A challenge sized to the request.

Every request is scored from what it reveals about itself, and the score picks how hard the puzzle is - between levels 1 and 5.

Get started free Read the docs

How it works

Signals, not identity

The user agent, the Accept headers, whether the address looks like a datacentre, and how often that hashed client has failed today. Nothing about who the visitor is.

Decided on the server, always

The client never sends a difficulty and never gets to ask for an easier one. An earlier implementation honoured a difficulty query parameter; that was the cheapest possible bypass and it is gone.

Failure compounds

Wrong answers are counted against a daily-rotating hash of the client and push the next challenge higher. A run of guesses climbs into the tightest tolerances on its own.

What that means concretely

Each of these is a statement about how the product behaves, not a description of how we feel about it.

Five difficulty levels: rotate ±20° down to ±8°, slider ±12px down to ±5px, 5 to 12 shapes.

There is no rule file, signature list or score threshold to maintain.

Nothing to configure: the level follows the score on every request.

Other features

Privacy and GDPR Proof-of-work Accessible challenge Drop-in migration No Google dependency Per-site dashboard

Risk scoring in PrivCaptcha: common questions

What risk scoring actually does, and where it stops.

The score is computed server-side from the request itself and never leaves the server. There is no parameter a page can send to ask for an easier puzzle, which is why we removed the customer-facing difficulty setting too.

No, and we would rather say so plainly. It is a hand-tuned additive heuristic over request signals - headers, how the address presents, and how that client has been doing on recent attempts. Readable rules, no model to explain away.

They still pass. A high score buys tighter tolerances and heavier proof-of-work, not a refusal - the worst case is a slower solve, never a locked-out customer.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

Change two lines. Keep the rest.

10,000 verifications a month are free, and the integration is the one you already have.

Get started free See the migration guide