Frequently Asked Questions
This documentation covers SCaptcha 2.3.0. Configuration-dependent features are identified separately.
What is SCaptcha?
SCaptcha is a CAPTCHA for WoltLab Suite 6.2. The browser solves a Proof-of-Work challenge, then your installation checks the answer. Sentinel, browser checks, and code challenges are additional features.
What happens during verification?
The widget loads a signed challenge, calculates the answer in the browser, and sends it back to your WoltLab installation for verification.
What is Under-Attack Mode?
Under-Attack mode shows a check before public pages. After a successful check, SCaptcha sets a signed cookie with a short lifetime.
What does analytics include and how long is it kept?
Request analytics are on by default. Logs can contain linkable operational data, including IP address, user agent, request, network and location fields, reasons, and submitted browser telemetry. Retention defaults to 90 days and can be set from 1 to 3,650 days. Turning analytics off stops new collection but does not erase existing rows or exports.
Does SCaptcha send data to third parties?
Each challenge uses its own cryptographically random 32-byte salt. Your WoltLab installation validates the salt, hash, algorithm, answer, and HMAC against the issuing session. The challenge expires after 60 seconds and does not require an external CAPTCHA provider. This option is off by default. If you enable it, SCaptcha sends the visitor's public IP address to proxycheck.io for proxy, VPN, or Tor evidence. SCaptcha 2.3.0 sends tag=0 by default; administrators can opt in to provider logging. The IP address is transmitted for every lookup either way.
Is SCaptcha accessible?
Behavioral scoring and Sentinel are off by default. Unsupported or privacy-restricted signals are neutral. Pointer movement is required only for mouse input, scrolling only on scrollable pages, and keyboard or touch activation does not need fabricated mouse movement.
Which WoltLab Suite versions are supported?
SCaptcha 2 supports WoltLab Suite 6.2. SCaptcha 1 is available for older WoltLab versions without Sentinel, browser checks, or analytics.
How do I install and enable SCaptcha?
Install the package through WoltLab package management, then select SCaptcha as the CAPTCHA in the ACP. The SCaptcha settings appear after it is selected.