CAPTCHA

The classic Turing test implementation requiring users to identify distorted text, traffic lights, or crosswalks. These challenges exploit the semantic gap between human visual cortex processing and computer vision models. Modern variants include image reCAPTCHA grids where users select specific objects, generating labeled training data for machine learning systems while simultaneously verifying humanity.

A frictionless verification engine (reCAPTCHA v3 / hCaptcha Enterprise) that returns a bot score between 0.0 and 1.0 without interrupting the user. It analyzes:

• Mouse movement trajectories and micro-jitter
• Keystroke dynamics and typing cadence
• Scroll velocity and touchscreen pressure curves
• Browser environment integrity and API consistency This allows site owners to programmatically challenge low-confidence sessions while allowing high-confidence human traffic to pass seamlessly.

A cryptographic challenge requiring the client to expend CPU cycles solving a mathematical problem before submitting a form or accessing a resource. Unlike visual puzzles, these impose an economic cost on large-scale scraping operations by consuming computational resources. Implementations like Friendly Captcha and mCaptcha use SHA-256 hash inversion or memory-hard algorithms that scale linearly with the number of requests, making bulk automated attacks financially prohibitive.

An accessibility-compliant alternative that presents a distorted audio clip of spoken digits or words over background noise. This tests the human auditory system's ability to perform cocktail party effect source separation—isolating a target voice from overlapping chatter—a task that remains exceptionally difficult for automated speech recognition systems. Compliance with WCAG 2.1 guidelines mandates this fallback to ensure users with visual impairments can complete verification.

CAPTCHA engines combine challenge-response logic with passive telemetry to build a persistent device profile. Signals collected include:

• Canvas fingerprinting (rendering variations across GPUs)
• WebGL renderer strings and driver versions
• Font enumeration and installed plugin lists
• Timezone offset and language stack consistency This allows the system to recognize returning bots even if they rotate IP addresses, creating a cumulative trust score across sessions.

A probabilistic rating assigned to a session or request by a detection engine, aggregating signals from IP reputation, TLS fingerprinting, and behavioral analysis to determine the likelihood of automation.

• Typically expressed as a percentage or categorical risk level (low/medium/high)
• Feeds into the decision engine that determines whether to serve a CAPTCHA challenge
• Integrates with edge bot management platforms for real-time scoring

A set of techniques that probe for the absence of a visible rendering surface or the presence of automation control flags in the JavaScript environment to identify browsers controlled by tools like Puppeteer or Playwright.

• Checks for navigator.webdriver property set to true
• Tests for missing browser plugins, inconsistent viewport dimensions, and incomplete rendering pipelines
• Often deployed as a pre-filter before invoking a visual CAPTCHA

A defensive mechanism involving an invisible link or form field hidden from human users via CSS but visible to parsers, which immediately identifies and blocks automated scrapers when they interact with it.

• Hidden using display: none, visibility: hidden, or positioned off-screen
• Legitimate users never see or interact with the trap
• Provides a high-confidence signal of automation without user friction

A cryptographic challenge that requires the client to expend significant CPU cycles to solve a mathematical puzzle before access is granted, imposing an economic cost on large-scale scraping operations.

• Similar in concept to cryptocurrency mining difficulty
• Stateless verification: the server only needs to check the solution, not track sessions
• Increasingly used as a CAPTCHA alternative to avoid accessibility issues

The heuristic examination of request timing, URL traversal logic, and session depth to distinguish the methodical, high-volume behavior of bots from the stochastic, intermittent browsing patterns of humans.

• Analyzes inter-request intervals, page dwell time, and mouse movement entropy
• Detects headless browsers that load pages but never trigger human-like interaction events
• Often combined with CAPTCHA as a second-factor behavioral signal

A security service deployed at the content delivery network edge that uses machine learning and fingerprinting to detect, categorize, and mitigate automated traffic before it reaches the origin server.

• Integrates CAPTCHA serving, bot score calculation, and rate limiting into a unified platform
• Vendors include Cloudflare Bot Management, Akamai Bot Manager, and AWS WAF Bot Control
• Reduces origin server load by filtering malicious traffic at the edge