FAQ

Do I have to use Botardo with forms?

No. Botardo scores sessions, not forms. Ask the snippet for a token with botardo.token() wherever you need a decision and verify it on your server: a login, a checkout, an API call, a comment, an account creation.

Form protection is a separate switch for teams that want their forms handled without writing that code. It attaches to forms, sends the token on submit, and challenges sessions we can't decide on.

Do I need my own CAPTCHA?

No. We challenge visitors ourselves. Form protection and botardo.token() both do it when we can't tell yet whether a session is a person, and resolve once the visitor passes. See when we can't tell yet. Only those sessions are ever challenged, and our challenge sees the whole session, not just the puzzle, so it's much harder to farm out than a CAPTCHA on its own.

If you'd rather use another provider's CAPTCHA, talk to us.

Can't a bot just pay someone to solve the challenge?

That's how bots get past reCAPTCHA and the others today. They send the puzzle off to a solving service, and a person or a model somewhere else answers it for a fraction of a cent. We built our own way of telling when a challenge was solved somewhere other than the visitor's browser, and when we see it, it goes into the decision verify gives you.

Does Botardo work with single-page apps?

Yes. The session follows the visitor across client-side navigation, and botardo.token() works from anywhere in your app. With form protection on, the snippet auto-discovers forms added to the DOM after initial page load using a MutationObserver. React, Vue, Angular, and plain JavaScript SPAs all work without additional configuration.

What counts as a session?

One page load. A session starts when the snippet loads and covers everything on that page, including client-side navigation in a single-page app. The next full page load, or a new tab, starts a new session.

What do you bill for?

Decisions. A decision is one token your server verifies, and each token counts once, whether verify says allow or block. Page views, challenges and tokens you never verify aren't billed, and neither are verifies that return token.invalid or token.reused, so a bot that skips the snippet never shows up on your bill. See pricing for what each plan includes.

Can I ask for more than one token per session?

Yes. Each call to botardo.token() scores the session as of that moment and returns a fresh single-use token that expires after 2 minutes. Ask for one per request you want scored. Verifying the same token a second time returns the status token.reused and the decision block.

What happens if the snippet fails to load?

If the CDN is unreachable, the snippet silently fails and no token is available. Verify answers a missing token with the status token.invalid, no risk, and the decision block. That's the same result a bot that skips the snippet would get, and we can't tell the two apart — see why sessions start at 100. Letting those requests through would let any bot in.

**Note:** A CDN outage or an aggressive ad blocker can stop the snippet loading for a real visitor. If you'd rather not turn those visitors away, check for `status === "token.invalid"` and send them to a check of your own, such as an email confirmation, instead of rejecting outright.

Does Botardo block real users?

Botardo never blocks anyone itself, and we only tell you to block when we find clear signs of automation, never on a guess. When there's little to go on, for example someone who barely touched the page, the visitor is challenged instead, as many times as it takes, and then gets through. You choose how readily we ask in the Console, and monitor mode lets you watch what we'd do before it affects anyone. Before any detection rule goes live, we check it against real people using ordinary browsers.

Why doesn't verify tell me why a session was blocked?

Because every explanation is a hint for whoever builds the next bot. Verify returns a decision and a risk, and nothing else, to every customer.

Is Botardo GDPR compliant?

Yes. The snippet never reads form data: no field values, no typed characters, no record of which keys were pressed, no clipboard contents. Raw signals are deleted seven days after a session starts. Our privacy policy lists everything the snippet collects, and we sign a DPA on request. Since the snippet reads information from your visitors' devices, check whether your local ePrivacy rules need you to ask for consent.

What latency does it add?

Asking for a token is one round trip, usually well under a second (plus the challenge itself, for the few visitors we challenge), and it happens in the browser before your request goes out. botardo.token() never waits for queued events to upload; they go out alongside it. The sentinel.verify() call on your server typically resolves in < 5 ms from a co-located region.

Can I use Botardo without a server?

No. The token never carries the result, so neither the browser nor a bot running in it can read it. Your server trades the token for a decision with your private site key. If you only want to watch your traffic for a while, turn on monitor mode.