Bot protection is the practice of detecting and stopping automated attacks against your web and mobile app. It combines behavioural analysis, device and TLS fingerprinting (JA4), network reputation and adaptive challenges. Layers stack so if one signal is spoofed, another catches the attacker. Procaptcha checks each form submission on its own; Prosopo Protect sees every request and learns your site's normal traffic. Both share Access Rules and the portal.
Enterprise Bot Protection — the Prosopo Platform
Two products, installed where your traffic lands. Procaptcha on individual forms; Prosopo Protect in front of an entire site or JSON API (Cloudflare Worker or AWS Lambda@Edge), where it also learns what normal traffic looks like for your site. Same Access Rules and same portal in both — every verdict comes back with a reason your team can read, not a black-box score. Spam Filter is included with either.
Detect, decide, explain
Shared Access Rules and one portal, whether a request came through Procaptcha on a form or Protect.
- 01
Detect
Every request is scored against behavioural signals (cursor, scroll, typing rhythm, SIMD-CPU signatures), JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest and Android Play Integrity, IP reputation and residential-proxy classification.
- 02
Decide
Machine-learning models combine the collected signals into a risk score. Real humans and authorised agents pass invisibly. Suspicious sessions get a proof-of-work, puzzle or image challenge, all configurable per site. Known-bad traffic never reaches your server.
- 03
Explain
Every block response includes the rule that fired. Drill into the event in the portal (the same view our engineers use).
Why teams pick Prosopo
A reason on every block
The bulk of what stops bots is a library of named detectors. When a block happens, the response carries the reason — Inconsistent hardware readings for device, Solver service detected, Synthetic interaction timings, HTTP header fingerprint mismatch. Not a numerical score. Not a vendor-branded policy label. Your team knows what caught the request without opening a support ticket.
Open source at the base
Our base captcha is published on GitHub, and self-hosting is available. The advanced site-wide, behavioural and intent-scoring layers are proprietary, but they run on the same open challenge stack that your security team can review before adoption.
Forms or whole site, one portal
Procaptcha checks the forms you choose. At the CDN edge, Protect checks every request and learns what normal looks like for your site. One portal, whichever you deploy.
Signals bots can't fake
JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest, Android Play Integrity, stealth-headless detection and residential-proxy classification. The signals bot toolkits can't spoof cleanly, with every block visible in your portal.
Fits your compliance programme
Cookieless widget, no cross-site profiling of humans, EU-only processing on the Enterprise and Custom plans. GDPR compliant, with a data processing agreement on every plan, and nothing to add to your cookie banner. UK-incorporated, engineered in the UK; enterprise support goes straight to the engineers who built the platform.
What Prosopo stops
Prosopo blocks the automated attacks that most directly impact revenue, security and user trust:
- Credential stuffing and account takeover on login and password-reset flows.
- Scraping by AI-training crawlers, price aggregators and look-alike competitors.
- Ticket scalping toolkits on high-demand on-sales.
- Denial of inventory that reserves stock across sneaker drops and limited releases.
- Spam form submissions and disposable-email signups.
- Unwanted AI shopping agents that sit between real humans and the automation you don't want.
A decade ago, a CAPTCHA and an IP blocklist were sufficient. Today they are not. Stealth headless browsers on rotating residential proxies pass an image CAPTCHA in milliseconds, at fractions of a cent, via CAPTCHA-solving farms that operate at industrial scale. Effective bot protection now requires continuous silent detection, adaptive challenges applied only when the risk score demands it, and a clear, auditable reason for every request that is blocked.
How the detection works
Three inspectable layers, in order.
First, a library of named detectors that fires against pattern-matches in the traffic. Signals combined include JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest, Android Play Integrity, stealth-headless-browser detection, residential-proxy classification, cursor and scroll behaviour, and SIMD-CPU signatures. When a detector fires, the block response names it. A few real examples of what the platform catches, with the underlying technical string in each case:
| Reason returned on the block | What it means |
|---|---|
Inconsistent hardware readings for device | The session claims one device, and the processor underneath behaves like another |
2Captcha solver detected | The request pattern matches the fingerprint of a named commercial solving service |
Synthetic interaction timings | Mouse and touch rhythm no human hand produces |
Client headers contradict claimed browser | The client's own headers disagree with the browser it says it is |
Malformed request headers | Header combinations no real browser emits |
Second, your own Access Rules layer on top for policy the default detectors don't yet cover — block a specific ASN pattern, challenge visitors from a high-risk country, whitelist a partner IP range. Third, in Prosopo Protect, an ML model scores request intent across the human / agent / bot boundary — the layer that decides whether an agentic browser is acting on behalf of a real customer or automating abuse.
