Measurement
CAPTCHA metrics without copying private form data
Build a compact event model for outcome analysis, keeping credentials, proofs, and sensitive form contents out of ordinary analytics.
By the easycaptcha team · Published
A request body is easy to capture, but it is rarely the best metric. Start with what the team needs to know: whether verification loaded, a result arrived, the server accepted it, and the final action completed. Those questions often need stage events rather than a copy of the submitted form.
Useful measurement events
A limited correlation identifier can connect observations without including passwords, proof values, proxy credentials, or private text in every event.
Keep a small event schema
| Proposed field | Purpose |
|---|---|
| Operation identifier | Connect stages of one intended task |
| Stage and outcome | Locate completion, rejection, or uncertainty |
| Elapsed interval | Compare observable timing |
| Environment/version | Explain deployment changes |
| Relevant non-secret cohort | Separate task families or configuration |
Only collect fields that answer a defined question. A public sitekey can be relevant to attribution; unrelated form contents usually are not. Public does not automatically mean useful to retain indefinitely.
Separate analytical and support records
Product reporting may need aggregates and durations. A restricted support investigation may need a limited request ID and error detail. Do not give an unrestricted analytics stream every field merely because one operator might occasionally need more context.
Document access, retention, and deletion behavior for each store according to the deployment’s policy. This article proposes a technical data model, not a legal compliance determination for a provider.
Test the exception paths
A redacted normal log can coexist with an exception tracker that uploads the whole request. Exercise malformed responses, provider errors, and interrupted submissions, then inspect each destination. Review body redaction when new optional inputs add credentials.
Keep unknown observations explicit so data minimization does not become an excuse to guess outcomes. The model can preserve uncertainty without preserving a proof.
Data minimization maps sensitive fields, success-rate definitions supplies stage denominators, and support diagnostics explains when limited operational evidence should be collected separately from routine product telemetry.
Frequently asked questions
Do useful CAPTCHA metrics require logging complete payloads?
Often they do not. Task IDs, statuses, timestamps, and observed outcomes can answer many diagnostic questions with less data.
What should I avoid collecting by default?
Avoid proofs, private form values, and unrelated visitor information. Define each measurement event from the question it needs to answer.
How can easycaptcha fit into my integration tests?
Use the documented recognition or token API for the hCaptcha stage, preserve task IDs, and inspect terminal results. Measure verifier acceptance and application completion separately from job completion.