Under Attack Mode (UAM) vs CAPTCHA — Dstat comparison

Under Attack Mode (UAM)

• Silent JavaScript challenge, no user action.
• Stops most simple bots automatically.
• Can be bypassed by headless browsers that run JS.

CAPTCHA

• Requires explicit human interaction.
• Stronger against automation than a JS challenge.
• Adds visible friction for legitimate users.

What the bypass line shows for each challenge

With Under Attack Mode enabled, the Dstat shows a high incoming line and a bypass line that drops within seconds of the test starting. Requests from clients that cannot execute JavaScript never reach the origin, so they count as blocked or challenged rather than bypassed.

With a CAPTCHA (managed challenge) in place, the bypass line is usually lower still, because passing requires interaction that scripted clients cannot supply. The trade-off is visible on the passed side: legitimate first-time visitors also appear only after they have solved the challenge.

Choosing between UAM and CAPTCHA

UAM suits sites that need broad, low-friction protection: it is transparent to browsers, requires no user action and removes most scripted traffic. Its limit is headless browsers that execute JavaScript; when the Dstat bypass line stays elevated under UAM, that is the usual cause.

CAPTCHA suits paths where the cost of a bypass is high — login, checkout, expensive API calls — and where users accept a one-time interaction. Applying it site-wide raises abandonment, so the common pattern is UAM as the default with CAPTCHA escalated on specific paths or during an active attack.

Takeaway

UAM is a good default for transparent protection; escalate to CAPTCHA when automated bypass traffic stays high.