Sentinel picked up three things this week: two new challenge types, an attack mode you can arm yourself, and a discovery endpoint that stops every integration from guessing what the service supports.
Object Match
A small three-dimensional scene, rendered procedurally on a canvas, containing a handful of solid objects. Two of them match. Select both.
What "match" means rotates. Sometimes the pair shares a shape and differs in colour; sometimes it shares a colour and differs in shape. The wording of the question rotates with it. Nothing about the scene is reused between challenges — the objects, their arrangement, their colours, their angles and their identifiers are all generated fresh, so there is no image library to scrape and no answer key to accumulate.
Every scene is built so exactly one pair qualifies. That constraint is the interesting part of the work, and it holds regardless of which question was asked.
Count Match
A key panel lists a few objects with a required quantity — two of this, one of that. The grid beside it holds a dozen. Select every object the key asks for, in the quantity it asks for.
This one is deliberately harder to automate cheaply, because the answer is a set rather than a click. Selecting everything fails. Selecting most of it fails. A solver has to actually resolve which objects belong and how many there are, and that is more work per attempt than a single-target challenge — which matters more than it sounds, for reasons the research note published alongside this covers.
Colour is randomised across the grid on purpose. The task is recognition and counting, never colour matching.
Both types adapt
Neither type is a fixed difficulty. Scene complexity scales with the risk Sentinel already assesses for the visitor, and both remain fully keyboard-operable with the accessible fallback every visual Sentinel challenge carries.
Attack mode, before the attack
Sentinel raises its own challenge floor when it detects a flood. That has always worked, and it stays free on every plan — including the free tier, because a site's baseline protection is not something worth putting behind a paywall.
The gap was timing. Automatic detection is necessarily reactive: it cannot trip until enough traffic has arrived to look like a flood. Site owners frequently know first — a product launch, a ticket drop, a campaign going out, or an attack already visible in their own logs.
Attack mode can now be raised on demand, from the Sentinel panel or from an API call, scoped to a single site and expiring on its own. Wiring it to your existing alerting means protection can rise the moment your WAF or on-call system notices something, without a person opening a browser.
Raising it makes the challenge harder for everyone, not only attackers, so it is built to be temporary by default. On-demand control needs Sentinel Pro or a membership tier that bundles it. Automatic attack mode does not.
Stop hardcoding our feature list
A new public endpoint reports which challenge types, themes and colour schemes a Sentinel deployment accepts.
This exists because of a real bug we shipped and then had to hunt down across every official plugin. An unrecognised widget type is not an error — it quietly falls back to the site default — so a plugin carrying a stale list keeps appearing to work while silently ignoring the setting. Ours drifted for months, and one value in the list had never been a real challenge type at all. It did nothing, for anyone, and nothing said so.
Every official plugin now reads its options from that endpoint instead of shipping a copy of the list. New challenge types appear in WordPress, Joomla, Drupal and MyBB settings without a plugin update. Where the endpoint cannot be reached, the settings screen falls back to a built-in list and says so rather than pretending.
Requests carrying an unrecognised type now also come back with a warning explaining what happened, instead of failing silently.
Availability
Both challenge types are live for every Sentinel site and are already part of the adaptive rotation. Updated plugins are published to their respective directories.