What is a CAPTCHA; in which protections is it used in TR7?

Short answer

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a verification step presented to tell whether the sender of the request is a human or automation (W3C); instead of blocking the suspicious client directly, it challenges the client, and the user who passes the verification continues to receive the service. In TR7 it is used in four places: in Bot/DDoS protection, the Show Captcha action of the L7 DDoS Protection, IP Reputation Protection and Bot Protection rules uses a single Captcha configuration per vService; in Load Balancer, the Advanced CAPTCHA action shows a CAPTCHA to the requests selected with a condition; in AGS, Account Lockout Policies and Bot Protection Policies ask for a CAPTCHA at login with the provider defined on the CAPTCHA Providers screen; and at the login of the management interface, HTTP(s) CAPTCHA Login Protection on the Management Access screen can also be turned on. In Bot/DDoS protection and in Advanced CAPTCHA, a client that has passed the verification is not asked again for the Captcha Valid for duration (default 24 hours).

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Bot/DDoS Protected vServices → vService → Bot/DDoS Management	Captcha card; the action of the protections is Show Captcha	The CAPTCHA page and duration that the three protections share; HTTP vService only
Bot/DDoS Management → Captcha card → table	Captcha table	Monitoring the sources that cannot pass the CAPTCHA and their numbers of failed attempts in the tracking window; the table is populated only while Quarantine Failed Captcha Solvers is on
Configuration Menu → Load Balancer → Actions (Policy Actions)	Advanced CAPTCHA	Showing a CAPTCHA to HTTP requests selected with a condition
Configuration Menu → AGS → CAPTCHA Providers	Provider: TR7 Captcha, Google reCAPTCHA, hCaptcha, Cloudflare Turnstile	The CAPTCHA provider to be used in the AGS login flow
Configuration Menu → AGS → Account Lockout Policies	Enable Captcha Protection, Captcha Threshold	Asking for a CAPTCHA when the number of failed logins exceeds the threshold
Configuration Menu → AGS → Bot Protection Policies	Action = Captcha	Showing a CAPTCHA when the bot policy is triggered
Configuration Menu → Settings → Device Management → Management Access	HTTP(s) CAPTCHA Login Protection (off by default) and CAPTCHA Difficulty (default Easy)	Asking for a CAPTCHA at TR7 management interface login

• Configuration steps: Can I verify humans with a CAPTCHA?

Common Misconceptions

• "CAPTCHA is a type of blocking." CAPTCHA does not block, it challenges; the client that passes the verification continues. In Bot/DDoS protection, putting clients that repeatedly fail the verification into Quarantine can be added with the Quarantine Failed Captcha Solvers option.
• "CAPTCHA is asked again on every request." In Bot/DDoS protection and in Advanced CAPTCHA, a client that has passed the verification is not asked again for the Captcha Valid for duration.
• "CAPTCHA is also shown on an L7 TCP vService." CAPTCHA is an HTTP page; the Show Captcha action and the Captcha card exist only on HTTP vServices.

How it is done in the documentation

• Captcha · What Is Captcha?
• Advanced CAPTCHA · What Is the Advanced Captcha Action?
• CAPTCHA Providers · What Are CAPTCHA Providers?
• Management Access · CAPTCHA

Related questions

• Can I verify humans with a CAPTCHA?
• What is a bot; how is the difference between a good bot and a bad bot handled in TR7?
• What is a brute-force attack; how does TR7 protect the management interface and applications against it?
• What is Waiting Room; how does it differ from an attack enforcement?