Stop bots without punishing real people.

Add one script tag and we score every visit to your site. Before a login, a checkout or an API call, your server asks us and gets a plain answer: allow or block.

Start freeRead the quick start
Incoming visitorsWhat we tell your server
Allowed
2,904
Challenged
382
Blocked
361

Works with the stack you already use

  • Next.js
  • Express
  • Laravel
  • React
  • Vue
  • Angular

The trouble with CAPTCHAs

CAPTCHAs assume a computer can't pick out traffic lights or read wobbly text. These days it can, and cheaply. The bots in our adversary lab get past reCAPTCHA, hCaptcha, Turnstile and every other commercial CAPTCHA we've tested.

  1. 2000sSolved by bots

    Wobbly text

    Computers couldn't read warped letters. By 2014, they read them better than people did.

  2. 2014Solved by bots

    Pick the pictures

    Computers couldn't recognise things in photos. Now image models solve these as easily as you do.

  3. 2018Solved by bots

    The invisible check

    It looks for a browser that isn't quite right. Bots now drive real Chrome from home IP addresses.

  4. 2020sSolved by bots

    Proof of work

    Every visitor does some math, which should cost bots more. A server does it for almost nothing.

  5. Botardo

    The whole visit

    We look at everything a visitor does and ask most people nothing. A bot has to fake the whole visit, not one answer.

Every CAPTCHA you show is a chance for a customer to give up and leave. So most of your visitors never see one. We only challenge a visitor when we can't tell either way.

How a score is made

Bot risk runs from 0, clearly a person, to 100, clearly a bot. Our layers weigh what they actually saw of the visit, and anything they couldn't see doesn't count either way.

  • A regular customer4
  • A first-time shopper11
  • Someone on a VPN20
  • Unusual for your site56
  • A cloud server's connection64
  • A script in a real browser95
  • A scraper with no browser99

Evidence leans both waysWhat looks like a person pulls the number down. What looks like a machine pushes it up.

Unseen means uncountedIf a layer saw nothing, it stays out of the sum. Nobody is marked down for what we missed.

Clear signs set a floorA clear sign of automation puts the risk near 100, however human the rest looks.

Your traffic isn't average. Your detection shouldn't be either.

Things that look odd on most checkouts can be perfectly normal on yours.

  1. 1
    Two-step checkout

    Most stores check out on one page. Yours has always used two.

  2. 2
    Coupon before address

    Rare on other stores. Six in ten of your customers do it.

  3. 3
    41 s on checkout

    Slow for most stores. Here it's about average.

A global model
64Challenge
Your modelPro
16Allow

Let us handle it, or do it yourself.

Turn on form protection and we take care of your forms, challenges included. Or ask for tokens from your own code, wherever you need a decision.

  1. Automatic

    Form protection

    One attribute and we take it from there: every form on the page, the token on submit, a challenge for anyone we can't decide on. Only want some forms covered? Call botardo.protect(form) on those.

    index.html
    <script
  src="https://cdn.botardo.com/v1.js"
  data-site="YOUR_SITE_KEY"
  data-form="true"
  defer
></script>
  2. Manual

    Your code, any request

    Ask for a token before any request you want protected: a login, a checkout, an API call. If we can't tell yet, the visitor is challenged first and the token arrives once they pass.

    login.js
    // Challenges the visitor first if we can't tell yet.
const token = await botardo.token();

await fetch("/api/login", {
  method: "POST",
  headers: { "x-bot-token": token },
  body,
});
  3. Your server

    Verify on your server

    Trade the token for allow or block, and reject on block. A bot risk from 0 to 100 comes with it, for logging or extra care on sensitive actions.

    route.ts
    import { sentinel } from "@botardo/server";

export async function POST(req) {
  const { decision } =
    await sentinel.verify(req.headers["x-bot-token"]);

  if (decision === "block") return reject();
  // handle the request
}

Free, until you outgrow it.

Every plan covers every page on every website.

10,000

One decision is one token your server verifies. Page views don't count.

Standard

$0a month

10,000 decisions included, then $5 per 10,000.

Start free
  • Global model on every session
  • Allow or block on every verify
  • Form protection, fully automatic
  • Unlimited challenges
  • Unlimited websites, pages and forms

Pro

Includes your model
$199a month

500,000 decisions included, then $5 per 10,000.

Start with Pro
  • Everything in Standard
  • A model trained on your own traffic, retrained weekly
  • Drift detection and A/B-aware retraining
  • Fewer challenges for your real visitors
  • Priority support on Slack

Over 10M decisions a month? We'll price your volume on an annual plan, with a DPA or MSA if you need one.

Talk to sales

Questions

More in the docs. If yours isn't here, ask a person.

Will it block real people?

We only tell you to block when we find clear signs of automation, never on a guess. If someone looks a little unusual, or barely touched the page before logging in, we challenge them instead, and once they pass they get through. Before any detection rule goes live, we test it against real people on ordinary browsers.

Can I try it before it affects anyone?

Yes. Turn on monitor mode and verify answers allow to everything, nobody is challenged, and the Console shows what we would have done. We'd suggest leaving it on for your first week. When you're happy, switch to enforcing in the Console, with nothing to redeploy. That's also where you set how readily we challenge people. It never changes what gets blocked.

We use reCAPTCHA today. What changes?

Most of your visitors stop seeing puzzles, because we only challenge the ones we can't make up our minds about. You also stop tuning a score threshold, since verify gives you allow or block. If you log the risk that comes with it, it runs the other way from reCAPTCHA's score, with 0 for a person and 100 for a bot. You don't need a CAPTCHA of your own on top. If you'd rather keep another provider's, talk to us.

Can't a bot just pay someone to solve the challenge?

That's how bots get past reCAPTCHA and the others today. They send the puzzle off to a solving service, and a person or a model somewhere else answers it for a fraction of a cent. We built our own way of telling when a challenge was solved somewhere other than the visitor's browser, and when we see it, it goes into the decision we give you.

What if the snippet doesn't load?

Then there's no token, and verify answers block. A bot that skips the snippet looks exactly the same, so letting those requests through would let any bot in. Verify also tells you the token was missing, so if ad blockers worry you, you can send those visitors to a check of your own, like an email confirmation, instead of turning them away.

Why doesn't verify say why someone was blocked?

Because every explanation is a hint for whoever builds the next bot. Every customer gets the same thing back, a decision and a risk, and nothing more.

What do you bill for?

Decisions. Each token your server verifies counts once, whether we say allow or block. Page views, challenges and tokens you never verify don't add to your bill, and neither do missing or reused tokens, so a bot that skips the snippet never shows up on it.

Does it work with single-page apps?

Yes. The session follows the visitor through client-side navigation, botardo.token() works from anywhere in your app, and form protection picks up forms that appear after the page loads. React, Vue, Angular and plain JavaScript all work with no extra setup.

Will it slow my site down?

No. The snippet loads with defer, so your page never waits for it. Asking for a token is one round trip from the browser, usually well under a second, before your request goes out. Checking it from your server is one more quick call.

What do you do with the data you collect?

We use it to score sessions and improve detection, and we delete the raw signals seven days after a session starts. We never read what anyone types, in any field, and never use any of it for advertising. On Standard, your traffic helps train our global model. On Pro, it trains only your own model and never goes into the global one. We're GDPR compliant and sign a DPA if you need one.