ShieldGate Docs

Traffic control

Challenges and CAPTCHA

Challenge gate and CAPTCHA provider hooks for suspicious clients.

Goal

Present challenges instead of immediate blocks when risk is uncertain.

Prerequisites

  • Challenge providers configured (Advanced → Challenges).
  • Optional webhook plugin for custom challenge flows.

Steps

  1. Register a challenge / CAPTCHA provider (console + plugin settings as required).
  2. Use policy actions Challenge or CaptchaHook, or enable bot enforcement that issues challenges.
  3. Publish and test with a client that should be challenged.

Pipeline position

ChallengeGate runs after rate limiting and before policy evaluation—failed challenges never reach upstream.

Verify

  • Challenged clients see the challenge UX / response.
  • Successful solve proceeds to upstream.
  • Provider outages: understand fail-open vs fail-closed for your provider settings.