Blog
Critical PHP flaws: update PHP on your WordPress site now
Two critical PHP flaws disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a server without logging in. Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Here is how to check, how to update, and what to do if you can't yet.
Chris Taylor
6 min read
Latest articles
AI agent identity: knowing which agent is calling, and why that is only half the problem
Agent identity is becoming solvable: signed requests, published key directories, authorisation mandates. A verified agent can still buy all your inventory, so identity is the foundation and not the answer.
Chris Taylor
ChatGPT Atlas has been discontinued: what replaced it and what it means for your site
OpenAI switched Atlas off on 9 August 2026, 292 days after launch. The browser is gone, the agentic traffic is not, and the replacements reach your site from different places.
Chris Taylor
Perplexity Comet: what an agentic browser does to your site, and the court case about it
Comet is free on every platform and its agent acts on sites for a real user. Amazon sued over exactly that, won an injunction, then lost it on appeal. The access question is now a live legal one.
Chris Taylor
Privacy & compliance
PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own
Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.
Chris Taylor
Procaptcha vs reCAPTCHA 2026: Data Controller, Pricing & Catch Rate
Procaptcha and Google reCAPTCHA compared on the 2026 controller-model change, free-tier terms, catch rate against modern solvers, and cost above 100K assessments. Where each fits, and where they differ.
Hugh Parry
Procaptcha vs Cloudflare Turnstile 2026: GDPR, Catch Rate & Lock-in
Procaptcha and Cloudflare Turnstile compared on GDPR posture, catch rate against stealth headless bots, vendor lock-in and free-tier terms. Where each fits, and where they differ.
Hugh Parry
Live events & ticket bots
How to Stop Ticket Scalping: The 2026 Anti-Bot Playbook
How to stop scalpers and stop scalping in 2026 — block scalper bots, residential proxies and bulk signups at the queue, ticket page, drop API and CDN edge.
Chris Taylor
Oklahoma SB 1241: New Laws to Stop Ticketing Bots and Protect Fans
Oklahoma SB 1241 bans ticketing bots and forces price transparency — what the law requires, and how Procaptcha blocks scalper automation for compliance.
Hugh Parry
🎫 Preventing Ticket Bots - The Battle for Fair Access
Ticket bots continue to plague the live event industry in 2026, frustrating fans and inflating prices. Discover the latest strategies to prevent them.
Chris Taylor
Technical deep dives
How to Stop PHP Form Spam (Without a Plugin)
If your PHP mail script is being abused by bots, stop the bot before mail() runs — server-side CAPTCHA verification in a few lines of PHP, via Procaptcha.
Chris Taylor
Faking browsers is easy — but not at scale
131,819 residential US IPs threw 1.4M brute-force attempts at one mobile-only customer in 30 days — all collapsing onto a handful of fingerprints.
Chris Taylor
How to Add CAPTCHA to Fastly CDN
Learn how to integrate Procaptcha with Fastly CDN to protect your website from bot attacks while maintaining performance and user privacy.
Chris Taylor
CAPTCHA fundamentals
Learn the basics from the team building the next generation.
PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own
Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.
Chris Taylor
Procaptcha vs reCAPTCHA 2026: Data Controller, Pricing & Catch Rate
Procaptcha and Google reCAPTCHA compared on the 2026 controller-model change, free-tier terms, catch rate against modern solvers, and cost above 100K assessments. Where each fits, and where they differ.
Hugh Parry
Procaptcha vs Cloudflare Turnstile 2026: GDPR, Catch Rate & Lock-in
Procaptcha and Cloudflare Turnstile compared on GDPR posture, catch rate against stealth headless bots, vendor lock-in and free-tier terms. Where each fits, and where they differ.
Hugh Parry
All articles
AI agent identity: knowing which agent is calling, and why that is only half the problem
Agent identity is becoming solvable: signed requests, published key directories, authorisation mandates. A verified agent can still buy all your inventory, so identity is the foundation and not the answer.
Chris Taylor
ChatGPT Atlas has been discontinued: what replaced it and what it means for your site
OpenAI switched Atlas off on 9 August 2026, 292 days after launch. The browser is gone, the agentic traffic is not, and the replacements reach your site from different places.
