CAPTCHA & Challenges

VisitorFilters ships a first-party CAPTCHA built on proof of work: suspicious visitors solve a small computational puzzle before they get through. There are no image grids, no third-party requests, and no tracking.

How the Built-in CAPTCHA Works

A visitor who matches a challenge rule is sent to the challenge page instead of being blocked outright.
Their browser solves a small hashcash-style puzzle automatically — there is nothing to read or click.
The difficulty adapts to the visitor's risk score: low-risk visitors clear it in well under a second, high-risk automation pays a real computational cost.
On success the browser receives an encrypted, replay-protected token bound to the visitor, and the request continues normally.

Using CAPTCHA in Rules

Choose Challenge as the action of any rule to present the CAPTCHA instead of a hard block. Two common setups:

Custom rules — challenge specific countries, ASNs, paths, or rate offenders while keeping them out of your logs as hard blocks.
Managed threat-feed rule — one toggle challenges every visitor whose IP appears on the managed threat intelligence feed.

Embedding on Your Own Forms

The same widget can protect your own forms — logins, signups, comments — independently of rules. The flow:

Copy the embed snippet for your site from the dashboard's CAPTCHA settings; the widget script is served from our CDN.
The widget renders inside your form and produces a response token when the visitor passes.
Your backend verifies the token server-side against the site-verify endpoint before accepting the submission.

Tokens are single-use and expire quickly, so a captured token cannot be replayed.

External Providers

Prefer a third party? Cloudflare Turnstile and hCaptcha can be configured per site and used as the challenge instead of the built-in CAPTCHA.

Privacy

No third-party requests are made during a challenge.
No behavioral tracking or advertising identifiers — the puzzle is pure computation.
Fits the same GDPR posture as the rest of the platform.