---
title: Challenge types
description: "The interactive challenges CaptchaLa can show — including the new Shape match, Select all shapes and Picture select types — and how they are chosen."
---

# Challenge types

Most visitors never see a challenge: the risk engine clears low-risk traffic
invisibly (see [How verification works](./how-verification-works)). When a
request does need interaction, CaptchaLa shows one of the challenge types below.
Every challenge is generated fresh for that request.

## Classic types

| Type | What the user does |
| --- | --- |
| Slider | Drag the piece until it fits the gap. |
| Click text / Click shapes | Click the characters or shapes named in the prompt. |
| Rotate | Turn the image until it is upright. |
| 3D click | Click the object described in the prompt in a 3D-rendered image. |
| Trace | Follow a path with the pointer. |
| Games (tic-tac-toe, gomoku) | Win a short game against the computer. |

Games are a light-hearted option shown only to low-risk visitors. If a round ends
in a loss or a draw, the user can choose **Play again** without loading a new
challenge (a few rounds per challenge).

## New interactive types <Badge type="tip" text="SDK 1.3" />

### Shape match

The side column shows two or more small reference shapes. Some of them appear
somewhere in the main picture, rotated or resized; others do not appear at all.

- **Drag mode** — the user drags each reference shape that appears in the
  picture onto its match and leaves the others in place. A shape that was moved
  by mistake can be dragged back into the column. The user presses **Confirm**
  when done.
- **Click mode** — the user clicks every shape in the picture that matches one
  of the reference shapes, then presses **Confirm**. Clicking a selected shape
  again removes the mark.

### Select all shapes

One reference shape is shown. The user clicks every copy of it in the picture
(there can be more than one, and the number is not announced), then presses
**Confirm**.

### Picture select

A grid of hand-drawn pictures with a short instruction such as *"Select
everything that can fly"*. Some prompts include an example picture
(*"Select the ones that move the same way as the example"*). The user clicks
all matching pictures and presses **Confirm**.

### Difficulty

All three types scale with risk: low-risk users get fewer, clearly different
candidates; higher-risk requests get more candidates, closer look-alikes and a
busier picture. Each challenge accepts one answer — a wrong answer loads a new
challenge.

## How a type is chosen

- **Automatically by risk.** The engine selects a type per request and moves to
  stronger types as risk increases (or after a failed attempt). Game types are
  never used as a step-up.
- **Your allowed list.** In the dashboard, an app's **Security Settings → CAPTCHA
  Type Whitelist** limits the engine to the types you select. With nothing
  selected, the engine decides on its own. The new types can be included in the
  list (API value `poly_match`, `poly_select_all`, `sem_select`).

## Challenge types and client compatibility

Shape match, Select all shapes and Picture select need a recent SDK. The Web
SDK, the React/Vue wrappers and the Android, iOS, Flutter and Electron SDKs
load the challenge UI from our CDN, so most integrations pick up the new types
without any change. A client built with an older SDK version — for example an
app release that embeds an older SDK, or a self-hosted or cached copy of an
older SDK build — may not be able to show them.

- **Older clients get a compatible type automatically.** Each client tells the
  server which types it can show. If a selected type is not among them, the
  server uses a compatible type that client can show instead (for example
  Rotate instead of Select all shapes). Users never see a challenge they cannot
  answer or a blank challenge window. Clients with a recent SDK keep getting the
  type you selected.
- **A selected type can also be temporarily unavailable.** In that case a
  compatible type is used as well, and the selected type returns on its own.
- **Billing is unchanged.** A verification that used a compatible type is a
  normal, authorized verification of your app and is billed like any other
  verification. It is not a sign of unauthorized use of your keys.
- **See it in the dashboard.** In **CAPTCHA Logs**, a verification that used a
  compatible type is marked **Compatible type** next to its type, with the
  reason ("The client SDK doesn't support the selected type" or "The selected
  type was temporarily unavailable") and the configured type. You can filter
  the list by this. In the app's **Security Settings**, types that need a newer
  SDK are marked, and the page shows what share of the last 24 hours of
  requests came from clients that support the selected types.

To have every user see the new types, ship an app release built with a current
SDK version. Until users update, they are verified with a compatible type.

On mobile and desktop, the challenge window resizes to fit each challenge.

## Accessibility

Shape match, Select all shapes and Picture select are pointer-based (mouse,
touch or pen). Keyboard and screen-reader users can switch to **audio
verification** with the *"Use audio verification instead"* link under the
challenge. The link is shown when audio verification is available for your app
and `enableVoice` is not turned off in the SDK configuration (see
[Web SDK options](../web-sdk)).