Wicket

Wicket checks that a person, and not a script, is filling in a form on your site. You add a widget to the page and the widget puts a token in the form. Your server then asks Wicket to verify the token before it accepts the form. Wicket shows no puzzle and sets no cookie (How Wicket works).

Wicket speaks Cloudflare Turnstile's protocol. A site that uses Turnstile moves to Wicket by changing three things: the script address, the widget's class name and the verify address. The token, the callbacks and the answer your server reads keep their shape (Move from Cloudflare Turnstile to Wicket).

A widget is one set of settings for a form, or for several forms on the same sites. It has a name, the hostnames it works on, a mode and an appearance, and two keys:

Site key

The public key your page gives the widget. It starts with wk_, and anyone who views your page can read it.

Secret key

The key your server sends when it verifies a token. It starts with wks_ and belongs in your server's settings, never in a page. We show it once, when you add the widget and when you rotate it. We keep only a fingerprint of it and its first ten characters, so we cannot show it to you again. If you lose it, rotate it.

A challenge is one check of one visitor. The solve rate is the share of challenges that visitors passed.

Wicket never refuses a visitor on a guess. When it is unsure, it asks for a click or for a little more work, and it fails a check only on near-certain evidence (Widget modes).

A widget lists the hostnames of the pages it works on. A hostname covers itself and every name under it: example.com covers www.example.com and shop.example.com, and www.example.com does not cover example.com. A page on any other hostname gets no challenge.

Write each hostname in lower case, with no scheme, port, path or wildcard, and not as an IP address. A name with characters outside the English alphabet is stored in its punycode form. localhost is not allowed: use a test key for a copy of your site on your own computer. When Wicket refuses a hostname, the answer names it and says why.

Wicket costs nothing extra on any plan. It is not a product you order, and it has no price and no add-on. Challenges and verifications are not limited and not charged. Your plan sets how many widgets you can have, how many hostnames each lists, how many days of analytics you can read, and whether a widget can leave out Wicket's name (Wicket limits).

Each widget has numbers for the last 24 hours, 7 days, 30 days, 90 days and 365 days, as far back as your plan reads: challenges started, passed and failed, the share that ticked a box, how many tokens your server verified, and the top hostnames, actions, countries, browsers and operating systems.

A widget needs attention when one of these is true:

• Our team turned it off.
• At least 20 checks passed in 24 hours and your server verified none of the tokens, so the form may not be calling the verify address.
• In 24 hours a challenge came from a page whose hostname the widget does not list.

On an account with a team, the Admin and Technical roles can add, change and delete widgets and rotate keys. The Billing and Read only roles can see widgets and their numbers (Team members).

• How Wicket works: a check from your page to your server, in plain words.
• Add a widget: name it, list its hostnames, choose its mode and save the keys.
• Add Wicket to your site: the script, the container, explicit rendering, several widgets and single-page apps.
• Verify a token on your server: the verify call, the answer, its error codes and how to report a check.
• Widget modes: what a visitor sees in Managed, Non-interactive and Invisible, and how to choose.
• Widget options: every option, callback, function and error code of the widget.
• Test keys: site keys and secret keys for development and automated tests.
• Read a widget's analytics: challenges, passes, verified tokens and the top lists.
• Change a widget's settings: rename, hostnames, mode, appearance, branding, rotating the secret key and deleting.
• Install a widget: the code on the Install tab, ready to paste, and the preview.
• Manage widgets with the API: list, add, change, rotate and delete widgets from a script.
• Move from Cloudflare Turnstile to Wicket: the changes, what stays the same, and an order that leaves no gap.
• Wicket limits: plan limits, rate budgets, sizes and times.
• Wicket and visitor privacy: what the widget reads, what we keep, and for how long.
• Troubleshoot Wicket: what each message in the widget means, and what to do about it.