CAPTCHA learning center
Understand what a challenge checks, what it cannot establish, and how it fits into a complete application. Start with the basics or go straight to the abuse problem you need to address.
32 articles ยท Most recently published first
Testing fundamentalsCAPTCHA test keys: what they prove and what they do not
Use provider test credentials for deterministic application checks, keeping production configuration separate and rejection paths covered.
Read article
Messaging abuseSMS pumping: protect verification message costs
Understand repeated message initiation as a resource-abuse problem, and review provider safeguards and server controls before sending SMS verification work.
Read article
AccessibilityCAPTCHA accessibility: how to review your form
Review image challenges, keyboard navigation, screen-reader feedback, expiration, and alternative routes as part of an accessible form.
Read article
Integration conceptsWhat is an hCaptcha sitekey?
Understand the difference between an hCaptcha sitekey, a verification secret, and an easycaptcha API key, and supply the correct sitekey in your integration.
Read article
Account abuseHow to reduce brute-force login attempts
Protect authentication with layered attempt controls and usable account recovery, while distinguishing password guessing from credential stuffing.
Read article
Registration abuseHow to reduce automated fake-account creation
Review registration, verification, activation, and downstream benefits together so unwanted account creation cannot move to a weaker alternate path.
Read article
Commerce abuseHow to reduce automated inventory hoarding
Protect reservations and stock holds by reviewing expiration, per-operation limits, and purchase completion instead of relying only on checkout challenges.
Read article
Verification fundamentalsCAPTCHA hostname, sitekey, and action checks
Bind verification to the application flow your server expects instead of accepting any successful-looking proof from an unrelated context.
Read article
Verification fundamentalsCAPTCHA token replay and expiration explained
Understand why a proof should be fresh for the protected submission, and design retries that obtain a new token rather than reusing consumed evidence.
Read article
Account abuse preventionHow to prevent credential stuffing
Protect login flows from reused stolen credentials with layered controls, account safeguards, server-side verification, and recovery that works for real users.
Read article
Application controlsRate limits and CAPTCHA: complementary controls
Understand why resource limits, authentication, and challenge verification should each enforce a separate condition around a protected operation.
Read article
Verification fundamentalsWhy CAPTCHA validation belongs on the server
Understand the trust boundary between a widget and a protected endpoint, and test missing, rejected, and unavailable verification outcomes.
Read article
Challenge fundamentalsCAPTCHA widget vs challenge: what is the difference?
Separate the embedded UI from the individual question or computational task, and use that distinction when debugging, testing, or measuring outcomes.
Read article
Challenge fundamentalsInvisible CAPTCHA: execution and recovery still matter
Understand that hiding a checkbox does not remove challenge policy, server validation, expiration, or the need for clear errors and retries.
Read article
Challenge fundamentalsWhat is a proof-of-work CAPTCHA?
Understand computation-based verification, its prover and verifier roles, and why device work does not by itself establish identity or application permission.
Read article
Integration fundamentalsEnterprise CAPTCHA terminology for integrations
Distinguish enterprise provider features, enterprise task types, account access, and flow-specific data without assuming every vendor uses the term identically.
Read article
Verification fundamentalsFail-closed CAPTCHA verification and usable recovery
Prevent missing configuration or provider errors from authorizing an action, while preserving clear retries and non-sensitive form content for genuine visitors.
Read article
Form abuse preventionHow to prevent form spam without blocking real users
Protect contact and signup forms with server-side validation, rate controls, verification, moderation, and accessible recovery.
Read article
Privacy fundamentalsCAPTCHA data minimization for application logs
Keep useful verification diagnostics while limiting proof values, credentials, private form content, and unnecessary personal data in logs and analytics.
Read article
Challenge fundamentalshCaptcha recognition types: binary, area selection, and drag
Understand the three recognition families in the easycaptcha API and why their input structures, answer models, geometry, and group counts differ.
Read article
Community abuseHow to reduce automated poll and vote manipulation
Protect the meaning of a vote with eligibility and uniqueness rules, while using verification and rate controls as supporting conditions.
Read article
Configuration fundamentalsRotate CAPTCHA secrets without exposing them
Separate public keys from server credentials, plan a verifier secret change, and test configuration reload and rollback without leaking values.
Read article
Promotion abuseCoupon abuse: enforce eligibility beyond a CAPTCHA
Review promotion eligibility, attribution, duplicate claims, and redemption state separately from challenge completion when protecting discounts or credits.
Read article
CAPTCHA basicsWhat is a CAPTCHA and what does it prevent?
Learn what CAPTCHA means, how verification fits into a website, and why a solved challenge is only one signal when preventing automated abuse.
Read article
Authentication fundamentalsMFA and CAPTCHA: separate authentication controls
Understand why a visitor challenge cannot establish account ownership or replace an authentication factor, and review recovery alongside login.
Read article
Payment abuse preventionHow to prevent carding and card-testing attacks
Learn how to protect payment flows from card testing with server-side verification, payment-provider controls, rate limits, and monitoring.
Read article
Browser fundamentalsCAPTCHA and Content Security Policy: what to review
Identify the script, frame, connection, and asset requirements of a widget, and verify a restrictive CSP without disabling unrelated protections.
Read article
Browser fundamentalsCAPTCHA API calls and CORS: understand the browser boundary
Separate browser cross-origin permission from authentication, worker networking, and server-side verification when diagnosing an integration.
Read article
Bot fundamentalsBots and automation: why intent matters
Distinguish useful automation from abusive behavior and choose controls around the operation being protected rather than labeling every automated client malicious.
Read article
Account abuseAccount enumeration: what a CAPTCHA does not fix
Understand how authentication and recovery responses can reveal account existence, and review response behavior independently of visitor verification.
Read article
Verification conceptsWhat is an hCaptcha token?
Understand hCaptcha tokens, server-side verification, expiration, and the difference between receiving a token and completing a protected action.
Read article
Account recoveryHow to protect password-reset flows from abuse
Review recovery message volume, account-existence leakage, proof handling, and final account access separately when protecting a password-reset flow.
Read articleLooking for the API contract?
The API reference covers request schemas, task results, errors, and authentication. Read pricing for the current billing units.
Get started with easycaptcha
Make hCaptcha easier.
Get recognition assistance in your Chromium browser, or build hCaptcha recognition and token workflows with our API and typed SDKs.
25 free recognitions a day in the extension. No account or payment required for the free plan.