What the score means
reCAPTCHA v3 returns a score from 0.0 to 1.0, with higher values indicating traffic more likely to be legitimate. Google recommends evaluating scores on your own traffic and initially testing a threshold of 0.5. The response also includes the action and hostname. Read Google's v3 guide.
Your backend turns that score into an action. At a cutoff of 0.5, a score of 0.61 passes. At 0.7, it does not. The score alone does not identify the browser condition that your application wants to accept or reject.
Checking a specific condition
Heretic tests statements that can be checked directly. Does the TCP signature conflict with the claimed operating system? Does a navigator getter accept an object the native getter rejects? Do the page and worker report different timezones?
Each finding has a documented ID, tier, and explanation. An absolute or composite contradiction is conclusive on its own. Conditional observations remain in the response without changing the verdict.
Reading the result
contradicted means a conclusive contradiction was found after
required measurement completed. refused means required measurement
did not complete. uncontradicted means the completed checks found
no conclusive contradiction. It does not certify that the visitor is human.
Save the response with your decision. The finding IDs explain which checks triggered, while the coverage and ruleset version describe the assessment used at the time.
Visitor interaction
reCAPTCHA v3 runs without an interactive challenge. Heretic's collector also runs in the page; your policy can additionally require a phone ceremony. That ceremony needs motion support and a usable passkey flow. Test the completion path with your audience, including visitors who cannot perform the required movement.
Cost and evaluation
reCAPTCHA has a free monthly allowance and paid usage tiers. Check Google's pricing for your volume. Heretic's Developer Sandbox includes 1,000 probes and 1,000 challenges each month.
Evaluate Heretic when your policy needs named browser conditions and device inputs alongside the result. You can apply those findings in your own code without choosing a risk-score cutoff.