Prosopo Logo

Blog

All articles

Everything we've written, newest first: vendor comparisons, technical deep dives, privacy analysis and the occasional company story.

Technical · Docker was hiding half a terabyte on our CI runner One CI runner's disk kept filling up. docker system prune freed 254GB, but another 238GB was hiding in old images, orphaned volumes and log files that no prune touches. Each of those needs its own command, and two of them can delete data you can't get back.
Top HUMAN Security alternatives in 2026: bot and fraud protection compared The best HUMAN Security alternatives for 2026: Prosopo, DataDome, Kasada, Arkose Labs, CHEQ and Netacea compared on pricing, where data is processed and how each explains a block.
Critical PHP flaws: update PHP on your WordPress site now Two critical PHP flaws disclosed on 21 October 2026 (CVE-2026-109618 and CVE-2026-109619) let an attacker run code on a server without logging in. Update to PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12. Here is how to check, how to update, and what to do if you can't yet.
AI agent identity: knowing which agent is calling, and why that is only half the problem Agent identity is becoming solvable: signed requests, published key directories, authorisation mandates. A verified agent can still buy all your inventory, so identity is the foundation and not the answer.
ChatGPT Atlas has been discontinued: what replaced it and what it means for your site OpenAI switched Atlas off on 9 August 2026, 292 days after launch. The browser is gone, the agentic traffic is not, and the replacements reach your site from different places.
Perplexity Comet: what an agentic browser does to your site, and the court case about it Comet is free on every platform and its agent acts on sites for a real user. Amazon sued over exactly that, won an injunction, then lost it on appeal. The access question is now a live legal one.
MCP security: the five ways agent tool access goes wrong MCP turns tool descriptions into model context, which makes the integration layer an attack surface. Tool poisoning, confused deputy, token passthrough, SSRF and rogue servers are the five that matter.
x402 and agent payments: what a machine-payable endpoint means for your site x402 revives HTTP 402 so an agent can pay for a request in stablecoins and retry it. That turns abuse into a priced transaction, and it does not decide who is allowed to buy.
llms.txt: we publish one, and no AI crawler has ever read it We have published an llms.txt since May 2026. Across four days of IP-verified logs, AI crawlers fetched our robots.txt 120 times and our sitemap 43 times. They fetched llms.txt zero times.
Agentic browsers: your customer is now a robot, and that is fine An agentic browser is automation operated by a real customer. It fails every classic bot test and still deserves to reach your checkout. The answer is to require evidence of a human on particular steps, rather than to judge the client.
OWASP API Security Top 10: which two a bot layer actually fixes Eight of the ten risks in the 2023 OWASP API Security Top 10 are authorization and inventory bugs only your own code can fix. API4 and API6 are the two where a bot-protection layer is the right tool.
Why Do Bots Fill Out Forms? The Economics of Form Spam and How to Stop It Why do bots fill out forms? For free advertising, credential stuffing, signup-credit abuse, SEO laundering through expired domains, and reconnaissance. Here is how each one works, and how Prosopo blocks them at the form-submission layer.
What is WAAP? Web Application and API Protection explained WAAP means Web Application and API Protection: a WAF, DDoS mitigation, bot management and API protection sold as one cloud service. The bot component is the one to scrutinise, because it needs signals a network vendor has no reason to collect.
Web Bot Auth: signed agents solve identity, not intent Web Bot Auth lets an AI agent cryptographically sign its requests so you can verify who it is. That fixes user-agent spoofing and leaves the harder question untouched: a verified agent can still be doing something you do not want.
OWASP automated threats: the 21 names your vendor should be using The OWASP Automated Threat Handbook gives every bot attack a vendor-neutral name and an OAT number. The full taxonomy, the five that cost the most money, and how to use it in an RFP.
