My experience was with using Tor Browser to access websites using cloudflare. I'd expect it to be based on the Accept request header (and possibly the Content-

My experience was with using Tor Browser to access websites using cloudflare. I'd expect it to be based on the Accept request header (and possibly the Content-Type response header to prevent bypassing it). Or perhaps even the Content-Type of past requests to that url. But I don't really understand what the purpose of these captcha checks is in the first place. Handling a captcha challenge is more expensive for the server than most GET requests. Perhaps it's done in anticipation of later POST requests (which can't be blocked transparently without breaking the functionality of the website).