It protects the forms you add it to against automated abuse: fake sign-ups, spam submissions, credential stuffing and account takeover attempts on a login form. Scraping, API abuse and inventory hoarding happen away from your forms; for those, Enterprise (Prosopo Protect) covers your API and whole site.
Invisible CAPTCHA
Invisible CAPTCHA is Procaptcha's invisible-first mode. Real humans pass silently on behavioural, device and network signals; only suspected bots are ever shown a challenge. When a block does happen, it comes with a reason — Inconsistent hardware readings for device, Solver service detected, Synthetic interaction timings, HTTP header fingerprint mismatch — not a numerical risk-score bucket. Cookieless by default, GDPR-compliant, drop-in replacement for invisible reCAPTCHA v3 and Cloudflare Turnstile without the Google or Cloudflare data-processing footprint.
How the invisible-first mode works
Score every request in the background; challenge only when the signals warrant it; give a reason on every block.
- 01
Minimal data by default
The widget is cookieless, IP is the only personal data retained (on legitimate-interest grounds for fraud and security), and no cross-site behavioural profile is built of human users.
- 02
Silent for humans, named block for bots
Real users pass with no visible step. When a bot is stopped, the block returns a reason in plain words — your team knows what stopped the request without opening a support ticket.
- 03
Drop-in integration
Same integration surface as reCAPTCHA v3, hCaptcha and Cloudflare Turnstile. A site-key swap and a script-tag change on most stacks.
Why teams pick Prosopo's invisible-first mode
A reason on every block
When a suspected bot is stopped, the block response carries the reason — Inconsistent hardware readings for device, Solver service detected, Synthetic interaction timings, HTTP header fingerprint mismatch. Your team knows exactly what caught the request — no numerical score, no vendor-branded policy label.
Real humans never see it
Behavioural, device and network signals score every request in the background. Legitimate visitors pass silently; only suspected bots are ever escalated to a challenge.
GDPR-compliant by default
Cookieless widget, no cross-site profile of humans, EU-only verification endpoints on request. Fits inside a GDPR or DSGVO programme without adding an entry to your cookie banner.
Open source at the base
The widget stack is open source on GitHub. Your security team can review the client-side code before adoption; self-hosting is available for teams that need the full stack on their own infrastructure.
Free to 10,000 requests a month
No card required for the first 10,000 requests a month. UK-incorporated, engineered in the UK. Support goes straight to the engineers who wrote the detectors.
How Invisible CAPTCHA works
Most of your users are human. The job of an Invisible CAPTCHA is to wave them through silently — and only stop them when there's a real reason to. Prosopo does this by analysing the browser environment and user behaviour in the background, then deciding on the fly whether the visitor needs a visible challenge.
When the signals come back clean, the visitor sees nothing — the form submits, the token is attached, and your server verifies it like any other captcha response. When the signals look automated — typical of a CAPTCHA solver or commercial CAPTCHA farm — the visitor is escalated to an image challenge before the form goes through.
If you're specifically looking for a Google-free equivalent of invisible reCAPTCHA v2, hidden reCAPTCHA or Google invisible CAPTCHA, Prosopo's Invisible CAPTCHA is a drop-in alternative — same "no widget for legitimate users, image challenge only when the risk score demands it" behaviour, without the Google third-party cookies, US data processing or google.com script tags that put many EU sites into a cookie-banner-and-DPA situation just to serve a form.
Three ways to run invisibly
Invisible CAPTCHA isn't a single mode — it's a family of three, so you can match the right level of protection to each form.
| Mode | What the user sees | When to use |
|---|---|---|
| Frictionless (recommended) | Nothing for legitimate users. An image challenge if the request looks automated. | Most forms — best balance of UX and security. |
| Invisible Proof of Work | Nothing — a computational puzzle runs silently in the browser. | When you want a consistent invisible step regardless of risk score. |
| Invisible Image | Nothing initially. An image challenge appears on submission. | When image verification is required but you don't want a visible widget on the page. |
Switching between them is a one-attribute change on your widget — no integration rewrite.
What Prosopo analyses to make the decision
Behind the scenes, the frictionless flow combines several signals to score each request:
- Browser environment — features and quirks that distinguish real browsers from headless automation tools like Playwright and Selenium.
- Interaction signals — natural mouse, touch and keyboard behaviour.
- Network context — whether the request comes from a network associated with bot traffic.
- Site policy — your Safety Threshold setting controls how strict the decision is. Tighter threshold = more challenges, fewer bots; looser threshold = fewer challenges, more bots squeak through.
