Documentation

Everything you need to integrate and operate CaptchaCore. If you are in a hurry, the quick start and a look at the verify response are enough.

What can we help with?

I want to get started quickly Create a site, include the script, check the token. Five minutes, three steps. Getting started → I use WordPress, Laravel or Symfony Install and configure the ready-made plugin or package. Integrations → I am building my own plugin The order of work, the templates and the checklist before release. Build your own integration → I am looking for a specific response field Every endpoint, field, status code and rate limit at a glance. API reference →

All chapters

01Getting started Create a site, add the widget, check the token — the shortest path to working protection. Quick startHTML integration 02Integrations Ready-made packages for Laravel, Symfony, WordPress and WoltLab Suite — plus the guide for one of your own. Laravel packageSymfony bundleWordPress pluginWoltLab SuiteBuild your own integration 03Widget Every attribute, the three modes and the JavaScript API for forms loaded later. Widget optionsWidget modesJavaScript API 04API reference Endpoints, response fields, status codes, rate limits and our stability commitments. Endpoints & responsesWebhooksVersioning 05Detection How the risk engine scores, how profiles and policies apply, and what happens under attack. Risk EngineSite profiles & form policiesUnder-Attack-Mode 06Operations Behaviour on outage, key rotation, server examples, domains and content security policy. Error handling & fail-openKeys & rotationBackend examplesDomains, CORS & CSP 07Help & privacy The most common pitfalls with their fix, and what CaptchaCore stores about your visitors. TroubleshootingPrivacy

The essentials in brief

1 · Include the widget

<script src="https://src-eu.captchacore.eu/widget/captchacore-v2.min.js"
        data-service-url="https://api.captchacore.eu"
        data-site-key="cc_pub_…" async defer></script>

<form data-captchacore="interactive" method="post">
    <div data-captchacore-widget></div>
</form>

2 · Check the token

POST https://api.captchacore.eu/api/v2/verify
X-CaptchaCore-Key: cc_sec_…

{ "token": "…", "form_type": "contact" }

Response

{ "valid": true, "decision": "allow", "risk_score": 8, "confidence": 0.94 } Process the form normally.

{ "valid": true, "decision": "challenge", "risk_score": 41, "confidence": 0.71 } Let it through but log it. Optionally add a check of your own, such as a confirmation email.

{ "valid": false, "decision": "step_up", "risk_score": 58, "step_up": { … } } Do NOT reject outright. The widget performs the additional check itself; return the form to the user with a friendly message.

{ "valid": false, "decision": "block", "risk_score": 96, "confidence": 0.88 } Reject. Show an error without details so attackers learn nothing.

valid is false for step_up as well. Do not treat step_up like block — details.