With risk scoring in enforce, a missing or invalid answer from the browser checks (client_tampered) only added to the score. Without any server-side signal that stayed below the interactive threshold, so a script that never ran the page's script, from a clean residential address, still got the pass with the proof of work alone.
Now the answer is required:
- A solve without a valid answer gets the one-click step whatever its score, on the challenge page and in the
managedwidget (non_interactiveandinvisiblewidgets answerinteraction-required). It never blocks on its own. - The click step (after an escalation, in under attack mode with the click, or the widget's) only passes with the answer for that same challenge. Without it, or with one taken from another challenge, it answers
interaction-requiredand no pass or token. - In the widget, an interaction sent with the first solve no longer skips the click step.
- Browsers send the answer by themselves: visitors see nothing new. We checked the challenge page and the widget, with and without the click, in Chrome, Chromium, Firefox, Safari's engine (WebKit) and Brave before turning it on.
- In
logmode both are only counted (escalatedin the Verification analytics). Challenges issued before the browser checks existed are not affected.
Nothing to configure: it follows the zone's challenge.risk mode.