FAQ¶
This page answers the questions that occur most frequently before and during an integration. Each answer refers to the section with the full description.
Must the visitor solve a puzzle?¶
No. The widget collects signals of the browser, and the browser solves a calculation task in the background. The visitor only sees a small Myra logo. There are no puzzles, no image selections, and no entries.
See How EU CAPTCHA works.
Does the website need a cookie banner for the widget?¶
No. Myra EU CAPTCHA operates without HTTP cookies and without permanent browser storage.
See Introduction.
How long does a challenge take?¶
The duration agrees with the difficulty level. There are eight levels from 0 to 7. Level 0 is solved after approximately 600 milliseconds, level 7 after approximately 30 minutes. Legitimate human visitors almost always get level 0 or level 1.
See A challenge takes an unusually long time.
Can I set the difficulty level myself?¶
You set an initial value for each sitekey. The setting contains the levels 0 to 3. The risk detection sets the higher levels itself as soon as suspicious behaviour occurs.
How many times can a token be used?¶
Each token is valid one time. A second verification of the same token responds with the timeout-or-duplicate error code. The same code also stands for an expired challenge.
Why does the endpoint report a success although there was no verification?¶
In this case, the response contains success: true together with train: true. The train: true value means that there was no real verification. Each transmission then counts as successful. This occurs with an unknown sitekey, with a secret that does not agree, with a sitekey whose protection is off, and with each other malfunction of the verification.
In production, always examine the two fields. With train: true, examine the values of sitekey and secret immediately.
What counts as an assessment?¶
An assessment counts as soon as the widget starts the examination in the background. The examination in the background and the server-side call count together as one assessment. The verification mode does not change this.
See How EU CAPTCHA works.
What occurs if I go above the monthly limit?¶
The monthly limit for assessments is not enforced at this time. If you go above the limit, the widget continues to operate.
See Plans tab.
How many sitekeys does a plan contain?¶
All plans contain an unlimited count of sitekeys. One sitekey for each domain is intended.
See Plans tab.
Can one sitekey be used for more than one domain?¶
One sitekey for each domain is intended. The system does not examine that the domain is unique. Thus two sitekeys for the same domain occur without a notice.
See Two sitekeys for the same domain.
What occurs at the end of the trial period?¶
The widget returns the TRIAL_EXPIRED error code and lets the requests through. Visitors are not blocked, and your forms stay available. The protection against bots ends. After you book a plan, the protection becomes active again in 60 seconds after the successful payment.
See Trial period expired.
Are my forms blocked if the API has a malfunction?¶
No. With a malfunction, the widget lets the requests through. The forms stay available to visitors. But the protection is not effective during this time.
Where are the sitekey and the secret given?¶
The two values are given in the Details view of the sitekey.
See Details view.
Is the secret permitted in the source code of the page?¶
No. The secret stays on your server. Call the /verify endpoint only from your server. The source code of the page contains only the public sitekey.
How do I examine if the integration is complete?¶
The Integration Test view examines the two parts separately: the load of the widget and the server-side verification of the token. The Fully Integrated result confirms a complete integration.
Which addresses must my Content Security Policy permit?¶
The script-src and frame-src directives must contain the https://cdn.eu-captcha.eu address, and the connect-src directive must contain the https://api.eu-captcha.eu address. If one of these permissions is missing, then the browser blocks the widget, although the service is reachable.