# Grok Bot blocked by a site or CAPTCHA? What works

Sites block Grok Bot because its computer sits in a US data center. Sign in yourself with Take over, route traffic through your own computer, or use a plugin.

*From Learn Grok Bot, an independent guide (not affiliated with SpaceXAI or Cursor). Web version: https://learngrokbot.com/logins-and-captchas Last verified: 2026-10-07.*

A site that blocks your Bot or keeps showing it a CAPTCHA is reacting to where the Bot's computer is: a data center in the United States. Do the human step yourself on the Bot's computer. If the site still refuses, send the Bot's browsing through your own connection.

**In short**

- Your Bots browse from a cloud computer in the United States, on an address shared with other Grok Bot customers. Some sites distrust that on sight.
- A password, a code or a CAPTCHA is yours to do. Click **Take over**, finish that step in the Bot's browser, and hand back.
- For a password that matters, skip the Secure Form: take over and type it on the site's own page.
- **Route traffic through this computer** makes sites see your own connection. A plugin skips the site's sign-in page altogether.
- Keep a Bot off any site whose terms forbid automated access. The account that gets locked is yours.

## Why a site turns a Bot away

A site judges a visit by where it comes from and how it behaves. The drawing shows the same site meeting you and meeting your Bot.

Diagram: You and your Bot's computer both visit the same website. You arrive on your own connection and are let straight in. The Bot's computer arrives from a data center in the United States and gets a CAPTCHA, or is blocked.
- You → The website: let straight in
- Your Bot's computer → The website: CAPTCHA, or blocked
- Note on You: your own connection
- Note on Your Bot's computer: a US data center

- **Where the visit comes from.** The computer runs in the United States, and there's no setting for another region. A site with strict rules about addresses can block the visit before the sign-in page loads.
- **Who else comes from there.** The address is shared across Grok Bot customers, so a site sees many accounts arriving from one place.
- **How the visit behaves.** Sites check for automated browsers, and a browser in the cloud can set those checks off.

Nothing in your setup is wrong, and a Bot doesn't try to get past a check. It stops and hands the step to you.

## Work through the fixes in order

There are four fixes. Take them in order, with one exception: if a CAPTCHA returns every time you solve it, the site distrusts the connection itself, so go straight to the third.

**Walkthrough: Get a Bot into a site**

### Step 1: Do the human step yourself with Take over

When a Bot meets a sign-in page, a code or a CAPTCHA, it stops and posts a **Computer** card that says what it needs. Click **Take over**, do that one step in the Bot's browser, then click **I'm done, continue**. [The shared computer](https://learngrokbot.com/shared-computer#take-over) shows each screen.

![A web page inside the tile that shows a Bot's screen. The page asks Are you a person or a robot? under a drawing of four people, with a press and hold button below. An Open button sits over the middle of the tile](https://learngrokbot.com/assets/shots/logins-and-captchas-captcha.jpg)

*No card? Open the computer yourself: click the Bot's name, then the **Computer** tab, then **Open** on the tile. Your mouse and keyboard work in the Bot's browser.*

Image: AI Master on YouTube (https://www.youtube.com/watch?v=j0Pqe8c07vY)

- Wait for the signed-in page to load before you hand back.
- The login now sits on the computer, so every Bot on your account can use it until it expires.
- Fingerprint, Face ID and passkeys saved on your own devices don't work there. Use a password with a code, or an approval on your phone.

> **You should see**
>
> The card changes to **Done**, and the Bot carries on from the signed-in page.

### Step 2: Treat a Secure Form with care

A Bot can also ask with a smaller card: **Sign in to** and the site's name, with **Secure Form** under it. **Open** shows the site's fields inside the app, and the form types what you enter into the site's page.

![A card in a Bot's chat with the GitHub mark. It reads Sign in to GitHub, with Secure Form under it and an Open button at the right](https://learngrokbot.com/assets/shots/logins-and-captchas-secure-form-card.png)

*The card a Bot posts when it wants you to sign in through a form.*

The form carries the line "Never shown to your Bot". Don't rely on that line for a password that matters.

The form puts your password into the page and leaves the Bot to press the site's sign-in button. Until the page moves on, the password is sitting in the page the Bot reads, and from there it can end up in the Bot's record of the task.

- **For an account that matters:** tell the Bot to skip the sign-in and leave the page open. Then open the Bot's screen, type the password on the site's own page and press the site's sign-in button yourself. Once the page has moved past the sign-in form, the password is no longer on it.
- **If you've already used the form for one:** change that password.

