I'm looking at adding ReCAPTCHA to a public facing website. We get significant bot traffic that we want to block. We currently have V3 implemented and logging scores but we are not yet acting on the scores.
We have seen in testing that sometimes legitimate users do get low scores so simply blocking users based on the score is not really an option, we cannot turn away legitimate users so we need to fallback to a challenge when the score is low, however it seems ReCAPTCHA V3 has done away with actual challenges and user interaction entirely?
This seems like a fairly obvious use case however I'm not seeing much about how to do this. I could stick to using V2, however we would still prefer that legitimate users don't see or have to click the checkbox.
Is there a way to show a challenge manually in v3? Should I simply make use of both versions at once, showing the v2 challenge only if the v3 score is low? Use a 3rd party challenge?
It seems google are OK with the idea of using both V2 and V3 at once:
https://developers.google.com/recaptcha/docs/faq#can-i-run-recaptcha-v2-and-v3-on-the-same-page
So this is probably the solution I want.