Google’s new reCAPTCHA only appears when a visitor is flagged as risky

Google is making reCAPTCHA – its free service for protecting sites from spam and abuse – a lot more intelligent. It can now distinguish between risky users, such as bots, and trustworthy ones, and give developers control over when to trigger the security guard.

Have you ever wondered how reCAPTCHA works? For millions of visits, it assigns a risk score between 0.0 and 1.0, where lower values indicate higher risk, and 1.0 means the visit is considered safe.

Most of the time, users don’t notice anything and browse uninterrupted, because their scores are above the minimum threshold.

However, if you see the challenge requiring you to prove you’re not a bot, it means that the score is below the threshold set by the website developer.

Last month, Google launched policy-based challenges for reCAPTCHA, which gives site owners precise deterministic control over when to trigger these challenges.

The developer can set a default score threshold to determine when to trigger the puzzles. They can also set different thresholds for various user actions, i.e., requiring lower thresholds for simply visiting the website, but higher thresholds for logging in, adding items to a cart, or completing checkout actions.

“Intelligently apply friction only to suspicious traffic, protecting user experience and your properties,” Google said in the announcement.

“Think of it as a smart security guard. Instead of checking everyone’s ID or no one’s, you can now give the guard a specific rulebook: ‘If someone tries to access a high-value action and they look less trustworthy, then issue a challenge to verify their identity.”

Developers can choose the CAPTCHA challenge difficulty between easy, balanced, and hard – the latter also shows more puzzles.

The changes allow securing high-value actions more aggressively. For example, site visitors who just add items to a cart may be required to solve the CAPTCHA when their score drops below 0.5. However, to prevent fake account creation, a stricter score of 0.2 might be applied for signup, and even higher for checkout.

“Let legitimate users prove they're human when their score is borderline, reducing false positives. Force bots to face a challenge, reducing false negatives,” Google’s blog to developers explains.

Once the user solves the challenge, a token is generated, and the server logic can later confirm whether the user has solved the challenge.

“You can monitor the performance of your policies, including challenge rates and pass/fail trends, directly from the reCAPTCHA dashboard in the Cloud Console,” Google said.

The tech giant expects that policy-based challenges are the “foundation for a more powerful and adaptable approach to abuse prevention.”

In other words, they enable nuanced security strategies tailored to the unique risk profiles of businesses.

Unlock more exclusive Cybernews content on YouTube.