Release v1.24.0 · WebDecoy/FCaptcha

The widget is now localized, and the checkbox has an accessible name.

Added

34 languages. The widget's five user-facing strings ship translated, bundled rather than fetched. Language is the first of these that names a shipped language: an explicit lang option, data-lang on the container, the page's <html lang>, navigator.language, English. Region tags fall back to their base (de-AT → de); pt-BR and zh-TW have their own entries.
Right-to-left layout for Arabic, Hebrew and Persian — dir="rtl" on the widget root and a flipped row.
strings option to override any key, so a language we do not ship is not a blocker. Overrides are HTML-escaped.
FCaptcha.languages() returns the shipped list; FCaptcha.configure({ lang }) sets a site-wide default.

Shipped: ar bg ca cs da de el en es fa fi fr he hi hu id it ja ko ms nb nl pl pt pt-BR ro ru sk sv th tr uk vi zh-CN zh-TW

The checkbox had no accessible name. role="checkbox" sat beside an unassociated sibling label, so screen readers announced "checkbox, not checked" and nothing else. Now wired with aria-labelledby.
State changes were not announced. Verifying, verified and failed are conveyed by swapping that label's text; the label is now aria-live="polite". The widget root also carries its resolved lang so the label is pronounced correctly.
The widget was served without a charset by the Go and Python servers. A classic script served without one is decoded using the document's encoding, so non-ASCII strings would render as mojibake on any page that is not already UTF-8. Node was already correct.
/api/score now reports the reason for a withheld token, matching /api/verify and the Go server.

No change to detection: bench human false-positive rate 0.00%, agent TPR 97.33%, gate exits 0. Canvas fingerprint inputs are byte-identical.