It provides comprehensive protection against various automated threats, including webscraping, credential stuffing, account takeover attempts, click fraud, distributed denial of service (DDoS) attacks, inventory hoarding, credit card fraud, and other forms of malicious bot activity that can harm your online business or compromise user data.
Invisible CAPTCHA
Invisible CAPTCHA is Procaptcha's invisible-first mode. Real humans pass silently on behavioural, device and network signals; only suspected bots are ever shown a challenge. When a block does fire, it names the specific detector that caught it — Apple hardware spoofing, known CAPTCHA-solver service detected, synthetic mouse-event timings, HTTP header fingerprint mismatch — not a numerical risk-score bucket. Cookieless by default, GDPR-compliant, drop-in replacement for invisible reCAPTCHA v3 and Cloudflare Turnstile without the Google or Cloudflare data-processing footprint.
How the invisible-first mode works
Score every request in the background; challenge only when the signals warrant it; name the detector on every block.
Minimal data by default
The widget is cookieless, IP is the only personal data retained (on legitimate-interest grounds for fraud and security), and no cross-site behavioural profile is built of human users.
Silent for humans, named block for bots
Real users pass with no visible step. When a bot is stopped, the block returns a named detector — your team knows exactly what caught the request without opening a support ticket.
Drop-in integration
Same integration surface as reCAPTCHA v3, hCaptcha and Cloudflare Turnstile. A site-key swap and a script-tag change on most stacks.
Why Prosopo
Why teams pick Prosopo's invisible-first mode
Named detectors on every block
When a suspected bot is stopped, the block response names the specific detector that caught it — Apple hardware spoofing, known CAPTCHA-solver service detected, synthetic mouse-event timings, HTTP header fingerprint mismatch. Your team knows exactly what caught the request — no numerical score, no vendor-branded policy label.
Real humans never see it
Behavioural, device and network signals score every request in the background. Legitimate visitors pass silently; only suspected bots are ever escalated to a challenge.
GDPR-compliant by default
Cookieless widget, no cross-site profile of humans, EU-only verification endpoints on request. Fits inside a GDPR or DSGVO programme without adding an entry to your cookie banner.
Open source at the base
The widget stack is open source on GitHub. Your security team can review the client-side code before adoption; self-hosting is available for teams that need the full stack on their own infrastructure.
Free to 10,000 verifications
No card required for the first 10,000 monthly verifications. UK-incorporated, engineered in the UK. Enterprise support goes straight to the engineers who wrote the detectors.
How Invisible CAPTCHA works
Most of your users are human. The job of an Invisible CAPTCHA is to wave them through silently — and only stop them when there's a real reason to. Prosopo does this by analysing the browser environment and user behaviour in the background, then deciding on the fly whether the visitor needs a visible challenge.
When the signals come back clean, the visitor sees nothing — the form submits, the token is attached, and your server verifies it like any other captcha response. When the signals look automated — typical of a CAPTCHA solver or commercial CAPTCHA farm — the visitor is escalated to an image challenge before the form goes through.
If you're specifically looking for a Google-free equivalent of invisible reCAPTCHA v2, hidden reCAPTCHA or Google invisible CAPTCHA, Prosopo's Invisible CAPTCHA is a drop-in alternative — same "no widget for legitimate users, image challenge only when the risk score demands it" behaviour, without the Google third-party cookies, US data processing or google.com script tags that put many EU sites into a cookie-banner-and-DPA situation just to serve a form.
Three ways to run invisibly
Invisible CAPTCHA isn't a single mode — it's a family of three, so you can match the right level of protection to each form.
| Mode | What the user sees | When to use |
|---|---|---|
| Frictionless (recommended) | Nothing for legitimate users. An image challenge if the request looks automated. | Most forms — best balance of UX and security. |
| Invisible Proof of Work | Nothing — a computational puzzle runs silently in the browser. | When you want a consistent invisible step regardless of risk score. |
| Invisible Image | Nothing initially. An image challenge appears on submission. | When image verification is required but you don't want a visible widget on the page. |
Switching between them is a one-attribute change on your widget — no integration rewrite.
What Prosopo analyses to make the decision
Behind the scenes, the frictionless flow combines several signals to score each request:
- Browser environment — features and quirks that distinguish real browsers from headless automation tools like Playwright and Selenium.
- Interaction signals — natural mouse, touch and keyboard behaviour.
- Network context — whether the request comes from a network associated with bot traffic.
- Site policy — your Safety Threshold setting controls how strict the decision is. Tighter threshold = more challenges, fewer bots; looser threshold = fewer challenges, more bots squeak through.
You can tune the threshold in your portal at any time — useful for raising the bar during an active attack and lowering it back when the wave is over.
Designed for compliance
Invisible CAPTCHA is part of the same GDPR-friendly architecture as the rest of Procaptcha:
- No third-party tracking cookies.
- IP address is the only personal data stored, retained on the legitimate-interest grounds of fraud and security.
