I spent a month scripting signups and posting across 8 platforms headlessly. Everyone asks about captchas. Captchas are the easy part. Here's what actually broke, in order of pain: Submit buttons that aren't buttons. Several editors render 'Continue' as a with no role and no type=submit. Clicking coordinates works; Playwright's .click() silently no-ops because the element isn't actionable. Fix: check getComputedStyle(el).cursor and backgroundColor — pointer + accent color means live, auto + grey means disabled. Phone verification is the wall, not the captcha. Telegram, Meta, and X all run HLR lookups. Virtual numbers get silently rejected — the button stays grey, or the code goes to someone else's app. SMS only reaches official mobile apps (Firebase), so a desktop headless client gets app-codes instead of SMS. Fix: use real carrier lines, or email-only platforms. Cookie banners that block your clicks. A full-screen [data-testid=mask] overlay sits over the Accept button. Coordinates miss, force-click hits the mask. Fix: reload — the banner usually doesn't survive a fresh render. IP reputation is per-platform. One datacenter IP gets you through Dev.to but 403'd on GitHub and Cloudflare-challenged on Medium. There's no single 'clean' IP — each platform keeps its own list. Fix: test the proxy with curl against the target before the run. Email-only platforms are the real entry point. Anything that lets you start from just an inbox (Substack, Mastodon, Reddit, Tumblr) skips the whole phone gauntlet. A domain that isn't on disposable blocklists beats a fresh custom domain every time. If you're automating signups, budget for verification the way you budget for servers. It's infrastructure now.