# Press and Hold CAPTCHA: Meaning and Fixes > The press and hold CAPTCHA, Press & Hold to confirm you are a human, is the HUMAN (PerimeterX) challenge. Why it appears, what to try, how scripts get the page. [Home](https://quanticdata.io/) / [Web Unlocker](https://quanticdata.io/web-unlocker/) / Press and hold Block pages · PerimeterX (HUMAN) # The press and hold CAPTCHA: "Press & Hold to confirm you are a human" The press and hold CAPTCHA, "Press & Hold to confirm you are a human", is the challenge of HUMAN Security, formerly PerimeterX. A site shows it with status `403` when a session looks automated. A person holds the button until the bar fills. The Web Unlocker does not press it: it asks in a way that is not challenged. [Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=press-and-hold-captcha-start-1) · [The PerimeterX (HUMAN) guide](https://quanticdata.io/web-unlocker/bypass-perimeterx/) - **9 of 9**: calls to PerimeterX-protected pages answered with the real page, canary of 11 November 2026 - **88.9%**: across all 27 protected targets of the same run - **4.1 s**: median response across the run - [What you are looking at](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#seen) - [If you are a visitor](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#visitor) - [If your script gets it](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#script) - [Get the page](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#call) - [Measured](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#measured) - [Limits](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#limits) - [FAQ](https://quanticdata.io/web-unlocker/press-and-hold-captcha/#faq) ## What you are looking at A browser gets a page with one button. Code that calls the site's API gets JSON it did not expect. Both are the same block, and the same company wrote both. | Where to look | What it shows | | --- | --- | | Status code | `403`. An API or XHR call gets `403` with a JSON body instead of a page. | | Text on the page | "Press & Hold to confirm you are a human (and not a bot)." The page title is "Access to this page has been denied". | | Reference | A line that starts with "Reference ID #" and a long identifier, at the bottom of the page. | | Which system | HUMAN Security, the company formerly called PerimeterX. Its documentation calls the button the HUMAN Challenge. | | In the page source | An element with the id `px-captcha`, and a script on a path that contains an app id starting with `PX`. | | JSON body on API calls | Keys named `appId`, `jsClientSrc`, `blockScript`, `vid` and `uuid`. | | Cookies | `_px3`, `_pxvid` and `_pxhd`. `_px3` carries the risk score of the session. | ![How to read the press and hold CAPTCHA: first the words Press and Hold to confirm you are a human with a 403 status, then a block page with three marked zones (status, the button, the px-captcha element), last a card that names the system as HUMAN, formerly PerimeterX, the kind of block as a behaviour challenge, the px-captcha mark, and what to do next: hold once, steadily.](https://quanticdata.io/web-unlocker/press-and-hold-captcha/diagram.webp?v=20261111b1) *What the page shows, which system sent it, and what to do next.* ## If you are a visitor It is a real check and a short one: press the button, keep it down until the bar fills, release. Sites use it in place of picture puzzles. When it answers "Please try again" or keeps coming back, the page could not read the press, or the session still looks automated. - Hold with one steady press, mouse or finger, until the bar completes. Do not click again and again. - Pause ad blockers and privacy extensions on the site and reload: they can block the script that reads the press. - Turn off the VPN or proxy. On a shared address the score stays low, and the button returns after each pass. - Allow cookies for the site. The pass is stored in a cookie, and without it the next page asks again. - Use a normal window of an up-to-date browser rather than an in-app browser. - The challenge works from the keyboard, and a site can switch on an enhanced accessibility mode. If you cannot hold a button, ask the site's support for another way in. ## If your script gets it PerimeterX watches the session, not only one request. A script on every page of the site reports to its servers, and the verdict travels in the `_px3` cookie. - First request: with no cookie yet, the decision rests on the address, the handshake and the headers. A scripted client is flagged here. - On the page: the site's script collects browser and