### Step 3: Route the Bot's browsing through your own computer

A site that keeps blocking or re-checking the Bot after you've done the human step distrusts the data-center connection. One setting sends the Bot's web traffic out through the desktop you're using, so sites see your own connection.

In the desktop app, open **Settings** > **Computer**. Under **Network**, turn on **Route traffic through this computer**.

![The Network block of the Computer page in Settings. One row, Route traffic through this computer, with the text Route network traffic from Grok Bot's computer through your local desktop computer instead of the cloud. 167 routed this session. Its switch is on](https://learngrokbot.com/assets/shots/logins-and-captchas-route-traffic.png)

*The line under the name ends with a count of what has been routed this session.*

- The route covers the Bot's browser and nothing else on its computer.
- It applies to new connections, so ask the Bot to open the site in a new tab.
- The setting belongs to this one desktop. The Bot's browser reaches what this desktop can reach, and nothing this desktop can't. If every page on the Bot's computer starts timing out, check your own connection and any VPN, or turn the switch off.
- On an Enterprise team an admin can lock the switch. It then reads "Disabled by your admin. You can't turn this on."

A site can still show a CAPTCHA. Do it yourself, as in the first step.

> **You should see**
>
> The Bot loads the site in a new tab.

### Step 4: Use a plugin where the app has one

A plugin connects a Bot to a service without the service's website. You approve it once in your own browser, and the Bot never loads the sign-in page from the data center. Where a plugin exists, it's often the more reliable route.

To check, click **Connect apps** at the bottom of the sidebar and type the app's name in **Search across apps and skills**.

![The search box of the Connect Apps window with GitHub typed in. A list under it, headed Plugins, shows GitHub, CodeRabbit and Adobe Developer App Builder](https://learngrokbot.com/assets/shots/logins-and-captchas-plugin-search.png)

*A match shows under **Plugins**. Click it to open the plugin's page.*

- Gmail, Google Calendar, Outlook, Slack, Notion and GitHub each have a plugin. [Plugins](https://learngrokbot.com/plugins) covers adding one and signing it in.
- Some services with no plugin issue an access token for automated use. Create one in the service's settings. When the Bot asks for it, enter it in the card with **Save securely**, never in a chat message.

Some sites stay closed to a cloud browser even after all four. For those, change the job.

- Do the gated step yourself. Export the report or download the file, and attach it to the Bot's chat.
- Tell the Bot to stop and report when a site blocks it, so it doesn't spend your usage on retries.
- Don't have a Bot install a VPN on its own computer. A VPN there can knock the computer offline, and then none of your Bots can work. If that has happened, see [Can't reach your computer](https://learngrokbot.com/cant-reach-computer).

## When a site won't stay signed in

A login that keeps ending has three possible causes. The first comes from your Bots sharing one browser. Predict what happens in this case.

**Predict: Your Inbox Bot finishes a job on a site and signs out, to be tidy. An hour later your Research Bot's routine opens the same site. What does it find?**

- The site, still signed in
- The sign-in page
- A CAPTCHA

Answer: The sign-in page

All your Bots share one browser on one computer, so a login belongs to all of them, and so does a sign-out. Signing in with a second account in one Bot's window changes the login for the others too.

Keep one account per site on the computer, and tell your Bots not to sign out.

The other two causes sit with the site.

- **The site ended the session.** Sites expire sessions, and some ask for a fresh check before every sensitive action. You can't switch that off. Take over and sign in again.
- **The site distrusts the connection.** A site can accept a login and flag the session again later. [Route the Bot's browsing](#route) through your own computer.

## Sites to keep a Bot away from

Some sites are better left alone even when a Bot can get in. A Bot signs in as you, so whatever a site decides about the Bot's visits, it decides about your account.

**Three kinds of site, and what to do instead**

| Kind of site | What can happen | Do this instead |
|---|---|---|
| A site whose terms forbid automated access | The site can restrict or close your account. | Read the terms of any social or professional network before a Bot messages, connects or posts from your account. If they forbid it, let the Bot research and draft, and do the part on the site yourself. |
| Your main email account, worked through the browser | A mail provider can flag an account that a cloud browser signs in to. | Connect the Gmail or Outlook plugin, which you approve on the provider's own page. |
| An account you couldn't afford to lose | A block falls on the account itself, and on everything else you use it for. | Where the service allows it, give the Bot an account of its own, with only the access the job needs. |

Under Grok Bot's terms you're responsible for everything a Bot does, whether or not you intended it. [Is Grok Bot safe?](https://learngrokbot.com/safety) covers which accounts to connect first.