Gartner and bot management: the Magic Quadrant that does not exist There is no Gartner Magic Quadrant for bot management. There is one for Cloud WAAP, and bot mitigation is a criterion inside it. Where each vendor appears, and how to read the two analyst views together.
CAPTCHA · PoW CAPTCHA Explained: What It Is, and Why It Isn't Enough on Its Own Proof-of-work CAPTCHA explained — how the hash-puzzle mechanism works, why it went mainstream after reCAPTCHA's price hike, and what it still can't stop on its own.
Private Access Control Tokens (PACT): the Privacy Pass successor from Cloudflare, Chrome, Edge and Firefox Cloudflare, Chrome, Edge, Firefox and Shopify announced Private Access Control Tokens (PACT) on 22 June 2026. It is the first descendant of Privacy Pass with more than one browser behind it. Private Access Tokens was only ever released in Safari, and Private State Tokens never got multi-vendor support.
CAPTCHA · Procaptcha vs reCAPTCHA 2026: Data Controller, Pricing & Catch Rate Procaptcha and Google reCAPTCHA compared on the 2026 controller-model change, free-tier terms, catch rate against modern solvers, and cost above 100K assessments. Where each fits, and where they differ.
CAPTCHA · Procaptcha vs Cloudflare Turnstile 2026: GDPR, Catch Rate & Lock-in Procaptcha and Cloudflare Turnstile compared on GDPR posture, catch rate against stealth headless bots, vendor lock-in and free-tier terms. Where each fits, and where they differ.
CAPTCHA · Top hCaptcha Alternatives 2026: Invisible, Private, No Image Puzzles Best hCaptcha alternatives for 2026 — compare Procaptcha, Cloudflare Turnstile, reCAPTCHA v3 and Friendly Captcha on pricing, privacy and bot detection.
Top DataDome Alternatives 2026: Enterprise Bot Defense Compared Best DataDome alternatives for 2026 — compare HUMAN, Kasada, Arkose Labs, Cloudflare and Prosopo on price, coverage and EU data residency.
Top Arkose Labs Alternatives 2026: Enterprise Bot Defense Without the Game Challenge Best Arkose Labs alternatives for 2026 — compare DataDome, HUMAN, Kasada and Prosopo for enterprise bot defense without visible game challenges.
CAPTCHA · reCAPTCHA vs hCaptcha 2026: Which One (and Why Procaptcha Often Wins Both) reCAPTCHA vs hCaptcha in 2026 — pricing, GDPR, catch rate compared. reCAPTCHA is cheaper at low volume, hCaptcha stricter, both are US data processors.
CAPTCHA · reCAPTCHA vs Cloudflare Turnstile 2026: Which One (and When Procaptcha Beats Both) reCAPTCHA vs Cloudflare Turnstile in 2026 — pricing, catch rate and privacy compared. reCAPTCHA gives a score, Turnstile is free, both are US processors.
CAPTCHA · hCaptcha vs Cloudflare Turnstile 2026: Which Wins (and When Neither Does) hCaptcha vs Cloudflare Turnstile in 2026 — pricing, catch rate and privacy compared. Turnstile is free but pass-only, hCaptcha stricter but paid.
Ticketing · How to Stop Ticket Scalping: The 2026 Anti-Bot Playbook How to stop and prevent ticket scalping in 2026: block scalper bots, residential proxies and bulk signups at the queue, ticket page, drop API and CDN edge.
CAPTCHA · Forrester Wave Bot and Agent Trust Management Q2 2026: How Prosopo Compares Forrester's Q2 2026 Wave named 8 Bot and Agent Trust Management vendors. What each got dinged for, and how Prosopo — the specialist entry — compares.
CAPTCHA · How to Stop PHP Form Spam (Without a Plugin) If your PHP mail script is being abused by bots, stop the bot before mail() runs — server-side CAPTCHA verification in a few lines of PHP, via Procaptcha.
CAPTCHA · Best CAPTCHA 2026: 7 Top Solutions Compared What is the best CAPTCHA in 2026? Compare pricing, privacy, GDPR compliance and bot-stopping power across the 7 leading CAPTCHA solutions.
Technical · Faking browsers is easy — but not at scale 131,819 residential US IPs threw 1.4M brute-force attempts at one mobile-only customer in 30 days — all collapsing onto a handful of fingerprints.
CAPTCHA · Cloudflare Turnstile Alternatives 2026 — 8 Options Ranked Turnstile returns a pass/fail token and nothing to escalate to. How Prosopo, hCaptcha, ALTCHA and 5 others compare on catch rate, GDPR and price.
Ticketing · Oklahoma SB 1241: New Laws to Stop Ticketing Bots and Protect Fans Oklahoma SB 1241 bans ticketing bots and forces price transparency — what the law requires, and how Prosopo Protect blocks scalper automation for compliance.
Privacy · Google reCAPTCHA Switches to Data Processor - Too Little, Too Late? Google flips reCAPTCHA to data processor in April 2026 — after a decade of harvesting visitor data. Why the switch, and why it doesn't fix GDPR risk.