device signals, and how the pointer and the keyboard are used. - On a low score: the answer is the `403` with the button. The hold is a behaviour test. The page records pointer, touch and keyboard events while the button is down, so a scripted click does not pass. - On API calls: the same block is JSON with `appId` and `blockScript`, which breaks code that expected data. The whole picture of the system is in the guide: [Bypass PerimeterX (HUMAN) Press and Hold](https://quanticdata.io/web-unlocker/bypass-perimeterx/). ## Get the page with one call Send the URL to the REST endpoint. With `mode: "auto"`, the default, the first attempt is a browser-grade request from a residential IP, which is what the first decision looks at. A real browser opens the page when the site needs one, and a blocked attempt is retried on a fresh exit. The button is never pressed. cURL: ```bash curl -X POST https://app.quanticdata.io/api/v1/scraper/unlock \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example.com/", "country": "us"}' ``` Python: ```python import requests r = requests.post( "https://app.quanticdata.io/api/v1/scraper/unlock", headers={"Authorization": "Bearer YOUR_API_KEY"}, json={"url": "https://example.com/", "country": "us"}, timeout=130, ) page = r.json()["payload"] print(page["status"], page["blocked"], page["latency_ms"], page["cost"]) print(page["body"][:500]) ``` Node.js: ```javascript const res = await fetch("https://app.quanticdata.io/api/v1/scraper/unlock", { method: "POST", headers: { Authorization: "Bearer YOUR_API_KEY", "Content-Type": "application/json" }, body: JSON.stringify({ url: "https://example.com/", country: "us" }), }); const { payload: page } = await res.json(); console.log(page.status, page.blocked, page.latency_ms, page.cost); console.log(page.body.slice(0, 500)); ``` When you call a site's JSON API, read `blocked` in the answer before you parse the body: a block on an API call is JSON too. ### What the answer tells you | Field | What it says | | --- | --- | | `blocked` | `false` when the real page came back. `true` only when every attempt met the block; the block page is then in `body`. | | `vendor` | The system the engine recognised on a blocked attempt. For this page: `perimeterx`. | | `blockClass` | Usually `captcha` for Press & Hold and `fingerprint` for a flat refusal. | | `tier_served` | `tls` for a browser-grade request, `browser` when a real browser had to open the page. | | `attempts`, `latency_ms` | How many tries the call took and how long it lasted. | | `cost` | The bytes this call moved and what it was charged. | ## Measured, with a date In the canary of 11 November 2026, all 9 calls to PerimeterX-protected pages came back with the real page. Across the whole run, 72 of 81 calls on 27 protected targets did, with a median response of 4.1 s. A call counts only when the answer is 2xx and carries the real page, not a challenge. The list, the method and every run are on the [Web Unlocker status page](https://quanticdata.io/web-unlocker/status/). ## What it is for, and what it does not do - It is for pages anyone can open in a browser without signing in: prices, listings, reviews, search results, public profiles. - Challenges that need no human input are handled by the browser tier. An interactive captcha that asks a person to click, pick images or type is not solved: the answer comes back with `blocked: true` and `blockClass: "captcha"`, so your code can skip the page or try later. - It does not log in for you and it does not create accounts. Pages behind a login stay behind it. - Whether you may collect a page depends on the terms of the site and on the law that covers the data. A protection system does not change that, in either direction. ## Press and hold: questions people ask ### What is the press and hold CAPTCHA? It is the HUMAN Challenge, made by HUMAN Security, the company formerly called PerimeterX. Instead of picking images, you press a button and keep it down until a bar fills. While you hold, the page records how the press is made, which is what tells a person from a script. ### Why is press and hold not working, or saying "Please try again"? Either the page could not read the press or the session still scores as automated. Blockers and privacy extensions stop the script that records the hold, and VPN addresses keep the score low. Pause the extensions, turn the VPN off, reload, and hold once, steadily, until the bar completes. ### Why do I get press and hold on every page? The pass is stored in a cookie and judged together with your address. If the browser