CAPTCHA glossary

A CAPTCHA is an automated test that a person can pass and a program is expected to fail. The name stands for Completely Automated Public Tur…

A game CAPTCHA is a CAPTCHA where the challenge is a short mini-game. Passing means finishing the game, after which the visitor gets a token…

A site key is a public identifier you put in your page so the widget can load. A secret key is a private credential your server uses to chec…

Siteverify is the name Cloudflare and Google use for the server-side endpoint that validates a CAPTCHA token. Your backend sends the token a…

A proof-of-work CAPTCHA asks the visitor's device to solve a computational problem, often a hash challenge, in the background. The cost is s…

An invisible CAPTCHA runs its check without asking the visitor to click or solve anything. It scores or tests the session in the background …

A honeypot field is a form input that people never see but that exists in the page code. Real visitors leave it empty. A script that fills e…

A CAPTCHA farm is a human solving service. People are paid to answer CAPTCHA challenges on behalf of someone else's script.

Credential stuffing is an attack where automated tools submit username and password pairs taken from other breaches to a login form, hoping …

A CAPTCHA token is a short-lived string the CAPTCHA service gives the page after a pass. The page sends it with the form, and your server ch…

In Google's reCAPTCHA, an assessment is the backend call that evaluates a token, created with the CreateAssessment method. It is also the un…

A headless browser is a browser that runs without a visible interface. Chrome documents a headless mode for servers, containers and CI pipel…