Technical · How to Add CAPTCHA to Fastly CDN Learn how to integrate Procaptcha with Fastly CDN to protect your website from bot attacks while maintaining performance and user privacy.
Technical · We suffered MongooseJS so you don't have to We investigate how MongooseJS's type safety can silently add bugs to your code base.
CAPTCHA · Survey Companies Are Having Their Data Compromised by AI Bots AI bots now fill and submit online surveys at scale, poisoning your data. How to keep survey responses clean by blocking bots at submission with Procaptcha.
CAPTCHA · We cut our Mongo DB costs by 90% by moving to Hetzner We moved MongoDB Atlas off AWS and onto self-hosted Hetzner boxes — 90% cost cut, no performance loss. Here's the setup, the Ansible, and what broke.
CAPTCHA · reCAPTCHA is Changing Its Terms of Service — What Site Owners Need to Do Google's reCAPTCHA is showing 'Take action' on sites with older keys. What the ToS change means, which keys are affected, and how to remediate.
Ticketing · Preventing Ticket Bots - The Battle for Fair Access Ticket bots continue to plague the live event industry in 2026, frustrating fans and inflating prices. Discover the latest strategies to prevent them.
CAPTCHA · Procaptcha vs hCaptcha 2026: Pricing, Free Limit & GDPR Procaptcha vs hCaptcha: pricing, free tier limits, GDPR compliance, and UX compared. See why teams switch from hCaptcha to Procaptcha.
CAPTCHA · Procaptcha vs Friendly Captcha - Why Real Bot Protection Matters in 2026 Procaptcha vs Friendly Captcha in 2026 — catch rate, GDPR posture and pricing compared. Friendly is proof-of-work only; Procaptcha catches real bots.
Technical · Reactive Frameworks Cheatsheet - React, Vue, Svelte and Angular
Technical · PHP Views Package - Templating Made Easy with Blade and Model-Driven Approach
Technical · Streamlining Releases: Building Scalable CICD Pipelines with Changesets Overcome common challenges and scale your CICD pipelines for predictable versioning, releases and deployments.
Technical · Independent vs Locked Versioning in a Workspace Locked vs independent versioning in a monorepo workspace — the tradeoffs on release cadence, dependency drift and CI overhead, and which one fits your team.
Technical · Mastering Versioning: A Guide to Software Stability Semver rules, dependency traps and the pitfalls that break stable builds — how we manage versioning at Prosopo without wrecking downstream consumers.
Technical · Monorepo vs Multirepo Architecture: How to Decide? Monorepo vs multirepo — tradeoffs on tooling, CI cost, dependency drift and team autonomy. Which one actually fits your project, and when to switch.
CAPTCHA · hCaptcha and GDPR - Privacy Claims Warrant Scrutiny Examination of hCaptcha reveals several potential friction points with GDPR principles.
CAPTCHA · How to Choose a GDPR-Friendly CAPTCHA for WordPress Stop spam & stay GDPR-compliant! Learn how to choose a GDPR-friendly CAPTCHA for WordPress that boosts security without tracking.
CAPTCHA · How to Integrate CAPTCHA Without Violating User Rights Integrate CAPTCHA the right way! Ensure security, privacy, and accessibility without violating user rights. Follow our expert guide for best practices!
Ticketing · How Do Ticket Scalpers Get Tickets? Bots, Tactics & Defenses Ticket scalping meaning, how ticket scalpers get tickets before fans, and the bot tactics behind resale markups — plus what venues can do about it.
Privacy · How to Make CAPTCHA GDPR Compliant & Protect Privacy Discover 7 essential steps to make your CAPTCHA GDPR compliant, avoid hefty fines, and pass security audits. Implement privacy-focused solutions today!
Privacy · What Privacy Laws Should CAPTCHA Providers Comply With Stay compliant with global privacy laws! Learn what CAPTCHA providers must follow to avoid fines and protect user data while ensuring legal security.
CAPTCHA · What is the Future of CAPTCHA and Online Privacy Discover the future of CAPTCHA! Learn how AI, privacy-first authentication & invisible security are shaping online privacy. Stay ahead - read now!
Ticketing · What do Artists do to Prevent Ticket Scalping? How do artists stop ticket scalpers? See how verified fans, dynamic pricing & blockchain disrupt resale bots and protect fair access.
CAPTCHA · Which Security Risks Does CAPTCHA Pose: Critical Flaws? Discover the critical flaws in CAPTCHA security that hackers exploit. Learn how to protect your site from threats. Stay secure - read now!
