With risk scoring in enforce, the challenge page applied its solve-time score only to block. A page issued below the interactive threshold handed out the pass even when the solve itself (the browser checks failing, or missing because the client never ran the page's script) pushed the score to interactive. With the block level off, a script that solved the proof of work without a browser got through.
Now that solve gets no pass: the page turns into the one-click step in place, with a new challenge and no reload, and the pass comes after the click. The managed widget already worked this way.
- A browser whose checks are clean sees nothing new.
- A browser that only trips the browser checks (DevTools open, an extension that patches functions) sees the checkbox, never a block: those checks alone are capped at the interactive threshold.
- A client that never runs the page's script never gets a pass without the click.
- In
logmode nothing changes;escalatedin the Verification analytics now also counts these solves (inlog: would have been). - Under attack mode with its own click is unchanged.
Nothing to configure: it follows the zone's challenge.risk mode and interactive threshold.