refuses the cookie, or the address is shared by many people, the site sees a fresh risky session on each page. Allow cookies for the site and try from your own connection. ### Which sites use the press and hold CAPTCHA? Sites that run HUMAN Security's bot protection, among them large shops, property listings, ticketing and sign-up forms. The button and its wording are HUMAN's, so they look the same everywhere. An element with the id px-captcha in the page source, or cookies whose names start with _px, confirm it. ### Does the Web Unlocker press the Press & Hold button? No. Press & Hold asks for a person and the Web Unlocker does not answer it. It gets the page by making the request in a way that is not challenged in the first place, and it retries from a fresh exit when a call does meet the button. If every attempt meets it, the answer says blocked: true with blockClass captcha. ### Why does my code get JSON with appId and blockScript instead of data? Your call to the site's API was blocked by PerimeterX. On API and XHR requests it answers 403 with a JSON body that names the app id and the block script, where a browser would show the button. Send the same URL through the Web Unlocker and read blocked in the answer before you parse the body. ## Send the URL that shows you this page Create the free account, open Web Unlocker in the dashboard and paste the URL into the test box. The answer shows the status, the tier that served the page, the attempts and the cost of the call. [Start free](https://app.quanticdata.io/register?next=%2Funlock&utm_source=web-unlocker&utm_medium=website&utm_campaign=unlocker-guides&utm_content=press-and-hold-captcha-start-2) · [How the Web Unlocker works](https://quanticdata.io/web-unlocker/) Block pages: - [Block page dictionary](https://quanticdata.io/web-unlocker/block-pages/) - ["Please enable JS and disable any ad blocker"](https://quanticdata.io/web-unlocker/please-enable-js-and-disable-any-ad-blocker/) - ["Access Denied ... on this server"](https://quanticdata.io/web-unlocker/access-denied-on-this-server/) - [Error 1015](https://quanticdata.io/web-unlocker/cloudflare-error-1015/) - [Error 1020](https://quanticdata.io/web-unlocker/cloudflare-error-1020/) - ["Just a moment..."](https://quanticdata.io/web-unlocker/cloudflare-just-a-moment/) - ["Pardon Our Interruption"](https://quanticdata.io/web-unlocker/pardon-our-interruption/) - ["The requested URL was rejected"](https://quanticdata.io/web-unlocker/request-rejected-support-id/) - [Cloudflare Turnstile](https://quanticdata.io/web-unlocker/cloudflare-turnstile/) - [CAPTCHA when scraping](https://quanticdata.io/web-unlocker/captcha-when-scraping/) Guides: - [PerimeterX (HUMAN) guide](https://quanticdata.io/web-unlocker/bypass-perimeterx/) - [Cloudflare](https://quanticdata.io/web-unlocker/bypass-cloudflare/) - [DataDome](https://quanticdata.io/web-unlocker/bypass-datadome/) - [Akamai Bot Manager](https://quanticdata.io/web-unlocker/bypass-akamai/) - [Kasada](https://quanticdata.io/web-unlocker/bypass-kasada/) - [Imperva (Incapsula)](https://quanticdata.io/web-unlocker/bypass-imperva/) - [F5 BIG-IP and Shape](https://quanticdata.io/web-unlocker/bypass-f5/) - [AWS WAF](https://quanticdata.io/web-unlocker/bypass-aws-waf/) Also: - [Web Unlocker](https://quanticdata.io/web-unlocker/) - [Status and canary](https://quanticdata.io/web-unlocker/status/) - [Residential proxies](https://quanticdata.io/residential-proxies/) - [Mobile proxies](https://quanticdata.io/mobile-proxies/) ## References By [Aldo Morese](https://quanticdata.io/about/), founder of QuanticData · Published 11 November 2026 · Updated 11 November 2026 · [Read as Markdown](https://quanticdata.io/web-unlocker/press-and-hold-captcha/index.md) - [HUMAN docs: the HUMAN Challenge (press and hold)](https://docs.humansecurity.com/applications/human-challenge) - [HUMAN docs: Bot Defender overview](https://docs.humansecurity.com/applications/bd-overview) - [HUMAN docs: use of cookies and web storage](https://docs.humansecurity.com/applications/use-of-cookies-web-storage) - [RFC 9110, section 15.5.4: 403 Forbidden](https://www.rfc-editor.org/rfc/rfc9110.html#section-15.5.4) - [Web Unlocker in the QuanticData API docs: request, answer, errors and how to read a block (vendor and blockClass)](https://quanticdata.io/docs/#tag/Web-Unlocker) - [Web Unlocker status: the canary list, the method and every run](https://quanticdata.io/web-unlocker/status/) --- Source: https://quanticdata.io/web-unlocker/press-and-hold-captcha/ · Site index for AI: https://quanticdata.io/llms.txt