Yes. Procaptcha processes an IP address and a short-lived session identifier — the minimum needed to verify a request is human — under legitimate interest. The widget is cookieless by default. Human users are not profiled across sites. EU-only processing is available on the Enterprise and Custom plans. Prosopo is UK-incorporated and engineered in the UK.
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is a drop-in CAPTCHA widget that replaces reCAPTCHA or hCaptcha on any form. Real humans pass invisibly on behavioural signals; suspected bots see a challenge. Cookieless by default, no cross-site profiling. Need EU-only processing, or your API and whole site covered? That's Enterprise.
What you get
Drop-in for reCAPTCHA and hCaptcha
The integration surface matches the incumbents. Migration is usually a site-key swap and a script-tag change.
GDPR-compliant, cookieless by default
No third-party tracking cookies. No entry required on your consent banner under the ePrivacy Directive.
Room to grow
Over 1M requests a month, or need EU-only processing, Access Rules and audit logs? Enterprise (Prosopo Protect) covers your forms, API and whole site.
Free to 10,000 requests a month
No card required to start. UK-incorporated, engineered in the UK. Support goes to the engineers who wrote the detection.
Teams usually switch to Procaptcha because their DPO flagged reCAPTCHA's or hCaptcha's tracking cookies and cross-site profiling, because reCAPTCHA's new billing has put a price on their traffic, or because the current widget is letting scrapers, credential stuffing and disposable signups through. It goes anywhere a CAPTCHA goes today: login, signup, checkout, contact and comment forms.
The code
Two things change on your site: a script tag and widget on the form, and a verify call in your backend.
<script type="module" src="https://js.prosopo.io/js/procaptcha.bundle.js" async defer></script>
<form method="POST" action="/login">
<input name="email" type="email">
<input name="password" type="password">
<div class="procaptcha" data-sitekey="YOUR_SITE_KEY"></div>
<button type="submit">Sign in</button>
</form>The form posts a procaptcha-response token. Verify it in your backend before you trust the submission:
const res = await fetch("https://api.prosopo.io/siteverify", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ secret: process.env.PROSOPO_SECRET, token }),
});
const { verified } = await res.json();
if (!verified) return reject();Migrating from reCAPTCHA or hCaptcha means swapping the script tag and site key, and checking verified where your code checks success today. On Professional and above the response also carries a score, and a reason such as API.CLIENT_SESSION_MISMATCH when a request is blocked.
Get a site key
Free for 10,000 requests a month. No card needed.
How it compares to reCAPTCHA, hCaptcha and Turnstile
Best Partial / caveat Weak
| Capability | Procaptcha | reCAPTCHA | hCaptcha | Cloudflare Turnstile |
|---|---|---|---|---|
| Third-party tracking cookies | ● None | ● Yes | ● Yes | ● None |
| Cross-site behavioural profile | ● None | ● Yes | ● Yes | ● Limited |
| Personal data stored by default | ● IP only | ● Multiple | ● Multiple | ● Minimal |
| Data processed in EU on request | ● On Enterprise | ● Limited | ● Limited | ● Limited |
| GDPR-compliant by default | ● | ● | ● | ● Partial |
| Free tier | ● 10K / month | ● | ● | ● |
| Reason given when a request is blocked | ● Professional and above | ● Score only | ● Score only | ● Score only |
Procaptcha vs Prosopo Protect
Procaptcha checks each form submission on its own. Prosopo Protect, the Enterprise and Custom plans, sees every request to your site and API and learns what normal traffic looks like there.
| Procaptcha (Free, Professional) | Prosopo Protect (Enterprise, Custom) | |
|---|---|---|
| What you install | <script> on the form + /siteverify in your backend | Your choice: a script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both |
| What it protects | One form at a time | Your forms, API and whole site |
| When to reach for it | Drop-in reCAPTCHA / hCaptcha replacement on specific forms, up to 1M requests a month | Scraping, API abuse, account takeover, Access Rules and audit logs, or more than 1M requests a month |
Next steps
- Get started in the docs: site key, widget and first verification, plus React, Vue, Angular and Svelte integrations.
