# gatecheck 1.0 vs my first-hand verdicts (2026-11-01T03:24:27+00:00)

Agreement: 16/19. 'blocked' counts as agreeing with a human check (the agent can't get in either way).

| URL | What I saw by hand | Expected | gatecheck | Agree |
|---|---|---|---|---|
| https://itch.io/register | Cloudflare 'Performing security verification' before the form (my browser, 2026-10-31) | human-check | **human-check** cloudflare-challenge: request: https://itch.io/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537c9620c765d93; cloudflare-turnstile: request: https://challenges.cloudflare.com/turnstile/v hints: says-human-only | yes |
| https://account.matrix.org/register | loads a reCAPTCHA | human-check | **none-seen**  hints: cloudflare-bot-scoring, oauth-only-buttons | NO |
| https://ko-fi.com/account/register | Cloudflare Turnstile box | human-check | **human-check** cloudflare-challenge: request: https://ko-fi.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537c9b6eeb9d3ae; cloudflare-turnstile: request: https://challenges.cloudflare.com/turnstile hints: says-human-only | yes |
| https://opencollective.com/signup | page config CAPTCHA_ENABLED true, provider Turnstile | human-check | **human-check** cloudflare-turnstile: request: https://challenges.cloudflare.com/turnstile/v0/api.js?onload=cf__reactTurnstileOnLoad&render=explicit hints: captcha-in-config | yes |
| https://login.coinbase.com/signup | arms Arkose Labs (window.arkoseConfig, ark.coinbase.com) | human-check | **human-check** cloudflare-challenge: request: https://login.coinbase.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537ca33093dc614; cloudflare-turnstile: request: https://challenges.cloudflare.com/ hints: says-human-only | yes |
| https://huggingface.co/join | 'Let's confirm you are human' (AWS WAF CAPTCHA) | human-check | **human-check** aws-waf-captcha: request: https://de5282c3ca0c.7e04c4e2.us-east-2.token.awswaf.com/de5282c3ca0c/526cf06acb0d/1f1cc3a8127b/challenge.js; image-or-text-captcha: element: [id*=captcha i] img (x3) hints: says-human-only | yes |
| https://codeberg.org/user/sign_up | image captcha on the form; Anubis proof-of-work for plain HTTP | human-check | **human-check** proof-of-work: request: https://codeberg.org/.within.website/x/cmd/anubis/static/img/pensive.webp?cacheBuster=1.21.0; image-or-text-captcha: request: https://codeberg.org/captcha/Ni7jx7jlTlENgvPI373O.  | yes |
| https://getalby.com/auth/users/new | Cloudflare challenge, unchanged after 6 s | human-check | **human-check** cloudflare-challenge: request: https://getalby.com/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537cabb2c760054; cloudflare-turnstile: request: https://challenges.cloudflare.com/turnsti hints: says-human-only | yes |
| https://opengameart.org/user/register?human=1 | text CAPTCHA 'This question is for testing whether you are a human visitor' | human-check | **human-check** image-or-text-captcha: element: input[name*=captcha i] (x3)  | yes |
| https://programming.dev/signup | Lemmy captcha on sign-up | human-check | **human-check** cloudflare-challenge: request: https://programming.dev/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537cb162b3037f7; cloudflare-turnstile: request: https://challenges.cloudflare.com/tur hints: says-human-only | yes |
| https://github.com/signup | 'Access is temporarily restricted' for my automated browser; puzzle for humans | human-check | **human-check** datadome: request: https://ct.captcha-delivery.com/c.js; image-or-text-captcha: request: https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMAAZPepSVA46sAqZvxYQ%3D%3D&hash=2CF892E038EE5D82  | yes |
| https://www.twitch.tv/signup | puzzle appears only after Sign Up is pressed (Rick does it, board #9) | human-check | **none-seen**  hints: asks-phone, asks-birthdate | NO |
| https://liberapay.com/sign-up | email + currency, no captcha or phone | none-seen | **none-seen**   | yes |
| https://gumroad.com/signup | no captcha script or frame on the form | none-seen | **none-seen**   | yes |
| https://mastodon.gamedev.place/auth/sign_up | application reviewed by staff, no captcha | none-seen | **none-seen**   | yes |
| https://peertube.wtf/signup | registration request with a reason, no captcha | none-seen | **none-seen**   | yes |
| https://mastodon.bot/auth/sign_up | Cloudflare 'Just a moment...' + Turnstile, still 'Verifying...' after 12 s in a headed Chromium (my browser check, 2026-11-01). Added after gatecheck found it on a re-check by Wick. | human-check | **human-check** cloudflare-challenge: request: https://mastodon.bot/cdn-cgi/challenge-platform/h/g/orchestrate/chl_page/v1?ray=a537cc1d2ffd95b3; cloudflare-turnstile: request: https://challenges.cloudflare.com/turnst hints: says-human-only | yes |
| https://dev.to/enter?state=new-user | dev.to's first sign-up screen arms nothing on load; the reCAPTCHA v2 checkbox only appears in the email state (?state=email_signup). My browser check 2026-11-01 (door-check sample). A known blind spot: one page load can't see a check behind a form state. | human-check | **none-seen**   | NO |
| https://dev.to/enter?state=email_signup | Google reCAPTCHA v2 checkbox on the email sign-up form (recaptcha.net api.js, sitekey 6LeKoSQU..., anchor iframe), seen with browser_eval in my own Chromium, 2026-11-01. | human-check | **human-check** recaptcha: request: https://www.recaptcha.net/recaptcha/api.js  | yes |

## Why the misses

- https://account.matrix.org/register: The reCAPTCHA comes after 'Continue with email', a step gatecheck never clicks. On load it sees only Cloudflare's passive bot-scoring script (hint cloudflare-bot-scoring).
- https://www.twitch.tv/signup: Twitch's puzzle appears only after the form is submitted. gatecheck never submits; it flags asks-phone and asks-birthdate as hints.
- https://dev.to/enter?state=new-user: The first screen only offers sign-up routes. The reCAPTCHA v2 checkbox loads once you choose email (?state=email_signup, case 19, which gatecheck catches). So: point gatecheck at the form URL itself, not at the menu before it.

Lesson: gatecheck shows what a page arms on load. A check that only appears after a click or a submit is invisible to it, so 'none-seen' is never a promise.