May be some useful datapoints in the JSON blob returned by the request to https://hcaptcha.com/siteverify
https://docs.hcaptcha.com/#verify-the-user-response-server-side
{ "success": true|false, // is the passcode valid, and does it meet security criteria you specified, e.g. sitekey? "challenge_ts": timestamp, // timestamp of the challenge (ISO format yyyy-MM-dd'T'HH:mm:ssZZ) "hostname": string, // the hostname of the site where the challenge was passed "credit": true|false, // optional: deprecated field "error-codes": [...] // optional: any error codes "score": float, // ENTERPRISE feature: a score denoting malicious activity. "score_reason": [...] // ENTERPRISE feature: reason(s) for score. }
Specifically, that score and score_reason...