Chris Taylor
Perplexity Comet: what an agentic browser does to your site, and the court case about it
Comet is free on every platform and its agent acts on sites for a real user. Amazon sued over exactly that, won an injunction, then lost it on appeal. The access question is now a live legal one.
Chris Taylor
MCP security: the five ways agent tool access goes wrong
MCP turns tool descriptions into model context, which makes the integration layer an attack surface. Tool poisoning, confused deputy, token passthrough, SSRF and rogue servers are the five that matter.
Chris Taylor
x402 and agent payments: what a machine-payable endpoint means for your site
x402 revives HTTP 402 so an agent can pay for a request in stablecoins and retry it. That turns abuse into a priced transaction, and it does not decide who is allowed to buy.
Chris Taylor
llms.txt: we publish one, and no AI crawler has ever read it
We have published an llms.txt since May 2026. Across four days of IP-verified logs, AI crawlers fetched our robots.txt 120 times and our sitemap 43 times. They fetched llms.txt zero times.
Chris Taylor
Agentic browsers: your customer is now a robot, and that is fine
An agentic browser is automation operated by a real customer. It fails every classic bot test and still deserves to reach your checkout. The answer is to require evidence of a human on particular steps, rather than to judge the client.
Chris Taylor
OWASP API Security Top 10: which two a bot layer actually fixes
Eight of the ten risks in the 2023 OWASP API Security Top 10 are authorization and inventory bugs only your own code can fix. API4 and API6 are the two where a bot-protection layer is the right tool.
Chris Taylor
Why Do Bots Fill Out Forms? The Economics of Form Spam and How to Stop It
Why do bots fill out forms? For free advertising, credential stuffing, signup-credit abuse, SEO laundering through expired domains, and reconnaissance. Here is how each one works, and how Prosopo blocks them at the form-submission layer.
Chris Taylor
What is WAAP? Web Application and API Protection explained
WAAP means Web Application and API Protection: a WAF, DDoS mitigation, bot management and API protection sold as one cloud service. The bot component is the one to scrutinise, because it needs signals a network vendor has no reason to collect.
Chris Taylor
Web Bot Auth: signed agents solve identity, not intent
Web Bot Auth lets an AI agent cryptographically sign its requests so you can verify who it is. That fixes user-agent spoofing and leaves the harder question untouched: a verified agent can still be doing something you do not want.
Chris Taylor
OWASP automated threats: the 21 names your vendor should be using
The OWASP Automated Threat Handbook gives every bot attack a vendor-neutral name and an OAT number. The full taxonomy, the five that cost the most money, and how to use it in an RFP.
Chris Taylor
Gartner and bot management: the Magic Quadrant that does not exist
There is no Gartner Magic Quadrant for bot management. There is one for Cloud WAAP, and bot mitigation is a criterion inside it. Where each vendor appears, and how to read the two analyst views together.
Chris Taylor
PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own
Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.
Chris Taylor
Private Access Control Tokens (PACT): the Privacy Pass successor from Cloudflare, Chrome, Edge and Firefox
Cloudflare, Chrome, Edge, Firefox and Shopify announced Private Access Control Tokens (PACT) on 22 June 2026. It is the first descendant of Privacy Pass with more than one browser behind it. Private Access Tokens was only ever released in Safari, and Private State Tokens never got multi-vendor support.
Chris Taylor
Procaptcha vs reCAPTCHA 2026: Data Controller, Pricing & Catch Rate
Procaptcha and Google reCAPTCHA compared on the 2026 controller-model change, free-tier terms, catch rate against modern solvers, and cost above 100K assessments. Where each fits, and where they differ.
Hugh Parry
Procaptcha vs Cloudflare Turnstile 2026: GDPR, Catch Rate & Lock-in
Procaptcha and Cloudflare Turnstile compared on GDPR posture, catch rate against stealth headless bots, vendor lock-in and free-tier terms. Where each fits, and where they differ.
Hugh Parry
Top hCaptcha Alternatives 2026: Invisible, Private, No Image Puzzles
Best hCaptcha alternatives for 2026 — compare Procaptcha, Cloudflare Turnstile, reCAPTCHA v3 and Friendly Captcha on pricing, privacy and bot detection.
Chris Taylor
