1. I&#x27;ve tried JS on and off, in Tor Browser, and in a proxied stock firefox.<p>2. No. It&#x27;s a crapshoot. Sometimes it does, but about &gt;75% of the time, it goes into CAPTCHA loops.<p>3. There&#x27;s plenty of things that could be done to alleviate this issue :<p>One, they could set up their own .onion service, and redirect TOR users to it. And that would rate-limit any potential TOR-user based damage.<p>Two, since sessions are per TCP, just slow the TCP down accordingly. That&#x27;s standard practice for things like tarpits and the like.<p>Three, there&#x27;s no need for CAPTCHAs on a HTTP GET, if not done in a harassing manner. But this basis is on being in a &quot;Bad IP list&quot;. POSTs are a whole different story.