What is SCaptcha?
This documentation covers SCaptcha 2.3.0. Configuration-dependent features are identified separately.
Proof of Work Mechanism
Each challenge uses its own cryptographically random 32-byte salt. Your WoltLab installation validates the salt, hash, algorithm, answer, and HMAC against the issuing session. The challenge expires after 60 seconds and does not require an external CAPTCHA provider.
Sentinel Risk Engine
Server-side scoring for IP, ASN, country, time zone, and email signals before verification completes.
Client-Side JS Checks
Behavior checks are off by default. The code contains pointer, movement, and scrolling checks, plus optional canvas, WebGL, and audio routines. Evaluation happens in the browser; results can affect local scoring and SCaptcha logs. This documentation therefore makes no blanket no-fingerprinting claim.
Under-Attack Mode
A site-wide verification page that filters traffic spikes with a short-lived cookie.
Analytics & Operations
Request analytics are on by default. Logs can contain linkable operational data, including IP address, user agent, request, network and location fields, reasons, and submitted browser telemetry. Retention defaults to 90 days and can be set from 1 to 3,650 days. Turning analytics off stops new collection but does not erase existing rows or exports.
Compliance
SCaptcha supports privacy-conscious and accessible deployments. The requirements for your site depend on its configuration, data flows, and field of use.