GR8 Faucet Script: Configure CAPTCHA Providers

These instructions apply to GR8 Faucet Script 70.1.81. The controls described are in your own installation; this public guide does not grant administrator access.

System → Security → CAPTCHA applies to every faucet in this installation. Keep an administrator session open while testing public protection. Saving credentials is not proof that a provider accepted a challenge.

Before You Start

Use a provider account and a registration named for this product, restricted to this installation’s hostname. Do not reuse another project’s keys. Enable any of the three supported providers after saving its matching keys. Automatic policies choose one enabled provider for each fresh challenge; Dropdown lets the visitor choose. Visitors complete only the selected provider’s challenge, not all three.

Register A Provider

Open Cloudflare Turnstile Console

Create a widget for the product, allow its hostname and use Managed mode. Use the widget’s matching Site Key and Secret Key.

Read Turnstile Setup

Open Google reCAPTCHA Console

Register the hostname for the supported reCAPTCHA v2 checkbox. A v3 score key is not compatible with this installed adapter.

Read reCAPTCHA v2 Documentation

Open hCaptcha Console

Create the site’s registration and allow the hostname. Copy its Site Key. Obtain the matching Secret Key from account settings; rotating an account secret can affect other registrations.

Read hCaptcha Setup

Save Credentials And Choose Providers

1. Open the CAPTCHA tab and choose Edit in the provider’s row. Its setup alert links to the correct console.

2. Paste the public Site Key and matching private Secret Key into their separate fields. Do not put a secret in Site Key.

3. Secret Saved confirms storage. Leave a replacement blank to keep it; changing Site Key requires its matching Secret Key. Show/Hide reveals only the replacement you enter.

4. Choose Save Credentials. Selection is unchanged. Correct field errors and reload after a changed-settings warning.

5. Enable the intended provider in the table after both keys are saved. Disabled providers keep their credentials. Saved Secret Unavailable means the installation cannot use that secret; enter a valid replacement before enabling.

6. Keep at least one usable provider enabled. Use Move Up or Move Down before Edit to set the complete saved order, including disabled rows. Moves save immediately and do not change credentials or enablement.

7. Click Policy: followed by the current mode. Priority uses the first enabled, configured provider in saved order. Round Robin cycles through enabled providers for fresh challenges. Random selects an enabled provider randomly. Dropdown first shows Select CAPTCHA and loads the visitor’s chosen provider. Save the intended policy; rotation distributes challenges and is not stronger verification.

8. In Dropdown mode, selecting another provider discards the earlier challenge response. Provider names in the administrator table open their websites through GR8; use Edit for credentials and the separate console link in its setup alert.

9. New installations use Priority. Upgrading older Primary/Secondary settings keeps their effective enabled choices and order as Priority; an explicitly saved policy is never replaced automatically.

Verify And Troubleshoot

1. Open the affected public sign-in or pre-claim flow in a separate session. Confirm the intended widget loads, then complete a fresh challenge and check server verification. Do not claim or pay out merely to check these settings.

2. Invalid key or domain: check the provider type, hostname allowlist and matched key pair. Server verification failed: check the secret and provider status.

3. Keep the last working registration until the replacement is verified. Unselecting a provider preserves its saved credentials.

Each challenge stays bound to the provider and configuration that issued it. A failed challenge does not try another provider. If settings change while a challenge is open, refresh it before trying again. An incomplete enabled pool or invalid saved policy blocks the flow rather than silently changing providers. Keep Secret Keys, challenge tokens and session data out of support posts and screenshots.

Provider setup documentation checked: October 6, 2026. These instructions describe the installed adapters, not an unimplemented API or verification mode.