Under the challenge
Three invisible mechanisms
The visible challenge is only part of the arrangement. Three mechanisms work quietly, each one switchable on its own:
| Mechanism | What it stops |
|---|---|
| Trap field | An invisible field, hidden from screen readers too, that only scripts fill in. |
| Minimum delay | A form sent back in under two seconds was not read by a human. |
| Signed token | Every challenge carries a signed token, valid ten minutes and usable once: a correct answer cannot be replayed. |
One visitor cannot chain attempts indefinitely: past a threshold, they are held off for five minutes. The threshold is stricter on the written challenge, whose answer space is narrower.