Every layer surfaces a readable trigger on a block. Real users pass invisibly. Suspicious sessions get a proof-of-work, puzzle or image challenge. Known-bad traffic never reaches your servers.
Live examples of what Prosopo is protecting in production today:
- Ticketing platforms. Full-traffic edge deployment against professional ticket-touting bots, including VM-iOS and real-device botnets.
- Subscription SaaS with free-tier scraping. The look-alike competitor pattern common in face-search, reverse-image, people-search and small-API businesses.
- Crypto-wallet login endpoints. Blocking CAPTCHA-solver services attempting account takeover.
How Prosopo compares to DataDome, HUMAN and Arkose
| Capability | Prosopo | DataDome | HUMAN | Arkose Labs |
|---|---|---|---|---|
| Behavioural analysis | ● | ● | ● | ● |
| Residential-proxy detection | ● | ● | ● | ● |
| Invisible-first UX (no default challenge) | ● | ● | ● | ● game challenges |
| EU-hosted processing | ● | ● enterprise | ● | ● |
| Widget cookieless by default | ● | ● | ● | ● |
| Plain-language reason on every block | ● Technical string | ● GenAI summary | ● Sightline view | ● "Telltales" |
| Agent-aware policy (AI agents) | ● | ● | ● | ● |
For a CAPTCHA-layer comparison across the wider market, see Cloudflare Turnstile alternatives.
The alternative to Imperva, HUMAN, AWS WAF and Cloudflare
Evaluating Cloudflare Bot Management, Imperva Advanced Bot Protection, AWS WAF Bot Control or HUMAN Bot Defender (formerly PerimeterX)? Three reasons teams pick Prosopo instead:
- Open source you can inspect. The base captcha is published on GitHub, so your security team can review the client-side code before adoption.
- Rules you can name. Every block traces back to a human-readable Access Rule in your dashboard, not to a black-box model score you cannot audit.
- A self-hosted option. You can run the open-source Procaptcha provider yourself in Docker, with proof-of-work and slider challenges, and bring your own detector. Prosopo's detector, ML scoring, Access Rules, traffic filters and analytics stay on the managed plans; obfuscated detector bundles are available on request.
All UK-incorporated, EU-processed, and available on a free tier so the fundamentals are not restricted to enterprise contracts.
Use cases
- Credential stuffing and account takeover. Password-replay and ATO on login and reset flows.
- Web scraping and free-tier abuse. AI-training crawlers, price aggregators, and look-alike competitors mining free-tier output for a look-alike product.
- Denial of inventory. Hoarding bots that reserve stock across sneaker drops, limited releases and on-sales.
- Ticket scalping. Professional scalper toolkits on ticketing platforms and venues, blocked with edge-mode enforcement.
- Spam bot protection. Form spam, fake signups, disposable-email abuse.
- Phishing defence. Verifying inbound traffic on authentication endpoints.
Deploy it wherever your traffic lives
Same rules and dashboard wherever it runs. At the edge, Protect also learns your site's normal traffic:
- Edge enforcement. The primary mode for whole-site and API coverage. Verifies on Cloudflare Workers or AWS Lambda@Edge before requests reach your origin.
- Drop-in widget. For form-level protection: login, signup, checkout, contact, comment. Open source on GitHub for a code review before it goes live.
- WordPress and CMS plugins. 16 WordPress integrations, including Contact Form 7, Gravity Forms and WPForms.
Privacy and compliance built in
- Cookieless widget by default. Nothing to add to your cookie banner under the ePrivacy Directive. Edge-mode deployments may set first-party session cookies for session continuity only.
