# What is Server-Level reCAPTCHA?

## Server-Level reCAPTCHA Protection

### Why use reCAPTCHA at a Server Level?

reCAPTCHA, when implemented on the server, offers more control than most other popular DDoS protection solutions. Legitimate visitors can access the website while malicious actors are stopped, providing a powerful tool to reduce resource usage.   
  
 Application-level reCAPTCHA carries the cost of PHP overhead. LiteSpeed's reCAPTCHA page uses SSI, making it essentially a static page. In addition, reCAPTCHA does not always have to be activated. It can be configured with rewrite rules to activate it selectively by virtual host or even by page. The LiteSpeed implementation uses a sensitivity scale to allow reCAPTCHA to be activated automatically when the server is under heavy load. When the load drops, reCAPTCHA will be disabled, leaving a smooth experience for visitors. A list of "good bots" and an IP whitelist allow for further control when a reCAPTCHA challenge appears.### How Does it Work?

LiteSpeed redirects untrustworthy visitors to a static page when the server detects high load. The static page creates a challenge for the visitor. Upon completion, verification will run through LiteSpeed. LiteSpeed comes with an executable that takes the challenge response and forwards the request to Google. If successful, Google responds with a response header indicating LiteSpeed's success. Future visits from the same customer will not be subjected to further reCAPTCHA checks.   
  
 LiteSpeed rejects failed clients by disconnecting or returning a 403 error.   
  
 With LiteSpeed reCAPTCHA on the alert, attacks are blocked before they have a chance to bring down the server, saving you and your customers the headache and potential lost revenue that downtime brings.