Challenge Modes
Two separate decisions: when a visitor is asked to prove themselves, and what happens to a submission you are not convinced by.
When someone is asked
suspicious (Default)
The visitor is only asked when the behaviour score looks off. Recommended for most sites: strong protection, no friction for everyone else.
always
Every visitor is asked, whatever the score. For high-stakes forms — sign-in, payment, password reset.
What happens to the submission
You choose this per verdict, and you can override it for an individual form. Every submission is scored and reported either way — this only decides what is enforced.
Ask the visitor
The visitor is asked to prove they are human. Passing lets the submission through. This is the default for both suspicious and bot verdicts.
Reject
The submission is refused outright, with no second chance.
Let through
The submission is accepted anyway. It is still scored and still counted in your reports — nothing is enforced. This is the honest way to run in monitoring mode.
One case has no “ask” option: a submission we have no measurement for at all — JavaScript switched off, an optimiser that removed our script, or a visitor who took too long. Real people end up here too, and by the time your server checks, they have already sent the form and left. There is nobody left to ask, so the only choices are to reject or to let through.
Set this in your dashboard under API Keys → Security. Individual forms can differ: API Keys → Forms.