Bot protection for the forms bots actually hit

Bad bots are a loop around an HTTP client, pointed at any public form you expose, submitting it faster than a person.

How bad bots find and hit your forms

A few dozen lines of python-requests or headless Chrome, POSTing one path in a loop. At a fraction of a cent per attempt, a one-in-a-thousand yield pays.

What bad bots looks like in your logs

Thousands of POSTs to one path from a few addresses, flat overnight.

Form submissions with no preceding GET, no CSS, JS or image requests.

User-Agents like python-requests/2.31 or Go-http-client/1.1, or none at all.

How PrivCaptcha stops bad bots

Four steps, with the numbers the server uses. Nothing here is configured by you.

No Origin header, no challenge

Once you list your domains, the challenge endpoint checks Origin. No Origin is refused with invalid-input-origin, and a bare curl sends none.

A bare client scores 75 on request one

Starts at 20. +40 bot User-Agent, +15 no Accept-Language. python-requests = 75. Level 4 on the visual path: 10 shapes, 10 degrees, 6 pixels.

Work is paid before the answer is read

At 75 the proof-of-work is 18 bits, 262,000 SHA-256 hashes, checked before the answer. One nonce covers all 3 attempts.

Three wrong answers and it is at 99

Each failure adds 8 points, up to 40, putting the 75-point script at 99: level 5, 12 shapes, 8 degrees, 5 pixels, 20 bits.

What a bad bots run costs now: Tokens die on redemption. 100,000 submissions means 100,000 challenges, each paying hashes before anything is checked: a million at score 94. Quota is charged only on a successful verify, so refused attempts bill zero.

Add PrivCaptcha to your public form or endpoint in two lines of code

Script tag, container in front of the submit button, and your existing verify call. Already on reCAPTCHA or hCaptcha? That backend code stays exactly as it is.

Quickstart guide Widget installation Verify a token

reCAPTCHA siteverify hCaptcha siteverify

Server SDKs

Go Node PHP Python

POST https://privcaptcha.com/api/v1/siteverify

Where it goes

A div with class privcaptcha and your data-sitekey inside the form your logs show being hit.

What the backend does

Read privcaptcha-response from the POST body and call siteverify with your secret before the insert.

The usual mistake

Widget on the page, but the JSON endpoint still takes a plain POST. Require a valid token inside the handler.

What this does not solve about bad bots

This prices only requests through the widget and verify call. It does nothing for endpoints not behind it: APIs, webhooks, feeds. It is not a rate limiter.

Other use cases

Credential stuffing Account takeover Fake signups Spam comments Card testing Scraping Giveaway abuse Ticket scalping Click fraud

Common questions about bad bots

How PrivCaptcha prices bad bots, and what it does not do about it.

No. The challenge only runs where you place the widget, and crawlers do not submit your forms. Indexable pages are untouched - put it on the action you want protected, not on the page around it.

Failures are counted against the daily-rotating hash of that client and push its score up, so the next challenge it receives is harder. A wrong answer costs something, which is what stops unlimited free retries.

Every request is challenged - there is no invisible pass to aim a script at, and no allowlist that skips the check. What changes is the form the challenge takes and what it costs. The server scores each request and picks one of five difficulty levels, so an ordinary visitor gets a couple of seconds and a client that looks automated gets tight tolerances and a heavier proof-of-work. On the non-visual path, taken by screen-reader and keyboard visitors, there is no puzzle to solve at all: the proof-of-work is the whole challenge, at a fixed 22 bits.

No. An address is used for the length of one request and never written anywhere. What we keep is an HMAC of it under a salt that is random, lives only in Redis and rotates every day, so yesterday's hashes cannot be linked to today's. The counters under that hash expire after 24 hours.

Put PrivCaptcha in front of your public form or endpoint

10,000 verifications a month are free, and the integration is the one you already have.

Get started free Read the docs