Challenge types

Most visitors never see a challenge: the risk engine clears low-risk traffic invisibly (see How verification works). When a request does need interaction, CaptchaLa shows one of the challenge types below. Every challenge is generated fresh for that request.

Classic types

Type	What the user does
Slider	Drag the piece until it fits the gap.
Click text / Click shapes	Click the characters or shapes named in the prompt.
Rotate	Turn the image until it is upright.
3D click	Click the object described in the prompt in a 3D-rendered image.
Trace	Follow a path with the pointer.
Games (tic-tac-toe, gomoku)	Win a short game against the computer.

Games are a light-hearted option shown only to low-risk visitors. If a round ends in a loss or a draw, the user can choose Play again without loading a new challenge (a few rounds per challenge).

New interactive types SDK 1.3

Shape match

The side column shows two or more small reference shapes. Some of them appear somewhere in the main picture, rotated or resized; others do not appear at all.

• Drag mode — the user drags each reference shape that appears in the picture onto its match and leaves the others in place. A shape that was moved by mistake can be dragged back into the column. The user presses Confirm when done.
• Click mode — the user clicks every shape in the picture that matches one of the reference shapes, then presses Confirm. Clicking a selected shape again removes the mark.

Select all shapes

One reference shape is shown. The user clicks every copy of it in the picture (there can be more than one, and the number is not announced), then presses Confirm.

Picture select

A grid of hand-drawn pictures with a short instruction such as "Select everything that can fly". Some prompts include an example picture ("Select the ones that move the same way as the example"). The user clicks all matching pictures and presses Confirm.

Difficulty

All three types scale with risk: low-risk users get fewer, clearly different candidates; higher-risk requests get more candidates, closer look-alikes and a busier picture. Each challenge accepts one answer — a wrong answer loads a new challenge.

How a type is chosen

• Automatically by risk. The engine selects a type per request and moves to stronger types as risk increases (or after a failed attempt). Game types are never used as a step-up.
• Your allowed list. In the dashboard, an app's Security Settings → CAPTCHA Type Whitelist limits the engine to the types you select. With nothing selected, the engine decides on its own. The new types can be included in the list (API value poly_match, poly_select_all, sem_select).

Challenge types and client compatibility

Shape match, Select all shapes and Picture select need a recent SDK. The Web SDK, the React/Vue wrappers and the Android, iOS, Flutter and Electron SDKs load the challenge UI from our CDN, so most integrations pick up the new types without any change. A client built with an older SDK version — for example an app release that embeds an older SDK, or a self-hosted or cached copy of an older SDK build — may not be able to show them.

• Older clients get a compatible type automatically. Each client tells the server which types it can show. If a selected type is not among them, the server uses a compatible type that client can show instead (for example Rotate instead of Select all shapes). Users never see a challenge they cannot answer or a blank challenge window. Clients with a recent SDK keep getting the type you selected.
• A selected type can also be temporarily unavailable. In that case a compatible type is used as well, and the selected type returns on its own.
• Billing is unchanged. A verification that used a compatible type is a normal, authorized verification of your app and is billed like any other verification. It is not a sign of unauthorized use of your keys.
• See it in the dashboard. In CAPTCHA Logs, a verification that used a compatible type is marked Compatible type next to its type, with the reason ("The client SDK doesn't support the selected type" or "The selected type was temporarily unavailable") and the configured type. You can filter the list by this. In the app's Security Settings, types that need a newer SDK are marked, and the page shows what share of the last 24 hours of requests came from clients that support the selected types.

To have every user see the new types, ship an app release built with a current SDK version. Until users update, they are verified with a compatible type.

On mobile and desktop, the challenge window resizes to fit each challenge.

Accessibility

Shape match, Select all shapes and Picture select are pointer-based (mouse, touch or pen). Keyboard and screen-reader users can switch to audio verification with the "Use audio verification instead" link under the challenge. The link is shown when audio verification is available for your app and enableVoice is not turned off in the SDK configuration (see Web SDK options).