- No behavioural profiling sold on to advertisers — unlike the major reCAPTCHA-style competitors.
Availability
Invisible CAPTCHA is available on the Professional and Enterprise tiers. The standard visible widget remains free for up to 10,000 monthly verifications.
How Prosopo Invisible CAPTCHA compares
Full capability Partial / caveat Not available
| Capability | Prosopo Invisible | reCAPTCHA v3 | Cloudflare Turnstile |
|---|---|---|---|
| Invisible by default | ● | ● | ● |
| GDPR-compliant data handling | ● | ● | ● Limited |
| No third-party tracking cookies | ● | ● | ● |
| Switch between frictionless / PoW / image / puzzle modes per form | ● | ● | ● |
| Tunable strictness without code changes | ● | ● Limited | ● |
| Risk score returned to your backend | ● Paid tiers | ● | ● Limited |
| Named detector reason on every block | ● Technical string | ● Score only | ● Score only |
Common use cases
- Stop credential stuffing at login without adding visible friction for real users.
- Defend signup forms against fake-account creation.
- Protect black-friday checkout flows without slowing legitimate buyers down.
- Prevent scraping of high-value pages.
Integration and configuration reference
Get started in 3 steps
Self-serve setup takes about ten minutes end to end.
1
Step 1: Get a site key
Sign up for a Prosopo site key. No card required up to 10,000 monthly verifications.
2
Step 2: Drop in the widget
Swap Procaptcha in where reCAPTCHA v3, hCaptcha or Turnstile sits today. Framework integrations for React, Vue, Angular and Svelte are in the docs.
3
Step 3: Verify server-side
Verify tokens in the backend. When a block fires, the response carries the named detector that caught the request — greppable in your logs, filterable in the portal.
By the numbers
Trusted by companies of all sizes.
Active websites
0+
Monthly verifications
0+
Bots stopped per month
0+
Reviews
Our customers love us.
Hundreds of businesses have made the switch from reCAPTCHA and hCaptcha to Prosopo. Here's what they have to say.
Frequently Asked Questions
What types of bot attacks can Procaptcha Invisible protect against?
How does Prosopo's Invisible CAPTCHA compare to other invisible-first options?
Prosopo is the specialist option in the invisible-first category. Every block names the specific detector that caught it — Apple hardware spoofing, known CAPTCHA-solver service detected, synthetic mouse-event timings, HTTP header fingerprint mismatch — not a numerical risk score. Full comparison against reCAPTCHA, hCaptcha, DataDome, Cloudflare Turnstile, Akamai Bot Manager, Castle.io, HUMAN and FriendlyCaptcha on the Forrester Wave 2026 breakdown.
What is Procaptcha Invisible CAPTCHA?
Invisible CAPTCHA is a security solution that operates in the background, verifying users without interrupting their browsing experience. It uses advanced algorithms to analyze user behavior and interactions, ensuring that only legitimate users can access your content.
How does Procaptcha's Invisible mode work?
Procaptcha dynamically evaluates user interactions by analyzing browser environments and behavior. Based on risk scores, it automatically applies the appropriate challenge, making it difficult for bots to bypass while ensuring real users see nothing at all.
Can Procaptcha Invisible distinguish between good bots and bad bots?
Yes, Procaptcha Invisible intelligently differentiates between beneficial bots (like search engine crawlers) and harmful bots by analyzing behavior, origin, and intent. It ensures that only trusted bots and genuine users gain access while blocking threats.
Does Procaptcha Invisible require storing user data?
No, our solution is privacy-first and compliant with data protection regulations. We store IP address only, which we store on the grounds of legitimate interest to prevent fraud and to ensure the network and information security of your IT systems.
More from Prosopo
What else can Prosopo protect for you?
No matter the threat, we have a solution to keep your business safe.
Product
Access Control — the Customer-Authored Layer
Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
Learn more
Product
Enterprise Bot Protection — the Prosopo Platform
Enterprise bot protection from Prosopo. One detection engine, delivered as a widget (Procaptcha) or at the edge (Prosopo Protect), same dashboard for both. Every block names the specific detector that caught it — not a black-box score.
Learn moreProduct
Invisible CAPTCHA
Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot names the detector that caught it.
Learn moreProduct
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 verifications per month.
Learn more
Product
Prosopo Protect — Site-Wide and API Bot Protection
Site-wide and API bot protection from Prosopo — deploy at the edge (Cloudflare Workers, AWS Lambda@Edge) or as a server-side integration (nginx, Caddy, custom reverse proxies). Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
Learn moreProduct
Residential proxy detection
How Prosopo detects residential proxies — TCP fingerprint interrogation, IP intelligence, and a self-maintained proxy-vendor catalogue. Available on the Enterprise plan.
Learn moreProduct
Spam Filter: Add-on for Procaptcha and Prosopo Protect
Spam Filter is a Procaptcha add-on that blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
Learn more