Maryland CF Turnstile — the new captcha challenge replacing the old

Maryland’s business registry moved to a new anti-bot system last year, and if you’ve tried to pull records in bulk or run them through an automated workflow, you’ve hit the wall. The shift matters for underwriters because it changes what’s actually feasible to verify at scale.

What changed, and when

Maryland Business Express, the state’s Secretary of State portal for corporate filings and entity lookups, switched from hCaptcha to Cloudflare Turnstile. That sounds like a technical detail. It’s not. For credit shops that pull 10 or 50 entity records a week across multiple states, a captcha swap can break an entire workflow. The old system had a rhythm · the new one is stricter and more opaque about what triggers it.

Turnstile is Cloudflare’s answer to reCAPTCHA. It’s designed to be “harder to solve with bots” (their words), which in practice means it fingerprints your browser, checks your request patterns, and serves challenges that are mathematically harder for automation to parse. Maryland adopted it sometime in the spring of 2024, and reports from underwriters and processors have been consistent: manual lookups still work fine, but scaling them is now slower.

Why this matters for your workflow

If your credit team does 5 entity checks per month, you won’t notice. If you do 50 per week or run them through an integration, the captcha is now the bottleneck. Turnstile doesn’t just block scrapers · it throttles requesters it deems suspicious, which includes legitimate automation that doesn’t look like a human using a browser.

The consequence is real: a batch that used to take 20 minutes now takes an hour, or you get locked out entirely and have to wait before retrying. That’s not a technical inconvenience. That’s a business process delay. For equipment-finance shops doing volume, it adds cost per deal.

Some underwriters have responded by hiring temps to manual-lookup records one at a time. That works, but it’s expensive and error-prone. Others have shifted their Maryland deal flow around, deprioritizing MD entities when faster states (like Delaware or Florida) are available. Both are rational responses to friction.

The broader pattern across states

Maryland is not alone. Over the last two years, a number of state Secretary of State portals have upgraded from older captcha systems to Turnstile or reCAPTCHA v3. Connecticut, North Carolina, and others have made similar moves. The intent is always the same: reduce spam and bot traffic to the portal.

The side effect is always the same: legitimate, high-volume users get slower or locked out. State IT budgets are often under pressure, and a captcha that “just works” is politically easier than one that needs tuning.

What this tells you is that any workflow that assumes you can batch-pull business records from state portals at speed is outdated. If you built a process three years ago that hit Maryland, Delaware, and Texas in a morning, test it now. Odds are it doesn’t complete without manual intervention.

What you can control

Slow down your request rate. Don’t hammer a state portal from the same IP in rapid succession. If you’re pulling 20 records, space them out over an hour or two, not 10 minutes. Use a proper browser user-agent header, not a generic script header. Some portals will log you out or serve Turnstile immediately if they see a non-browser request pattern.

Verify in the order that’s fastest for your credit decision. If you need the entity status and filing date to make a yes-no call, pull those first from the state. If beneficial-owner data or UCC filings would be nice to have but aren’t deal-critical, get those second or in a separate batch.

Accept that some states will require manual spot-checks. Maryland is now one of them. That’s not a failure of your process · it’s a requirement of Maryland’s process.

Where human review still adds value

Turnstile exists partly because some bad actors do run scrapers and scrape state data for credit fraud or competitor intel. The captcha isn’t wrong to be skeptical. What it means for you is that manual verification, when it happens, is actually more reliable than it looks. A human pulling a Maryland record through a browser is less likely to hit friction than an automated system, which means the information is fresher and the session is less likely to degrade mid-pull.

If you’re underwriting a fleet operator or a contractor with Maryland incorporation, do that lookup by hand or with a tool that handles the captcha interaction on your behalf. It takes three minutes. It’s worth it.

Bottom line

Maryland’s shift to Turnstile is a symptom of a real constraint in commercial underwriting. State portals are not APIs. They were not built for bulk queries. As captcha systems improve, they’re getting less friendly to automation and more reliant on the slowness and friction of manual human review. Plan your verification workflow around that reality, not around what was possible five years ago.