| Cooldown | 120s base → ×2 per retry during lockout → capped at 3600s |
| Challenge fallback | BypassBehavior, window 120s, tolerance 6px |
| Min fill time | 3000 ms |
| Require mouse movement | True |
| Anomaly trigger threshold | 0.75 |
| Response mode | TooManyRequests429 |
| Behavior memory TTL | 3600 s |
| Honeypot field | cw_hp_email |
| Nonce TTL | 300 s |
A behavior_flagged rejection right after a successful submit means the
cooldown above is active — each retry during the lockout extends it. Wait it out
(the AJAX/fetch demos show the remaining seconds), or lower
CWaptcha:Behavior:CooldownSeconds in appsettings.json while testing.