Site Admin help

Keys

Each site has one or two keysets. A keyset is a matched Site Key (public, used in the widget embed), Private Key (used server-side to verify a solved captcha), and Test Key (used for automated testing). Use Generate New Keyset to create an additional keyset for a site, for example to roll keys without downtime by adding a new keyset before retiring the old one. A site can hold at most two keysets at a time.

Site Domains

The production domains where this keyset is allowed to run. Requirements:

• Enter the full domain of the website, not just the root domain (for example www.example.com, not example.com, if that is where the widget actually loads).
• IPv4 addresses are accepted (for example 10.10.10.10).
• No wildcards are allowed here; unlike Site Dev Domains below, every production domain must be listed explicitly.

Getting production and development domains correctly separated matters beyond access control: MTCaptcha’s risk engine learns and profiles traffic patterns per domain to calibrate difficulty, and development/test traffic usually behaves very differently from real production traffic. Mixing them into one bucket makes that profiling less accurate for both.

Site Dev Domains

Also labeled Development & Test Env Domains in the dashboard. Looser rules than Site Domains, since these cover local and staging environments:

• Full domains are accepted (for example test.example.com).
• A single wildcard-prefixed domain is accepted, matching multiple development subdomains at once (for example *.example.com).
• IPv4 addresses are accepted (for example 127.0.0.1), including a single wildcard suffix (for example 192.168.1.*).
• localhost is accepted directly.

Enable Low Friction Fuzzy Match

When enabled, a solve with exactly one incorrect character is still accepted as successful, if the visitor’s calculated risk is very low. Real users mistype occasionally; this setting trades a small amount of strictness for a meaningfully higher first-time pass rate for genuine visitors, without materially helping a script (which isn’t making human-style typos in the first place).

Captcha Text Length

Pro plan and above. The length range of the text challenge, in characters. Default is 4 to 8 characters; this setting allows customizing that to anywhere from a minimum of 3 to a maximum of 10. Note that the Modern Mini form factor supports a maximum of 8 characters regardless of this setting.

Enable JS Config Captcha Text Length

Pro plan and above. Lets the captcha’s character-count range be set at render time via JavaScript configuration, rather than only the fixed range configured above. Useful for sites that already run their own risk scoring and want to drive MTCaptcha’s difficulty from it directly.

Enable Solve Pass

Not currently available in the dashboard - documented here so the page stays accurate if this setting is re-enabled; there is nothing to turn on today. Solve Pass, when live, lets a visitor’s solved captcha remain valid for a configurable duration and number of uses, rather than requiring a fresh solve on every action, with options to also require the pass be used from the same action and the same host it was issued for.

Enable Low Friction Invisible Captcha

Core plan and above. When enabled, the captcha stays invisible for most visitors and is only shown when the risk engine calculates meaningful risk. If you enable this, also consider setting the widget’s loadAnimation parameter to false, since the loading animation has nothing to attach to when the challenge itself never appears for most visitors.

Enable Threat SPECT

Business plan and above. Adds a detailed, actionable risk profile for each visitor: additional risk signals are returned in the CheckToken API response, and corresponding analytics appear in the Admin Dashboard. Use this when you need the reasoning behind a pass/fail decision, not just the decision itself.

Hide Powered by MTCaptcha

Business plan and above. Also labeled Disable Powered by MTCaptcha in the dashboard. Removes the “Powered by MTCaptcha” text from the widget.

Hide Privacy Terms

Business plan and above. Also labeled Disable MTCaptcha Privacy & Terms in the dashboard. Removes the “Privacy & Terms” link from the widget. If you disable this, make sure your own site’s privacy policy already covers what the widget’s linked terms would have disclosed, since removing the link doesn’t remove the obligation to disclose it somewhere.

Enable IP Whitelist Invisible Captcha

Business plan and above. When enabled, visitors connecting from an IP address in the whitelist below always see the captcha as invisible, regardless of the risk engine’s usual calculation. Accepts IPv4 addresses with an optional single wildcard suffix (for example 192.168.1.*), the same format Site Dev Domains uses.

IP Whitelist

The list of IPs this setting applies to, up to 100 entries. Add and remove entries directly on the Site Admin page; this section only controls the invisible-captcha behavior above, not general access to the site.