Challenge Types
NexloLabs Verification ships with eight challenge types. All of them are rendered as inline SVG/CSS — no external image assets are loaded.
Every challenge can be used with a difficulty level (easy, normal, hard) via data-difficulty or a site default — see Widget Configuration.
Checkbox (default)
The classic "I'm not a robot" checkbox. Behind the scenes, behavioral signals (mouse movement, interaction timing, entropy) are collected and evaluated.
<div class="nexlolabs-verification" data-sitekey="..." data-type="checkbox"></div>
Best for: forms where you want a visible, familiar proof of humanity.
Image selection (image_select)
A 3x3 grid of colored tiles. The user must click all tiles containing the letter shown in the prompt. The target letter is seeded deterministically from the challenge so that the correct answer can be validated server-side without storing plaintext answers.
<div class="nexlolabs-verification" data-sitekey="..." data-type="image_select"></div>
Best for: high-security actions (login, password reset, payment).
Slider puzzle (puzzle)
A random pattern fills a 320x160 canvas. A gap is cut at a random horizontal offset; the user slides the round piece until the image lines up. The offset is validated server-side with a tolerance of 3px.
<div class="nexlolabs-verification" data-sitekey="..." data-type="puzzle"></div>
Best for: a balance of fun and security.
Math (math)
A two-digit arithmetic problem (e.g. 38 + 57 = ? or 13 × 17 = ?). Fast to solve, harder for naive bots than one-digit math.
<div class="nexlolabs-verification" data-sitekey="..." data-type="math"></div>
Best for: low-friction checks where the checkbox is too trivial.
Character code (code)
Distorted letter sequences — the classic CAPTCHA approach, rendered client-side without external images.
<div class="nexlolabs-verification" data-sitekey="..." data-type="code"></div>
Best for: aggressive bot environments.
Invisible (invisible)
No interaction is required. The widget silently runs a behavioral probe and produces a token when the signals look human. If the signals are ambiguous, it falls back to a visible challenge automatically.
<div class="nexlolabs-verification" data-sitekey="..." data-type="invisible"></div>
Best for: protecting flows where you do not want any visible friction (search, pagination, background checks).
Shape selection (shapes)
A 3x3 grid of six different shapes (circle, square, triangle, star, heart, diamond). The user must click every tile containing the requested shape. On hard difficulty the grid grows to 4x4.
<div class="nexlolabs-verification" data-sitekey="..." data-type="shapes"></div>
Best for: image-select style checks that are easy for humans to recognize.
Vowel counting (vowels)
A German word is shown; the user counts its vowels (a, e, i, o, u, ä, ö, ü). On hard difficulty, longer compound words are used.
<div class="nexlolabs-verification" data-sitekey="..." data-type="vowels"></div>
Best for: language-based checks that are trivial for humans but expensive for bots.
Difficulty
| Difficulty | Tiles / grid | Code length | Math range |
|---|---|---|---|
easy | 6 tiles | 4 glyphs | small numbers |
normal | 9 tiles | 5 glyphs | 10–99 / 10–19 |
hard | 16 tiles | 7 glyphs | 10–99 / 10–19 |
Set per site (dashboard → Site → Challenge settings) or per widget via data-difficulty.
Comparison
| Type | Friction | Security | Use case |
|---|---|---|---|
checkbox | Low | Medium | Contact forms, comments |
image_select | Medium | High | Login, password reset |
puzzle | Medium | High | Registrations, order forms |
math | Low | Low | Quick checks, rate limiting |
code | High | High | High-bot environments |
shapes | Medium | High | Registration, sign-up flows |
vowels | Low | Medium | Comments, quick checks |
invisible | None | Medium | Background protection |
Behavioral signals
Mouse movements are tracked from the moment the widget script loads — not only while a challenge is open. Every challenge (except when solved purely by geometry) collects a behavioral snapshot:
- elapsedMs — time spent between widget load and solve
- moveCount / clickCount / keyCount — interaction volume
- mouseEntropy / keyEntropy — randomness of input patterns
- scrollDepth — page scroll behavior
- linearity — how straight and predictable the mouse path is (1.0 = perfectly straight line)
These are combined with the answer check into a score 0–1. A scripted bot typically scores below 0.3 even when it solves the challenge correctly, because its interaction patterns are not human-like:
- Straight, machine-like paths (
linearityhigh) are penalized heavily. - Single-direction / low-entropy patterns are treated as bot-like.
- Unnaturally fast move bursts reduce the score.
The invisible challenge is rejected outright when the motion is scripted (high linearity with enough samples).
Score thresholds
| Range | Interpretation | Recommendation |
|---|---|---|
| 0.0–0.3 | Very likely a bot | Reject |
| 0.3–0.5 | Suspicious | Require stronger challenge |
| 0.5–0.7 | Probably human | Accept for most forms |
| 0.7–1.0 | Clearly human | Accept |
The threshold is entirely up to you. Start with 0.5 and observe your statistics page.