Developer documentation

Content Security Policy

CDPCaptcha uses no iframe and no inline script.
If your site sends a Content-Security-Policy, allow the script and stylesheet host, the API host for fetch, and blob: workers (the solver runs in a Web Worker created from a blob URL).

HTTP
Content-Security-Policy: default-src 'self';
  script-src 'self' https://cdpcaptcha.com;
  style-src 'self' https://cdpcaptcha.com;
  connect-src 'self' https://cdpcaptcha.com;
  worker-src 'self' blob:;

If worker-src cannot be allowed, the widget falls back to solving on the main thread.
That works, but the page is less responsive during the computation.

If you self-host the two asset files on your own origin, only connect-src for the API host and worker-src blob: remain.

← LanguagesAutomated testing →