Control panel

Set the truth here first. Then run Witness and see whether its report says the same thing.

CAPTCHA

interactive forces a real challenge, which is what the hands step is for. block can never be solved, so every session must be recorded as failed.

Email verification

test = code is always 000000 and is printed on the page. live = a real email through Resend, capped at 100 a day.

Phone code, % of logins

Chosen from the address itself, so the same identity always behaves the same.

Added delay, ms

Every request waits this long before anything happens.

Jitter, ms

A random extra 0 to n on top, so the numbers are not suspiciously flat.

Hard failure, % of posts

An honest 500. Witness should record these as failures.

Silent failure, % of signups

The important one. The page says Welcome, no account is made, no session is set. Set this to 20 and any tester that still reports 100% passed is lying to you.

Live Turnstile sitekey

Only for CAPTCHA = live. Leave blank and live mode blocks everything rather than quietly letting it through.

Password for this page

Blank leaves /lab open, which is fine for a testbed. Set one and every /lab address needs ?k=that. Write it down — nothing else shows it.

3 accounts · 11 requests logged · what the server saw · empty the database