Sentinel Risk Engine
This documentation covers SCaptcha 2.3.0. Configuration-dependent features are identified separately.
Sentinel Risk Engine
Server-side scoring for IP, ASN, country, time zone, and email signals before verification completes.
How Sentinel Works
The widget sends a signed sentinel payload with optional time zone and email domain data. The signature prevents tampering and keeps the payload short-lived.
Sentinel evaluates device headers such as User-Agent, Accept/Accept-Language/Accept-Encoding, Sec-Fetch, and DNT. Missing headers or missing Sec-Fetch add penalties, and the WCF robot list is used to catch known bots.
GeoLite2 lookups map the IP to country, city, and ASN, then compare expected countries, Accept-Language country hints, and time zone alignment.
Optional ProxyCheck.io lookups add proxy, VPN, or TOR intelligence with cached results before Sentinel classifies the score.
Scoring & Classification
Blocked countries and ASNs add +5, unexpected countries add +1, time zone mismatch adds +1, Accept-Language mismatch with country languages adds +1, and IP blacklists add +3. Email rules add their own penalties.
Scores <=0 are GOOD, scores >0 are NEUTRAL, and scores >=5 are BAD. JS escalation always triggers on BAD and can trigger on NEUTRAL when score >0.
If DNT is present, Sentinel can slightly reduce the score to avoid penalizing privacy-conscious users.
Core Controls
Enable SCaptcha Sentinel to activate server-side checks. The default mode uses email, IP, and time zone signals.
Switch to ipOnly when you do not want to collect email signals. This keeps scoring focused on network and device signals only.
Geo & Network Rules
Blocked countries and ASNs add +5 and can be configured to block outright depending on your escalation action.
Blocked ASNs (AS123 or 123) are useful for known abusive networks, but should remain targeted to avoid collateral damage.
IP blacklist hits add +3 and can be used for short-lived abuse waves.
Proxy check
This option is off by default. If you enable it, SCaptcha sends the visitor's public IP address to proxycheck.io for proxy, VPN, or Tor evidence. SCaptcha 2.3.0 sends tag=0 by default; administrators can opt in to provider logging. The IP address is transmitted for every lookup either way.
Logging & Analytics
Sentinel payloads are stored in the session for 10 minutes and attached to the next verification log so you can correlate client behavior with server scoring.
Only classification, score, and triggeredRules are returned unless debug is enabled. Blocked Sentinel responses are logged immediately with reason codes.
CSV exports can include Sentinel payloads for offline review and incident response.
Best Practices
Start with default mode and review logs before tightening rules. Overly strict settings can increase false positives.
Keep blocked country and ASN lists small and targeted, and use expected country or language rules for regional communities.
Enable ProxyCheck.io during active attacks or sign-up abuse waves, then disable it when traffic stabilizes.