Adaptive Captcha
Open-source ALTCHA presents every visitor with the same proof-of-work difficulty. Adaptive Captcha, part of Sentinel, instead scales what a visitor is asked to do based on their individual risk score.
Frictionless Captcha vs. Code Challenge
- Frictionless Captcha — what legitimate users see: a background proof-of-work computation with no visual puzzle to solve.
- Code Challenge — what flagged users see instead: an interactive challenge that requires active participation, deliberately adding friction for traffic that looks suspicious.
Examples
Frictionless
Interactive Bot Check
How it works
Sentinel evaluates server-side signals into a combined risk score for every request — it does not rely on browser fingerprinting or invasive client-side tracking. When the score crosses a threshold, Sentinel escalates from a frictionless challenge to a Code Challenge (or a rate limit / block, depending on your Security Group policy).
Evaluated factors
- Automated clients — abnormal request timing, parallelized submissions, malformed payloads, missing browser characteristics.
- Suspicious networks — a local database of high-risk IPs, including Tor exit nodes and known botnet ranges.
- High-risk geographic regions — heightened scrutiny for locations with historically elevated automated abuse.
- Non-standard browser requests — missing typical headers, or unusual header combinations.
- User penalties — temporary penalties for exceeded rate limits, failed challenges, or malformed requests.
- Server load — thresholds tighten automatically during high-traffic periods.
Accessibility & audio challenge
The Code Challenge includes an audio option to stay compliant with accessibility standards (including the European Accessibility Act, EAA 2025) for users relying on assistive technology like screen readers.
Audio is generated by a built-in text-to-speech synthesizer — no external service dependency, and generation takes under 5ms. Numeric codes are read digit-by-digit; letters are read using phonetic-alphabet pronunciation (e.g. the NATO alphabet for English).
Configuration:
AUDIO_CHALLENGE_DELAY— delay before generating/returning the audio challenge (default3s; set to0for instant generation). See ENV Variables.- Code alphabet and code length (4–8 characters) — configurable per Security Group.
Audio samples
Numeric codes:
| Language | Sample |
|---|---|
| English | |
| Spanish | |
| French | |
| Portuguese | |
| Russian | |
| Arabic | |
| Chinese | |
| Hindi |
Letter pronunciation:
| Language | Sample |
|---|---|
| English | |
| German | |
| Polish | |
| Swedish |
Supported languages
- Full alpha-numeric support (30 languages): Afrikaans, Bulgarian, Croatian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Hungarian, Indonesian, Italian, Latvian, Lithuanian, Malay, Norwegian Bokmål, Polish, Portuguese, Romanian, Russian, Serbian, Slovak, Slovenian, Spanish, Swedish, Turkish, Ukrainian, Vietnamese.
- Numeric-only support (14 languages): Arabic, Bengali, Cantonese, Chinese, Greek, Hebrew, Hindi, Japanese, Korean, Marathi, Punjabi, Tamil, Telugu, Thai, Urdu.
Configuration
Enable Adaptive Captcha one of two ways:
- Autopilot — let Sentinel manage it automatically based on observed traffic. See Autopilot.
- Manual — enable the Code Challenge feature and activate Adaptive Mode directly in your Security Group settings.
Related
- Autopilot — automatic tuning of the thresholds this feature uses.
- Human Interaction Signature — one of the main signals feeding the risk score.
- Widget Integration — the client-side component that renders the challenge.