Why am I being asked to solve a captcha during signup?

The captcha you see on the Valid Email Checker signup form is Cloudflare Turnstile. It is the modern replacement for the old reCAPTCHA "click every traffic light" puzzles, and it sits on the signup page to keep automated bots from creating thousands of throwaway accounts to abuse the free 200-credit grant.

Why we need a captcha at all

Every legitimate signup gives the new user 200 free credits, which represents a real cost on our side (we still pay our verification providers regardless of whether the user paid us). Without bot protection, scripts can register hundreds of accounts a minute, burn through the welcome credits on automated bulk jobs, and walk away. Turnstile is the cheapest way to make that economically uninteresting.

Why you usually do not see a real challenge

Turnstile runs invisibly in the background most of the time. It analyzes your browser and connection (cookies, prior history with Cloudflare-protected sites, request patterns) and decides on its own whether you look human. If you do, the widget passes silently and you do not see anything beyond a small spinner that flashes for half a second.

A visible challenge only appears when something about your traffic looks unusual to Cloudflare. Common triggers:

• You are signing up from a VPN, Tor, or a known datacenter IP range.
• Your browser sends no cookies and has no prior reputation (a fresh incognito session on a clean device).
• You signed up recently from the same IP for a different service Cloudflare protects, and the reputation score on that IP shifted.
• Aggressive ad-blockers or privacy extensions are stripping signals Turnstile uses.

When the captcha is required vs. optional

On Valid Email Checker, Turnstile is required to submit the signup form. The submit button stays disabled until the widget reports success to the page. If the widget never completes, signup is blocked entirely. We verify the token server-side before creating the account, so a bot cannot forge a pass result.

The same protection runs on the login form, for the same reasons. Repeated login attempts on the same email get flagged faster than first-time signups.