Documentation

Everything you need to integrate and operate CaptchaCore. If you are in a hurry, the quick start and a look at the verify response are enough.

What can we help with?

I want to get started quickly

Create a site, include the script, check the token. Five minutes, three steps.

I use WordPress, Laravel or Symfony

Install and configure the ready-made plugin or package.

I am building my own plugin

The order of work, the templates and the checklist before release.

I am looking for a specific response field

Every endpoint, field, status code and rate limit at a glance.

All chapters

Getting started

Create a site, add the widget, check the token — the shortest path to working protection.

Quick start · HTML integration

Integrations

Ready-made packages for Laravel, Symfony, WordPress and WoltLab Suite — plus the guide for one of your own.

Laravel package · Symfony bundle · WordPress plugin · WoltLab Suite · Build your own integration

Widget

Every attribute, the three modes and the JavaScript API for forms loaded later.

Widget options · Widget modes · JavaScript API

API reference

Endpoints, response fields, status codes, rate limits and our stability commitments.

Endpoints & responses · Webhooks · Versioning

Detection

How the risk engine scores, how profiles and policies apply, and what happens under attack.

Risk Engine · Site profiles & form policies · Under-Attack-Mode

Operations

Behaviour on outage, key rotation, server examples, domains and content security policy.

Error handling & fail-open · Keys & rotation · Backend examples · Domains, CORS & CSP

Help & privacy

The most common pitfalls with their fix, and what CaptchaCore stores about your visitors.

Troubleshooting · Privacy

The essentials in brief

Include the widget

<script src="https://src-eu.captchacore.eu/widget/captchacore-v2.min.js"
        data-service-url="https://api.captchacore.eu"
        data-site-key="cc_pub_…" async defer></script>

<form data-captchacore="interactive">
    <div data-captchacore-widget></div>
</form>

Check the token

POST https://api.captchacore.eu/api/v2/verify
X-CaptchaCore-Key: cc_sec_…

{ "token": "…", "form_type": "contact" }

// Antwort
{ "valid": true, "decision": "allow", … }

valid is false for step_up as well. Do not treat step_up like block — details.