• Detection improvements

• Add enriched headers to challenged and allowed requests

• Add support for custom fields on payloads using configurable request headers

• Omit undefined fields from the JSON payload to the Account Protect API

• Collect custom fields UserID and ProductID

• Bundle optimisation

• Collect custom fields UserID and ProductID

• Collect new business data to enrich detection models (accountType, failReason, customFields)

• Collect custom fields UserID and ProductID

The target date announced here has been updated in order to leave more time to make the required change.

New target date

Monday, May 4, 2026

Required change (reminder)

If you are using the frame-src directive in your Content-Security-Policy headers with a direct reference to geo.captcha-delivery.com, you will need to proceed with the change below:

• ❎ Before: frame-src geo.captcha-delivery.com
• ✅ After: frame-src *.captcha-delivery.com

Without this change, some of your end users might experience issues with displaying response pages in case of false positives.

Reference documentation: JavaScript Tag