Client-Side JS Checks

Optional browser checks

Behavior checks are off by default. The code contains pointer, movement, and scrolling checks, plus optional canvas, WebGL, and audio routines. Evaluation happens in the browser; results can affect local scoring and SCaptcha logs. This documentation therefore makes no blanket no-fingerprinting claim.

Decision Pipeline

While the page is open, SCaptcha tracks interaction telemetry: mouse/touch move counts and span, bounding box, direction entropy, speed and interval variance, scroll presence and uniformity, click count, hover dwell, keyboard inactivity after 15s, visibility changes, and first-interaction timing (<500ms).

On click, the client evaluates high-signal automation markers such as navigator.webdriver, HeadlessChrome in the UA, automation globals (__webdriver_evaluate, _phantom, etc.), UA brand indicators for Playwright/Puppeteer, and a substring blocklist for AI/crawler patterns.

Environment checks run only when enabled. Missing or privacy-restricted APIs remain neutral, and generic Chromium/ANGLE, Mesa, or llvmpipe renderer strings do not count as automation on their own.

Fingerprint and timing signals (canvas toDataURL timing under 5ms, WebGL fingerprint hash and extension counts, OfflineAudioContext hash, requestAnimationFrame cadence uniformity) are sampled per session to reduce stability, then blended into the score.

Thresholds & Outcomes

If confidence >= botThreshold, the configured escalation action (challenge or block) runs immediately. If confidence >= challengeThreshold, the fallback challenge is shown unless escalation is set to none.

Blocking sets an error state and logs the reason; challenge opens the fallback overlay tied to the PoW payload.

Under-Attack Mode raises thresholds and relaxes gesture requirements so legitimate users can still pass quickly during traffic spikes.

Behavior & UX Controls

Pointer movement applies only to mouse input, scrolling only to scrollable pages, and legitimate keyboard or touch activation does not need simulated mouse movement.

Telemetry includes movement counts and span, direction entropy, hover dwell, click count, first interaction timing (<500ms), and keyboard inactivity after 15s.

Escalation & Logging

Escalation writes a reason list and confidence score into the analytics payload so you can review exactly why a session was challenged or blocked.

Challenge escalation requests the code-based image/audio fallback. The server stores the challenge and proof tokens in the session for 5 minutes, and the PoW is accepted only when the proof token matches.

Block escalation stops verification and records the outcome in request logs. Client events like escalation, challenge, and verified are stored in the JS payload to support drill-down analysis.

Accessibility Notes

If your audience is keyboard-only or uses embedded views, relax scroll or pointer requirements and rely more on timing or environment signals.

Disable audio or WebGL checks for locked-down browsers or strict privacy extensions to avoid false positives.

Prefer challenge escalation over blocking when accessibility or device diversity is high.

Floating mode can improve form UX, but test it with screen readers and zoom because anchor placement can affect focus order.

Analytics and retention

Request analytics are on by default. Logs can contain linkable operational data, including IP address, user agent, request, network and location fields, reasons, and submitted browser telemetry. Retention defaults to 90 days and can be set from 1 to 3,650 days. Turning analytics off stops new collection but does not erase existing rows or exports.