Protect is sold as two plans. Enterprise starts at £1,500 a month (€1,750 / $1,990) with a dedicated support engineer and business-hours support, with a P1 response within 4 business hours. Custom starts at £2,500 a month (€2,950 / $3,300) with 24/7 support, a 15-minute P1 response, and custom SLA and data-residency terms. Both are priced by the number of sites you protect, traffic is not metered, there are no setup or onboarding fees, both plans run on a 12-month term, and paying annually upfront takes 15% off. Every deployment starts with 14 days in preview mode. Full details on the pricing page.
Prosopo Protect — Site-Wide and API Bot Protection
Prosopo Protect stops bots on your forms, API and whole site. It learns what normal traffic looks like on your site and blocks what doesn't fit, naming the reason for every block. From $1,990 a month, traffic not metered, and every deployment starts with 14 days in preview mode, so you see what it would block before it blocks anything.
Why teams deploy Prosopo Protect
Stops bots before origin
Every request is scored at the edge location closest to the visitor and blocked, challenged or passed through before it ever consumes an application round-trip. Bot load never eats capacity from real users.
Access Rules on every request
Enforce IP CIDR, ASN, country, User-Agent, JA4 TLS fingerprint and IP category (VPN, proxy, datacentre) rules from a single dashboard. Rules apply the moment they're saved — no code deploy, no re-provisioning.
Under 40 ms at p95
Protect calls the Prosopo API from the edge location closest to the request. On a production ticketing deployment the verification hop measured 39.3 ms at p95 over 30 days, inside the latency budget of login, checkout and search endpoints.
Different verdicts for HTML and JSON
Blocked HTML pages get a branded interstitial. JSON APIs get the right HTTP status and an X-Prosopo-Decision header, so your apps handle blocks cleanly.
First-party session cookie
A first-party prosopo_session cookie identifies the visitor's session. No third-party cookies and no cross-site tracking.
Every block comes with a reason
Blocks name the detector that fired, such as Solver service detected or Synthetic interaction timings, not a risk score. Every block and challenge carries an X-Prosopo-Request-Id header, so you can look any decision up in the portal.
Protect at a glance
Prosopo Protect is site-wide and API bot protection. It checks every request at your edge and blocks bots before they reach your servers.
| Price | From $1,990 a month, Custom from $3,300. See pricing |
| What it covers | Your forms, plus every page, JSON API and endpoint pattern on the sites in your contract |
| How you add it | A script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both |
| Mobile apps | Android and iOS SDKs sign each app request with a hardware-attested key (Play Integrity, App Attest) |
| Speed | Verification hop under 40 ms at p95 in production |
| Starting out | 14 days in preview mode: everything is checked, nothing is blocked, and you see your own numbers first |
| Every block | Names the detector that fired, with a request ID you can look up |
| Data | Request metadata only. EU-only processing on request, and a data processing agreement on every plan |
| Support | 09:00–17:30 UK time, Monday to Friday on Enterprise; 24/7 and a P1 response within 15 minutes on Custom |
What Prosopo Protect stops
Protect blocks the automated attacks that specifically depend on hitting your origin at volume:
- Scraping by AI-training crawlers, price aggregators and look-alike competitors — enforced at the edge, so scraper traffic never consumes origin capacity or shows up in access logs.
- Credential stuffing against login and password-reset endpoints — blocked before it reaches the authentication layer.
- Denial of inventory and ticket scalping — Access Rules by ASN and JA4 fingerprint catch the scalper-toolkit signature before the request reaches checkout.
- API abuse — carding, enumeration, mass-signup, scraping-via-API. Different verdicts for HTML pages and JSON APIs so client applications handle blocks cleanly.
- Stealth-headless browsers on residential proxies — the exact profile that gets past Cloudflare Bot Management's default posture, caught by JA4 fingerprinting and behavioural signals.
Protect and Procaptcha
Procaptcha (Free and Professional) checks each form submission on its own. Protect (Enterprise and Custom) sees every request to your site and API and learns what normal looks like there, so it also stops scraping, API abuse and credential stuffing that never touch a form. Protect plans include Procaptcha, so you never pay for both.
Sites and APIs — same worker, different verdicts
One Protect deployment handles both HTML site traffic and JSON API traffic on the same origin. The Access Rules are the same for both; only the block/challenge response shape changes to match what the client expects:
| HTML site pages | JSON API endpoints | |
|---|---|---|
| Block response | Server-rendered branded interstitial (logo, colours, typography configurable) | 403 with X-Prosopo-Decision: block |
| Challenge response | Interstitial page hosting a captcha the visitor solves before the request proceeds | 401 with X-Prosopo-Status: challenge — protect.js on the client intercepts the header, shows the challenge, and retries the request on success |
| Session-init response | Handled inline in the bootstrap | 401 with X-Prosopo-Status: no-session — protect.js intercepts and calls /session/init before retrying |
| Session cookie | First-party prosopo_session set by Protect to identify the session | Same cookie when the caller is a browser; API-only clients (mobile app, server-to-server) fall through to the standard no-session flow |
| Access Rules | Same rule set | Same rule set |
Mobile apps
Native apps don't run a browser, so Protect checks them a different way. The Android and iOS SDKs give the app a key that the device's own hardware vouches for, using Google Play Integrity with key attestation on Android and Apple App Attest on iOS, and sign each request with it. The edge checks that signature before the request reaches your API.
