**Steps to replicate the issue** (include links if applicable):
* Log out of your account/be in incognito mode
* Open the 2010 wikieditor for a draft page like https://en.wikipedia.org/w/index.php?title=Draft:Cross-site_leaks&action=submit
* Paste in the following content:
```
{{Cite web
| last = Jensen
| first = Nathan D.
| title = General Alexandre-Louis-Robert Girardin d'Ermenonville (1776-1855)
| url = https://www.frenchempire.net/biographies/girardin/
| website = frenchempire.net
| access-date = 31 October 2025
}}
```
* Press "Publish page"
**What happens?**:
The page reloads with no notice, peeking at logstash tells me: "ConfirmEdit: new captcha session; 1x url trigger by '<my IP>' at [[Draft:Cross-site leaks]]: https://www.frenchempire.net/biographies/girardin/" but no CAPTCHA is shown to me
**What should have happened instead?**:
The page should show a CAPTCHA or the edit should have been published