Next, connect the apps your Bots use most, so fewer jobs go through a sign-in page at all.

**Next:** [Connect plugins](https://learngrokbot.com/plugins)

Give a Bot a direct line to Gmail, Slack and the other apps it works in, and see what to do when an app has no plugin.

### Can I give a Bot a fixed address, or one in another country?

No. The computer runs in the United States with no choice of region, and its addresses are shared across Grok Bot customers. **Route traffic through this computer** is the setting that lets a Bot browse from an address of your own.

### Do passkeys, single sign-on and security keys work on the Bot's computer?

Single sign-on works: take over and sign in with your company's identity provider. Passkeys, fingerprint and Face ID from your own devices don't. A hardware security key plugged into your Mac or Windows computer works once you turn on **Use hardware security keys** in **Settings** > **General**, under **Security Key**, and Grok Bot asks you to approve each use.

### Can a Bot use my password manager?

On a Mac, it can use 1Password. Search for it in **Connect apps**: the plugin shares one dedicated vault with Grok Bot, so a Bot can sign in to the sites you put there. Some sign-in pages don't accept the autofill. Sign in to those yourself with a takeover.

- 2026-10-07: Checked **Take over** in our own run of the app (version 0.68.1). The **Computer** card carries no **Action needed** tag while it waits.
- 2026-10-06: First published.

## Sources

- [Cursor Help Center: Grok Bot FAQs (Why does a website block my Bot or show a captcha?)](https://cursor.com/help/grok-bot/faqs)
- [SpaceXAI docs: Use the computer and apps (take over, sign in once, connectors)](https://docs.x.ai/grok-bot/computer-and-apps)
- [Cursor Help Center: Grok Bot How Tos (single sign-on, security keys)](https://cursor.com/help/grok-bot/how-to)
- [Cursor docs: Settings (Route traffic through your desktop)](https://cursor.com/docs/grok-bot/settings)
- [Cursor docs: Connect to private networks](https://cursor.com/docs/grok-bot/private-networks)
- [SpaceXAI docs: Grok Bot security (where computers run, shared addresses)](https://docs.x.ai/grok-bot/security)
- [SpaceXAI docs: Grok Bot](https://docs.x.ai/grok-bot/overview)
- [SpaceXAI docs: Troubleshooting (A website keeps asking for login)](https://docs.x.ai/grok-bot/troubleshooting)
- [SpaceXAI docs: Approvals, security, and privacy](https://docs.x.ai/grok-bot/approvals-security-and-privacy)
- [Cursor Help Center: Store secrets securely](https://cursor.com/help/grok-bot/secrets)
- [SpaceXAI: Grok Bot changelog (v0.44.0, v0.50.0, v0.53.0, v0.64.0)](https://x.ai/changelog/bot)
- [SpaceXAI: Grok Bot Terms](https://x.ai/legal/grok-bot-terms)
- [Cursor forum: staff on a password filled by the Secure Form](https://forum.cursor.com/t/grok-bot-browser-snapshot-shows-a-password-filled-by-the-secure-form-requestuserform-in-plain-text/173748)
- [Cursor forum: staff on sites with heavy bot protection](https://forum.cursor.com/t/grok-bot-agent-computer-blocked-by-cloudflare-hcaptcha-on-suno-create-often-silent-fails/168082)
- [Cursor forum: staff on where the computer's traffic comes from](https://forum.cursor.com/t/grok-bot-computer-is-us-aws-only-nz-trade-sites-behind-imperva-hard-block-it/168271)
- [Cursor forum: staff on using a service's own access token](https://forum.cursor.com/t/grok-bot-browser-blocked-from-shopify-login/169222)
- [Cursor forum: staff on pages timing out with routing on](https://forum.cursor.com/t/grok-bot-computer-chrome-err-timed-out-on-every-site-update-says-up-to-date-reset-didnt-help/173750)
- [Cursor forum: staff on VPNs, single sign-on and security keys](https://forum.cursor.com/t/vpn-sso-passkey-and-yubikey-within-grokbot/170148)
- [Cursor forum: staff on the browser session all Bots share](https://forum.cursor.com/t/grok-bot-ship-real-session-fences-bots-are-not-a-security-boundary/168476)
- [AI Master on YouTube (the picture of a Bot's browser stopped at a human check)](https://www.youtube.com/watch?v=j0Pqe8c07vY)