Ticketing · Why is Ticket Scalping so Hard to Stop? Uncovered Why ticket scalping is so hard to stop: bots, proxies, bulk accounts and resale markets, the Eras Tour case, and what ticketing platforms can do about it.
CAPTCHA · How to Test Your Ansible Playbooks Locally Testing your Ansible playbooks locally can save you time and effort. Here are some tips to help you get started.
Company · We Are Being Blackmailed or: How Not to Hire a Contractor A contractor that we hired on Upwork is now blackmailing us. Here's how we got into this situation and how we're dealing with it.
CAPTCHA · tsx vs ts-node: Time to Drop ts-node for tsx tsx vs ts-node compared: why tsx runs TypeScript faster than ts-node, and how to migrate your Node.js scripts away from ts-node today.
CAPTCHA · actions/cache@v3 restore: GitHub Actions Cache Fix Fix GitHub Actions caching with actions/cache@v3 and actions/cache/restore: share caches across branches and evict old caches faster.
CAPTCHA · TypeScript: Branded Types How to brand TypeScript types for norminal typing, providing an automated and easy-to-use way of making a type nominal.
Technical · Using Vite To Rebuild Local Dependencies in an NPM Workspace Vite ignores local workspace packages because they sit outside its module graph — the config trick that forces Vite to rebuild sibling npm packages.
CAPTCHA · What is the best value CAPTCHA in 2024? Find out what the best value CAPTCHA is in 2024 and how it compares to other popular CAPTCHA solutions.
CAPTCHA · Switching From reCAPTCHA to Prosopo: What's Involved What changes when you swap reCAPTCHA for Prosopo — integration surface, verdict shape, GDPR posture, and what your team sees in the dashboard.
CAPTCHA · Vite: How to handle .node files Vite can't bundle .node native binaries — it treats them as raw JS and blows up. Our custom rollup plugin that copies .node files through the build.
CAPTCHA · Invisible Captcha: A Silent Solution by Prosopo Invisible captcha blocks spam and abuse without a challenge screen — how Procaptcha runs silently in the background and only interrupts suspicious traffic.
Privacy · Google reCAPTCHA is a privacy nightmare - Questions over privacy promises and cookie use Scrutiny by the French data protection authority, CNIL, reveals the problematic infrastructure that allows for reCAPTCHA's operations
CAPTCHA · Why Am I Clicking Traffic Lights? The reCAPTCHA CAPTCHA Explained Traffic lights, cars and crosswalks in reCAPTCHA are not random — you've been labelling training data for Google's computer-vision models for a decade. Here's how the traffic-light CAPTCHA works, why it's still shown, and what a modern alternative looks like.
CAPTCHA · What is a CAPTCHA? How the Challenges Work 🛡️ Unveil the secrets behind CAPTCHA, the digital gatekeeper standing between you and cyber chaos, in our captivating exploration of cybersecurity's unsung hero!
CAPTCHA · TypeScript: Mapped Type Magic TypeScript mapped types can make Cat === Dog — a weird paradox. How to brand identical structural types so the compiler can tell them apart.
CAPTCHA · Stop giving your website data away! Find out why reCAPTCHA, hCaptcha, and Cloudflare Turnstile may be secretly monetising your website data, and how Prosopo's Procaptcha is solving this problem.
CAPTCHA · Google reCAPTCHA Price Hike: What Changed in 2024 & What It Broke Google's 2024 reCAPTCHA change cut the free tier from 1M to 10K requests/month. What actually changed, why it stung SMBs, and where teams moved next.
Technical · How to deploy Procaptcha on your website or app How to switch from Google's reCAPTCHA to Prosopo Procaptcha and protect your website or app from bots for free.
CAPTCHA · Prosopo Procaptcha vs Google reCAPTCHA Procaptcha vs Google reCAPTCHA — decentralised, GDPR-clean and free at low volume vs the US data harvester. Which one actually protects your web forms.
Company · Prosopo team at Polkadot Decoded 2022 Prosopo at Polkadot Decoded 2022 in Berlin — Gavin Wood on Governance v2, Encointer on UBI, and why web3 still needs bot protection at the wallet layer.
Company · Prosopo receives grant from Web3 Foundation to build human verification Prosopo has received a Web3 Foundation grant to build a decentralised human verification marketplace, developed with Gimly to protect DApps from bot attacks.

See what's reaching your site

A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.

Book an assessment Read the case studies