What's new

Release notes for the loader your visitors run and the service behind it. Sites that host the loader themselves move to the current version when they copy the new file.

Loader

The current loader is 1.2.1. Sites that load it from us run it already; earlier entries are history.

1.2.1

A named entry point

  • The loader defines window.otcaptcha, with init(config, callback) to start a check and version to read the build. Both are documented in full in the developer docs.
  • The file is also served at /captcha/v1/otcaptcha.js. Same bytes, same headers.
  • No change to the checks, the box or the server check.
1.2.0

A brand look, a clearer box and fewer round trips

  • Brand look per site: accent colour, corner radius, light or dark mode, and an optional "Protected by OTCaptcha" trust line.
  • A tick and "Verified" when a check passes. The puzzle marks the fit before it closes.
  • A stronger hold fill with a soft pulse, a light vibration where the device supports it, and clear guidance when the hold is released too soon.
  • A drawn puzzle handle that is easier to grab, a mark on the fit and a shake on a miss.
  • On phones the box rises as a sheet from the bottom of the screen. The page behind it is softened.
  • Keyboard: Tab stays inside the box, Escape closes it, and focus returns to where it was.
  • Challenge funnel: the loader reports whether a hold or a puzzle was finished, closed or abandoned, so reports can show what visitors who never reached your server did.
  • Faster on weak devices: background workers start earlier, the fallback when workers are unavailable uses the same fast engine, and verify calls skip a browser round trip.
  • Size: about 12 KB gzipped and under 11 KB with brotli.
1.1.0

First production loader (superseded by 1.2.0)

  • Invisible check first, then press and hold, then slide puzzle, chosen by risk and attack level.
  • Proof-of-work in background workers with a main-thread fallback.
  • Six languages: English, Spanish, Portuguese, Arabic, Hindi and Chinese. Arabic is laid out right to left.
  • Keyboard-operable hold and puzzle, with an alternative check for anyone who cannot drag.
  • The loader reports its version, so a site can tell which build its visitors run.

Service

Changes on our side reach every site at once, whichever loader version it runs.

  • Proof-of-work is split into more, smaller pieces with the same total work, which narrows the spread of solve times. In simulation the slowest 5% of solves on four workers fell from about 1.9 times the typical solve to about 1.3.
  • Precompressed loader files, strong ETags and long revalidation windows when the file is loaded from us.
  • Repeat detection within a day, the drag trace of the puzzle, and the device class of each solve are now measured and recorded. None of them changes a verdict yet.
  • Every record names the scoring version that produced it.
  • Attack episodes are kept as one timeline each, and a weekly report is produced.
  • Faults on our servers are reported to an error tracker without visitor data.
  • Automatic attack mode: two levels, raised by volume or by the share of suspicious solves, eased after ten quiet minutes.
  • Network and browser scores kept separately, with the checks behind each.
  • The service runs in two EU regions behind two load balancers, with a replicated store and automatic failover.