You can tune the threshold in your portal at any time — useful for raising the bar during an active attack and lowering it back when the wave is over.
Designed for compliance
Invisible CAPTCHA is part of the same GDPR-friendly architecture as the rest of Procaptcha:
- No third-party tracking cookies.
- IP address is the only personal data stored, retained on the legitimate-interest grounds of fraud and security.
- No behavioural profiling sold on to advertisers — unlike the major reCAPTCHA-style competitors.
Availability
Invisible mode is on every Procaptcha plan, including Free, which covers up to 10,000 requests a month.
How Prosopo Invisible CAPTCHA compares
Full capability Partial / caveat Not available
| Capability | Prosopo Invisible | reCAPTCHA v3 | Cloudflare Turnstile |
|---|---|---|---|
| Invisible by default | ● | ● | ● |
| GDPR-compliant data handling | ● | ● | ● Limited |
| No third-party tracking cookies | ● | ● | ● |
| Switch between frictionless / PoW / image / puzzle modes per form | ● | ● | ● |
| Tunable strictness without code changes | ● | ● Limited | ● |
| Risk score returned to your backend | ● Paid tiers | ● | ● Limited |
| Plain-language reason on every block | ● Technical string | ● Score only | ● Score only |
Common use cases
- Stop credential stuffing at login without adding visible friction for real users.
- Defend signup forms against fake-account creation.
- Protect black-friday checkout flows without slowing legitimate buyers down.
- Scraping happens away from your forms, so it needs Enterprise (Prosopo Protect) rather than a form widget.
Integration and configuration reference
Get started in 3 steps
Self-serve setup takes about ten minutes end to end.
- 01
Get a site key
Sign up for a Prosopo site key. No card required up to 10,000 requests a month.
- 02
Drop in the widget
Swap Procaptcha in where reCAPTCHA v3, hCaptcha or Turnstile sits today. Framework integrations for React, Vue, Angular and Svelte are in the docs.
- 03
Verify server-side
Verify tokens in the backend. When a block fires, the response carries the reason it was stopped — greppable in your logs, filterable in the portal.
See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
What types of bot attacks can Procaptcha Invisible protect against?
How does Prosopo's Invisible CAPTCHA compare to other invisible-first options?
Prosopo is the specialist option in the invisible-first category. Every block comes with a reason in plain words — Inconsistent hardware readings for device, Solver service detected, Synthetic interaction timings, HTTP header fingerprint mismatch — not a numerical risk score. Full comparison against reCAPTCHA, hCaptcha, DataDome, Cloudflare Turnstile, Akamai Bot Manager, Castle.io, HUMAN and FriendlyCaptcha on the Forrester Wave 2026 breakdown.
What is Procaptcha Invisible CAPTCHA?
Invisible CAPTCHA is a security solution that operates in the background, verifying users without interrupting their browsing experience. It uses advanced algorithms to analyze user behavior and interactions, ensuring that only legitimate users can access your content.
How does Procaptcha's Invisible mode work?
Procaptcha dynamically evaluates user interactions by analyzing browser environments and behavior. Based on risk scores, it automatically applies the appropriate challenge, making it difficult for bots to bypass while ensuring real users see nothing at all.
Can Procaptcha Invisible distinguish between good bots and bad bots?
Yes, Procaptcha Invisible intelligently differentiates between beneficial bots (like search engine crawlers) and harmful bots by analyzing behavior, origin, and intent. It ensures that only trusted bots and genuine users gain access while blocking threats.
Does Procaptcha Invisible require storing user data?
No, our solution is privacy-first and compliant with data protection regulations. We store IP address only, which we store on the grounds of legitimate interest to prevent fraud and to ensure the network and information security of your IT systems.
More from Prosopo
- Access Control — the Customer-Authored Layer Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
- Accessible CAPTCHA: verification that does not lock people out An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
- Spam Filter for Procaptcha and Prosopo Protect Spam Filter is part of Procaptcha. It blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
- Prosopo Protect — Site-Wide and API Bot Protection Site-wide, API and form bot protection from Prosopo, sold as the Enterprise and Custom plans. Add it as a script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both. Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
- Residential proxy detection How Prosopo detects residential proxies: TCP connection checks against the claimed device, live IP intelligence and a proxy exit-IP catalogue we build ourselves, with a readable reason on every block. Available from the Professional plan.
- Enterprise Bot Protection — the Prosopo Platform Enterprise bot protection from Prosopo. A widget for your forms (Procaptcha), or protection at the edge that learns your site's normal traffic (Prosopo Protect), with one dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.