- Compare plans: Free to 10,000 requests a month, Professional from $39 a month.
Having a problem on a live site? Use Prosopo Support and include the URL where the issue is happening.
Live demo
Try the widget for yourself
Pick a challenge, a theme and a language, then watch the widget rebuild inside a working sign-in form — the same widget your users would see.
Runs right here — no signup, nothing to install.
Live demo
Try Procaptcha
CAPTCHA challenge
How Frictionless works
The default mode. Procaptcha scores the request first, and only asks the visitor to do something when the score is not good enough on its own.
- What the visitor does
- One click, and in the common case nothing after it. The widget is already scoring the request while the page sits open.
- What Procaptcha looks at
- Browser environment characteristics that separate real browsers from headless automation, the shape of natural mouse, touch and keyboard interaction, and the network the request arrives from.
- Where the decision is made
- Server-side, against the Safety Threshold you set in the portal. Tighten it during an attack and loosen it afterwards without touching your integration.
- What happens to a bad score
- The request falls through to a real challenge rather than being blocked outright, so a false positive costs the visitor a few seconds instead of the transaction.
How Proof of Work works
Every client pays a small, unavoidable compute cost before its submission is accepted.
- What the visitor does
- Nothing beyond the click. The puzzle is solved in the background, well inside a second on an ordinary device.
- The puzzle
- The browser searches for an input whose hash begins with a set number of zero bits. Finding a solution takes real work; checking one is instant. That asymmetry is the entire mechanism.
- Why it stops automation
- The cost scales with volume. A visitor solves one puzzle; an operator firing ten thousand requests solves ten thousand. Difficulty is tuned per site, so you choose where that bill starts to bite.
- What it resists
- There is no answer to resell. Unlike an image grid, a solver farm cannot pre-compute or outsource the work — every request needs its own solution, computed at request time.
How Image CAPTCHA works
The familiar grid test, kept for requests that have already failed a quieter check.
- What the visitor does
- Picks the images matching a prompt out of a grid, over two rounds by default.
- How it is marked
- Each round is scored as a proportion of correct selections against a threshold — 0.8 out of the box — rather than demanding a flawless grid.
- What you can tune
- The number of rounds and the pass threshold are both per-site settings, within a house cap on rounds. More rounds costs an attacker more, and costs your visitors more too.
- Where it fits
- Strongest as the thing frictionless mode falls through to. Image challenges are the easiest kind to hand to a solver farm, which is what makes them irritating as a front door without being especially effective there.
How Slider Puzzle works
A drag-to-fit challenge, quicker on a phone than picking images out of a grid.
- What the visitor does
- Drags a puzzle piece across the background image until it sits in the notch it was cut from.
- Decoys
- Further notches are drawn alongside the real one, so the target is a shape to match rather than the only gap on the image.
- How it is marked
- The resting position is checked server-side against a tolerance — around fifteen pixels by default — so a close human drag passes and a miss does not.
- What you can tune
- Tolerance, how many decoys are drawn and the contrast they are drawn at are all per-site settings in the portal.
Theme
Widget mode
Placement
Centred over the page, or anchored to the widget.
32 translations are included with the widget.
How widget mode works
Whether the widget appears on the page at all.
- Checkbox
- The familiar "I am human" box sits in your form. The visitor clicks it, verification runs there and then, and your submit button unlocks.
- Invisible
- Nothing renders. Verification runs when the visitor submits, so the form's own button becomes the trigger and the widget takes up no layout space at all.
- What changes in your code
- One render option —
size: "invisible"— and a submit handler that callsprocaptcha.execute()and waits for the callback rather than posting straight away. - Which to choose
- Invisible suits a form that already has one obvious submit. Checkbox is the safer default when visitors benefit from seeing that a check happened, and it is the only mode where a challenge can be anchored to the widget.
How challenge placement works
Where the challenge opens on the occasions one is needed.
- Popup
- Centred over the page behind a dimmed backdrop. Works wherever the widget sits, including below the fold, and is the default.
- Float
- Anchored to the widget itself, opening beside the checkbox like a dropdown, so the challenge stays in the context of the form being filled in.