- GDPR compliant. A data processing agreement on every plan, and your data is never resold to ad networks or used as a cross-tenant training signal without your opt-in.
- Bots profiled cross-site, real users are not. A scraper we spot on one customer's site is blocked when it shows up on yours; real users are never cross-site tracked.
- EU-only processing on Enterprise and Custom. Custom adds data residency terms and a dedicated database if you need them.
- UK-incorporated, EU-processed. Full details in the privacy policy.
Book a call with a security engineer
Ready to evaluate? Bring an attack log or your threat model to the first call. The demonstration is far more useful when it runs against your own traffic than against a scripted one, and the first call is 30 minutes with a Prosopo engineer, not a sales representative.
- Book an enterprise call. See what Prosopo catches on your traffic before the pricing conversation.
- Read the Forrester Wave 2026 breakdown. How Prosopo compares against DataDome, HUMAN, Kasada, Arkose, CHEQ, Netacea, hCaptcha and Google reCAPTCHA Enterprise.
- Compare CAPTCHA-layer solutions. How the Prosopo widget stacks up against the rest of the market.
PoC to production in days
Three steps, not a six-month vendor onboarding.
- 01
Talk to an engineer
Book a 30-minute call directly with a Prosopo engineer, not a sales representative. Bring an attack log or your current threat model, and we will demonstrate exactly what Prosopo catches on your live traffic before any pricing conversation.
- 02
Integrate
Drop-in widget for forms. Edge deployment on Cloudflare Workers or AWS Lambda@Edge for full-traffic protection.
- 03
Baseline, deploy, investigate
Prosopo baselines your legitimate traffic before enforcement is enabled, so real users see nothing when the platform goes live. From then on, every block is traceable to a specific rule in the portal or over the API.
See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
What is bot protection?
How is bot protection different from a CAPTCHA?
A CAPTCHA is one layer: a challenge shown to the user. Bot protection is the whole system: silent detection, adaptive escalation to a challenge only when the score demands it, and an integrated response (block, throttle, step-up). Modern bots defeat single-layer CAPTCHAs cheaply via solving farms, so the detection has to happen before the CAPTCHA fires.
Can Prosopo stop credential stuffing and account takeover?
Yes. Every login and password-reset request is scored against behavioural, device, JA4 and network signals. Real users pass invisibly, credential-replay infrastructure is throttled or blocked, and every block returns the reason and the signals that fired. See the credential stuffing use case for the full pattern.
Does Prosopo fit our GDPR compliance work?
Yes. The widget is cookieless by default (edge-mode deployments may set first-party session cookies for continuity), real users are not profiled across sites, and EU-only processing is available on the Enterprise and Custom plans. Prosopo is GDPR compliant, with a data processing agreement on every plan. UK-incorporated, engineered in the UK. See the GDPR-compliant CAPTCHA page for the full data-handling posture.
Can Prosopo run self-hosted?
Yes. You can run the open-source Procaptcha provider yourself in Docker, with proof-of-work and slider challenges, and bring your own detector. Prosopo's detector, ML scoring, Access Rules, traffic filters and analytics stay on the managed plans; obfuscated detector bundles are available on request.
Which bot management vendors did Forrester name in Q2 2026?
Forrester's Q2 2026 Wave for Bot and Agent Trust Management named DataDome, HUMAN and Kasada as Leaders; Arkose Labs, CHEQ and Netacea as Strong Performers; hCaptcha and Google reCAPTCHA Enterprise as Contenders. Prosopo is the specialist alternative in the same category, with every verdict traceable to a human-readable rule instead of a black-box score. Full comparison on the Forrester Wave 2026 breakdown.
More from Prosopo
- Accessible CAPTCHA: verification that does not lock people out An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
- Residential proxy detection How Prosopo detects residential proxies — TCP fingerprint interrogation, IP intelligence, and a self-maintained proxy-vendor catalogue. Available from the Professional plan.
- Spam Filter for Procaptcha and Prosopo Protect Spam Filter is part of Procaptcha. It blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
- Invisible CAPTCHA Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
- Procaptcha: the GDPR-compliant CAPTCHA widget Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 requests a month.
- Access Control — the Customer-Authored Layer Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.