Does a captcha block AI shopping agents at checkout?
Usually yes. A captcha exists to stop programs, and a shopping agent is a program. The fix is not to remove the captcha but to let agents with a verified signature skip it. Under Rules, a signed agent skips hCaptcha and Cloudflare Turnstile. People still see the captcha.
In our October 2026 check of 66 WooCommerce stores, 19 of the 39 checkouts we could open had a captcha.
A verified signature is a Web Bot Auth signature: the agent's maker signs each request with a key it publishes, and your server checks it. An agent that only says its name in the user-agent can be anyone, so skipping the captcha does not trust that name.
By captcha
| Captcha | What to do |
|---|---|
| hCaptcha | Under Rules, let signed agents skip the captcha |
| Cloudflare Turnstile (Simple Cloudflare Turnstile plugin) | Under Rules, let signed agents skip the captcha |
| Google reCAPTCHA | Set its plugin to skip verified bots, or switch to hCaptcha or Turnstile |
The Agents tab counts how many agents a captcha stopped and what their carts held, so you can see whether it costs you sales before you change anything. The free check shows whether a captcha is on your checkout page.