Help & privacy
The most common pitfalls with their fix, and what CaptchaCore stores about your visitors.
Troubleshooting
Widget does not load / 500 on /api/v2/challenge
Check the domain: is it listed under "Allowed domains" in the site settings? Wildcards are possible: *.example.com
CORS error in the browser
The CaptchaCore service must know the requesting domain. Add the domain in the site settings. Widget JS and worker JS are served with Access-Control-Allow-Origin: *.
Token is null / empty
The widget script must be loaded before the form is submitted. Check: is data-captchacore set on the <form>? Is a data-captchacore-widget container present (for visible/interactive)?
PoW FAIL / Nonce FAIL
The nonce is valid for 5 minutes and can be used once. If the user waits too long or submits twice, verification fails. Reload the page.
Checkbox tick not visible
External CSS frameworks can override the SVG. The widget uses !important for all critical styles. If in doubt: check browser DevTools > Elements > Computed styles.
Risk score too high for real users
Check the behavioural thresholds: time_to_submit_ms below 1500 ms = +35 penalty. Users need to spend enough time on the page and interact with it.
Privacy (GDPR)
What is stored
- IP hash (salt changes every 6 hours)
- Truncated IP (IPv4 /24, IPv6 /48)
- Browser, operating system and device family
- User agent hash (salted)
- Risk score + result
- IP fields cleared after 30 days, statistics 7–365 days depending on plan
What is NOT stored
- No plain-text IPs
- No cookies, no storage in the browser
- No mouse trajectories
- No keystrokes
- No form data
- No external requests