- Why Float greys out
- An invisible widget renders nothing for a floating challenge to anchor to, so the bundle resolves that combination back to popup. The control disables Float rather than letting you pick a placement that will not happen.
- What changes in your code
- One render option —
placement— with no markup or layout changes on your side either way.
Sign in
Checkbox mode: verify with the widget below.
Verified
Your backend would now check this token against /siteverify.
Like what you see? Get a site key free — 10,000 verifications a month, no card required.
Get a site key and go live today
Free for 10K verifications a month, no card needed. Paid plans from $39 a month when you need more.
What customers say
Verified G2 and Trustpilot reviews, in their own words.
Easy setup for website owners I have been a web developer for over 10 years at this point, some of the alternative captcha's have been a bit long winded to setup and their documentation is quite poor. I managed to go from discovering Prosopo and use it on my website (the upcoming visitgrid.uk) in under an hour in my own weird in house architecture. Daniel Jones · 22 Jul 2026 Easy Setup, Excellent Spam Protection I use Procaptcha to eliminate spam from my forms on my website. It was fairly easy to install and has excellent customer service. When installed correctly, it helped eliminate spam contacts and subscribers. I contacted Chris at Procaptcha for assistance with an issue, and he very quickly helped resolve it. Wanda A · 28 Mar 2026 Stopped Newsletter Spam My newsletter signup was being continuously spammed. Chris helped me tweak the settings so that bots blocked and temporary spam email domains were filtered. Excellent product and team! Frank Power · 16 Mar 2026 Effortless Integration and Outstanding Support with Procaptcha I use Procaptcha with React. Procaptcha has been very easy to implement as they maintain a wrapper component that can be easily pulled from NPM. They have incredible customer service and are happy to answer any questions I have or help their community with their product. The component itself is flexible, allows styling with inline CSS, and even allows for theming. The puzzle is also not too difficult to solve and is a great middle ground as far as Captchas go. I originally came from using Cloudflare Turnstile and hCaptcha and have enjoyed my experience with Procaptcha significantly more. Nathan G · 11 Aug 2025 Prosopo's CAPTCHA widget I've installed Prosopo's CAPTCHA widget on my website to filter out spam from my contact form. Getting it working was a little bit tricky but the support from Chris has been first class. I wanted to use a CAPTCHA which was as easy as possible for my website's visitors while respecting their privacy and which didn't use cookies. Prosopo's CAPTCHA meets all these criteria. Update - after more than a week I haven't had a single spam form submission. Theo · 31 Mar 2025 Easy Integration, First-Class Bot Blocking I like that Procaptcha offers easy integration, which meant we didn't have to spend days getting it set up. It's cost-effective and reasonable, which is great for our budget. The bot blocking feature is first-class, effectively preventing scrapers from registering as users and clogging up our workflow. Joshua G · 30 Jan 2026
Questions
Something else? Ask an engineer.
Is Procaptcha GDPR compliant?
Does Procaptcha need a cookie banner entry?
No. The widget is cookieless by default, so there is no third-party tracking scope to consent to under the ePrivacy Directive.
Can I self-host Procaptcha?
Yes. You can run the open-source Procaptcha provider yourself in Docker, with proof-of-work and jigsaw puzzle challenges, and bring your own detector. Prosopo's detector, ML scoring, Access Rules, traffic filters and analytics stay on the managed plans; obfuscated detector bundles are available on request.
More from Prosopo
- Access Control — the Customer-Authored Layer Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
- Accessible CAPTCHA: verification that does not lock people out An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
- Enterprise Bot Protection — the Prosopo Platform Enterprise bot protection from Prosopo. A widget for your forms (Procaptcha), or protection at the edge that learns your site's normal traffic (Prosopo Protect), with one dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.
- Invisible CAPTCHA Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
- Prosopo Protect — Site-Wide and API Bot Protection Site-wide, API and form bot protection from Prosopo, sold as the Enterprise and Custom plans. Add it as a script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both. Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
- Residential proxy detection How Prosopo detects residential proxies: TCP connection checks against the claimed device, live IP intelligence and a proxy exit-IP catalogue we build ourselves, with a readable reason on every block. Available from the Professional plan.