, what cookie or session state is issued, and whether the same source IP is repeatedly flagged across sites or environments.
What's in the full article
Sprocket Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The full request and response sequence for SGCaptcha challenge handling, including the 202 flow, redirect path, and cookie issuance.
- The browser-side proof-of-work mechanics that determine how the challenge is solved and why scanners miss it.
- The mitmproxy-based workflow used to intercept, solve, and replay requests without modifying scanner logic directly.
- The observed behaviour across repeated requests and shared-hosting reputation states, which matters for engagement planning.
👉 Read Sprocket Security's analysis of SiteGround SGCaptcha and scanner blind spots →
PoW CAPTCHA challenges and what they mean for scanner visibility?
Explore further
19/08/2026 4:12 pm
Scanner blindness is now an assurance problem, not just an automation problem. When a defensive control returns a valid-looking response that prevents scanners from understanding what happened, security teams can overestimate coverage and understate exposure. For IAM and NHI programmes, that matters because login flows, service endpoints, and delegated access paths often depend on automated validation to confirm control effectiveness. The practical conclusion is that observability must be treated as part of the control plane, not an afterthought.
A question worth separating out:
Q: Who is accountable when an anti-bot control hides exposure from testing and monitoring?
A: Accountability should sit with the teams that own both the application control and the assurance process, because a blocking mechanism that reduces abuse can still damage visibility if it is not testable. Identity, application, and security operations teams should define who validates challenge outcomes, who reviews false-negative scans, and who signs off on any monitoring exemption.
👉 Read our full editorial: PoW CAPTCHA challenges are blinding security scanners on WordPress sites
