CAPTCHA & Challenges

VisitorFilters ships a first-party CAPTCHA built on proof of work: suspicious visitors solve a small computational puzzle before they get through. There are no image grids, no third-party requests, and no tracking.

How the Built-in CAPTCHA Works

1. A visitor who matches a challenge rule is sent to the challenge page instead of being blocked outright.
2. Their browser solves a small hashcash-style puzzle automatically — there is nothing to read or click.
3. The difficulty adapts to the visitor's risk score: low-risk visitors clear it in well under a second, high-risk automation pays a real computational cost.
4. On success the browser receives an encrypted, replay-protected token bound to the visitor, and the request continues normally.

Using CAPTCHA in Rules

Choose Challenge as the action of any rule to present the CAPTCHA instead of a hard block. Two common setups:

• Custom rules — challenge specific countries, ASNs, paths, or rate offenders while keeping them out of your logs as hard blocks.
• Managed threat-feed rule — one toggle challenges every visitor whose IP appears on the managed threat intelligence feed.

Embedding on Your Own Forms

The same widget can protect your own forms — logins, signups, comments — independently of rules. The flow:

1. Copy the embed snippet for your site from the dashboard's CAPTCHA settings; the widget script is served from our CDN.
2. The visitor ticks the I am human checkbox — hCaptcha/Turnstile style — and the widget solves the proof of work behind the scenes, adding a hidden vf_captcha_response field to your form.
3. Your backend verifies the token server-side against the site-verify endpoint before accepting the submission.

Tokens are single-use and expire quickly, so a captured token cannot be replayed.

Verifying From Your Backend

POST the token to /collector/form/siteverify with your secret key and read the success field:

• secret — your site secret key (never expose it in the browser).
• response — the value of the vf_captcha_response field.
• remoteip (optional, recommended) — the visitor's IP address. When supplied, it must match the IP the token was solved on, which defeats token relaying through a solving service.

Domain Binding

The widget only issues challenges to pages served from a domain registered to your site. If you copy your public key onto an unregistered domain the widget shows Domain not registered and refuses to verify, so a leaked public key cannot be reused elsewhere. Add every domain and subdomain that embeds the widget under your site's settings.

Adaptive Difficulty From Our Threat Intelligence

The proof of work is not a fixed cost. Requests coming from IPs on our threat-intelligence feed, from datacenter networks, from headless browsers, or that report automation signals are made to solve a substantially harder puzzle — invisible to real people, expensive at bot scale. This is powered by the same threat data that drives the rest of the platform, not a third-party risk score.

External Providers

Prefer a third party? Cloudflare Turnstile and hCaptcha can be configured per site and used as the challenge instead of the built-in CAPTCHA.

Privacy

• No third-party requests are made during a challenge.
• No behavioral tracking or advertising identifiers — the puzzle is pure computation.
• Fits the same GDPR posture as the rest of the platform.