Under-Attack Mode

Under-Attack Mode

Under-Attack Mode replaces normal pages with a dedicated verification screen. Visitors solve the PoW (and fallback challenge if needed) once, then receive a signed cookie bound to their session ID and user-agent hash so they can continue browsing without repeated checks.

Verification Flow

Enable Under-Attack Mode to gate all public pages with a verification screen that runs before regular content is served.

SCaptcha starts the Proof-of-Work challenge immediately on load. If JS checks or Sentinel escalate, the user completes the fallback code challenge.

On success, SCaptcha sets a signed cookie tied to the session ID and user-agent hash, then redirects to the original page after the configured delay.

Security cookies

A pre-submit marker and the optional text/audio proof are valid for 5 minutes. Under-Attack mode uses a signed, user-agent-bound access cookie for 5 to 30 minutes; the default is 10. Sentinel can store a server-side rejection in a separate signed cookie for 10 minutes. Sentinel itself is off by default.

Available Options

Redirect delay controls how long the verification screen remains before returning to the original page.

Set this to 0 for instant reloads, or add a short delay when slower devices need time to finalize the PoW.

When to Use It

Use Under-Attack Mode during spam waves, credential stuffing, or sudden traffic spikes that overload your infrastructure.

It is ideal for short, high-risk windows such as product launches or promotions, and as a temporary shield while you tune Sentinel or JS thresholds.

Tuning Tips

Use 5 to 10 minute cookies during active attacks, then increase the lifetime once traffic stabilizes.

If UX is critical, set redirect delay to 0 and keep gesture requirements relaxed to avoid false positives.

Monitor analytics to confirm that failed or blocked attempts drop without impacting legitimate users.