Introduction

botbar keeps bots off your forms. Most visitors pass without noticing: their browser does a few hundred milliseconds of proof of work while the widget collects signals about the browser. Only suspicious visitors get a puzzle, and the most suspicious get a live challenge streamed from the server.

How it worksCopy Anchor Link

1. Your page loads api.js. The widget runs in its own iframe.
2. The browser solves a proof of work and reports signals: is it automated, headless, patched, or consistent with the request?
3. The server scores the visit. A good score gets a token straight away; a doubtful one gets a puzzle; a bad one fails.
4. The token lands in your form as botbar-response. Your server sends it to siteverify with your secret.

Siteverify takes the same request and returns the same response as Turnstile and reCAPTCHA, plus a score and an agent field, so switching is a small change.

Start hereCopy Anchor Link

• Quickstart: a protected form in five minutes.
• Migrate from reCAPTCHA, Turnstile or hCaptcha.
• Test keys for local development and CI.