Blog
Vendor comparisons, engineering notes and privacy analysis from the team that builds Prosopo's bot detection.
Featured · CAPTCHA ·
Top Friendly Captcha Alternatives 2026: Prices Compared
Friendly Captcha starts at €9 a month for 1,000 requests. Seven alternatives compared on price, proof of work, EU hosting, open source and accessibility.
Read article →Privacy and compliance
View all →
CAPTCHA · Top reCAPTCHA Alternatives 2026: 8 Options Compared reCAPTCHA is free for only 10,000 assessments a month and now runs inside Google Cloud. Eight alternatives compared on price, cookies and data location. 
CAPTCHA · GDPR-Compliant CAPTCHA 2026: 8 Providers Checked The CNIL says a CAPTCHA needs no consent only if its sole purpose is security. Eight CAPTCHAs checked on cookies, data transfers, DPAs and data location. 
CAPTCHA · PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.Live events and ticket bots
View all →
Ticketing · How to Stop Ticket Scalping: The 2026 Anti-Bot Playbook How to stop and prevent ticket scalping in 2026: block scalper bots, residential proxies and bulk signups at the queue, ticket page, drop API and CDN edge. 
Ticketing · Oklahoma SB 1241: New Laws to Stop Ticketing Bots and Protect Fans Oklahoma SB 1241 bans ticketing bots and forces price transparency — what the law requires, and how Prosopo Protect blocks scalper automation for compliance. 
Ticketing · Preventing Ticket Bots - The Battle for Fair Access Ticket bots continue to plague the live event industry in 2026, frustrating fans and inflating prices. Discover the latest strategies to prevent them.Technical deep dives
View all →
Technical · We stopped throwing errors in TypeScript and used Rust's Result instead A TypeScript function signature tells you everything except how it can fail. Rust solved this years ago by putting failures in the return type with Result, and TypeScript's discriminated unions and type guards make the same pattern a natural fit. We published ours as @prosopo/result. 
Technical · GitHub quietly broke our free CI overflow Giving a self-hosted runner the ubuntu-latest label used to let it share jobs with GitHub's hosted runners, so when the Actions minutes ran out our own machines picked up the slack. That stopped working in mid-2025, without an announcement. The workarounds left all cost something: a token, a billed minute per run, a cluster to run, or a bigger bill. 
Technical · Docker was hiding half a terabyte on our CI runner One CI runner's disk kept filling up. docker system prune freed 254GB, but another 238GB was hiding in old images, orphaned volumes and log files that no prune touches. Each of those needs its own command, and two of them can delete data you can't get back.CAPTCHA fundamentals
View all → CAPTCHA · Top reCAPTCHA Alternatives 2026: 8 Options Compared reCAPTCHA is free for only 10,000 assessments a month and now runs inside Google Cloud. Eight alternatives compared on price, cookies and data location. CAPTCHA · GDPR-Compliant CAPTCHA 2026: 8 Providers Checked The CNIL says a CAPTCHA needs no consent only if its sole purpose is security. Eight CAPTCHAs checked on cookies, data transfers, DPAs and data location. CAPTCHA · PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.Latest articles
Bot protection on AWS: AWS WAF Bot Control, CloudFront and Lambda@Edge compared AWS gives you three ways to stop bots in front of CloudFront: AWS WAF rules, AWS WAF Bot Control, and your own code in Lambda@Edge. What each catches, what it costs on AWS's published prices, and when to add a specialist. 
What is account takeover (ATO)? How the fraud works Account takeover is a criminal logging in as your customer. Bot management stops the automated routes in, like credential stuffing, but phishing needs MFA. Technical · We stopped throwing errors in TypeScript and used Rust's Result instead A TypeScript function signature tells you everything except how it can fail. Rust solved this years ago by putting failures in the return type with Result, and TypeScript's discriminated unions and type guards make the same pattern a natural fit. We published ours as @prosopo/result. 
How to detect AI agents on your website Over half the AI-agent traffic in our logs was spoofed. Check crawlers against vendor IP ranges or signatures, and judge agentic browsers on behaviour. 
SMS pumping fraud: what it is and how to stop it SMS pumping is bots requesting OTP texts to number ranges a rogue carrier shares revenue on, and you pay for every one. How to spot it and stop it. 
How to block bots on your website: what each method stops, and what gets past it robots.txt only asks crawlers to stay away. Blocking bots that ignore it takes verified crawler lists, edge rules, and checks on the network, device and behaviour behind each request. 
What is credential stuffing? How it works and how to stop it Credential stuffing is bots replaying passwords leaked from one site against the login of another. How attacks run, real incidents, and the defences. 
Agentic commerce fraud: when AI agents do the buying In agentic commerce, a mandate proves a person authorised the AI agent to pay. It does not stop that agent buying all your stock or testing stolen cards. CAPTCHA · Top reCAPTCHA Alternatives 2026: 8 Options Compared reCAPTCHA is free for only 10,000 assessments a month and now runs inside Google Cloud. Eight alternatives compared on price, cookies and data location. CAPTCHA · GDPR-Compliant CAPTCHA 2026: 8 Providers Checked The CNIL says a CAPTCHA needs no consent only if its sole purpose is security. Eight CAPTCHAs checked on cookies, data transfers, DPAs and data location. Technical · GitHub quietly broke our free CI overflow Giving a self-hosted runner the ubuntu-latest label used to let it share jobs with GitHub's hosted runners, so when the Actions minutes ran out our own machines picked up the slack. That stopped working in mid-2025, without an announcement. The workarounds left all cost something: a token, a billed minute per run, a cluster to run, or a bigger bill. Technical · Docker was hiding half a terabyte on our CI runner One CI runner's disk kept filling up. docker system prune freed 254GB, but another 238GB was hiding in old images, orphaned volumes and log files that no prune touches. Each of those needs its own command, and two of them can delete data you can't get back. 
Top HUMAN Security alternatives in 2026: bot and fraud protection compared The best HUMAN Security alternatives for 2026: Prosopo, DataDome, Kasada, Arkose Labs, CHEQ and Netacea compared on pricing, where data is processed and how each explains a block. 
Critical PHP flaws: update PHP on your WordPress site now Two critical PHP flaws disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a server without logging in. Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Here is how to check, how to update, and what to do if you can't yet. 
AI agent identity: knowing which agent is calling, and why that is only half the problem Agent identity is becoming solvable: signed requests, published key directories, authorisation mandates. A verified agent can still buy all your inventory, so identity is the foundation and not the answer. 
ChatGPT Atlas has been discontinued: what replaced it and what it means for your site OpenAI switched Atlas off on 9 August 2026, 292 days after launch. The browser is gone, the agentic traffic is not, and the replacements reach your site from different places. 
Perplexity Comet: what an agentic browser does to your site, and the court case about it Comet is free on every platform and its agent acts on sites for a real user. Amazon sued over exactly that, won an injunction, then lost it on appeal. The access question is now a live legal one. 
MCP security: the five ways agent tool access goes wrong MCP turns tool descriptions into model context, which makes the integration layer an attack surface. Tool poisoning, confused deputy, token passthrough, SSRF and rogue servers are the five that matter.See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.