- Refuse rooted devices, emulators and sideloaded builds. Set the rules per Android app, so a production app can refuse them while a staging build still runs on emulators. You can also require strong integrity and pin your app's signing certificate.
- Block app traffic from data centres, not people on VPNs. A phone attesting from a hosting network is an emulator; a person browsing through a VPN is a customer. App traffic has its own rule, so blocking one doesn't block the other.
- See each surface separately. The portal breaks verdicts down by web, Android app and iPhone app.
Available on Enterprise and Custom.
Runtimes
- Cloudflare Workers — deployed as a Worker script bound to your zone or specific routes. Runs on Cloudflare's global network of edge locations. Compatible with the rest of your Cloudflare configuration (cache rules, page rules, Worker chains) without conflict.
- AWS Lambda@Edge — deployed as a Lambda function associated with your CloudFront distribution. Runs at CloudFront's PoPs before the request reaches your origin, so bot traffic never enters your AWS account.
Other runtimes are on the roadmap. If yours isn't listed, get in touch.
Access Rules
Rules match on IP range, ASN, country, User-Agent, JA4 TLS fingerprint and IP category (VPN, proxy, Tor, datacentre), alone or combined, globally or per site. They apply the moment you save them. See the Access Control Rules documentation.
Data handling
Protect processes only the request metadata it needs for a verdict: IP, headers, JA4 fingerprint and timing. Its only cookie is the first-party prosopo_session. EU-only processing is available on request. See the security page and the data processing agreement.
Related
- Prosopo Protect edge documentation: the Cloudflare Worker and Lambda@Edge deployments.
- Stop web scraping with Prosopo Protect: the main use case, end to end.
- Pricing: Enterprise and Custom.
One deploy to live
Deploy the Worker or Lambda@Edge, add a rule, watch preview mode until the baseline looks clean, then enforce.
- 01
Deploy the Worker
Publish the Prosopo Protect Worker script to your Cloudflare zone, or associate the Lambda@Edge function with your CloudFront distribution. Under 20 lines of configuration for either. See the Protect edge documentation for the full walkthrough.
- 02
Author Access Rules
Add rules in the Prosopo dashboard — block ASNs known for scraping, challenge visitors from high-risk countries, whitelist a partner IP range on your API. Rules take effect the moment they're saved, without a re-deploy.
- 03
Baseline, enforce, investigate
Run in preview mode for 14 days against live traffic first — Protect logs every verdict but doesn't block. Compare against your baseline of legitimate traffic. When the numbers look clean, switch to enforcement. Every block can be traced to the rule or detector that fired by looking up its
X-Prosopo-Request-Idin the portal.
See what's reaching your site
A Bot Exposure Assessment is a 30-minute call with an engineer. We look at your traffic, show where your current setup leaves gaps, and agree how a trial would be judged. Nothing to install first.
Questions
Something else? Ask an engineer.
How much does Prosopo Protect cost?
What is Prosopo Protect?
Prosopo Protect is bot protection for your forms, API and whole site. It sees every request and learns what normal traffic looks like on your site, so it catches abuse a single form never sees. You add it as a script tag on your forms, an edge worker (Cloudflare Workers or AWS Lambda@Edge), or both. At the edge, on each request Protect consults the Prosopo API for a verdict and applies your Access Rules. Different response shapes for HTML site pages (branded interstitial) and JSON API endpoints (HTTP status + X-Prosopo-Decision header). A first-party prosopo_session cookie identifies the session, and an X-Prosopo-Request-Id header on blocks and challenges (and forwarded to your origin on allowed requests) lets your team look up any decision in the portal.
How is Prosopo Protect different from Procaptcha (the widget)?
Procaptcha is a widget on a form: it checks each submission on its own, and your backend verifies the token with a /siteverify call. Protect (the Enterprise and Custom plans) sees every request to your forms, API and whole site and learns what normal traffic looks like there. Procaptcha suits form-only needs up to 1M requests a month. Protect plans include Procaptcha and share the same portal.
Where does Prosopo Protect deploy?
Wherever suits you: a script tag on your forms, an edge worker on Cloudflare Workers or on AWS Lambda@Edge with your CloudFront distribution, or both. Other edge runtimes are on the roadmap. If yours isn't listed, get in touch.
Can I write my own Access Rules?
Yes. At the edge, Access Rules match on IP CIDR, ASN, country, User-Agent substring, JA4 TLS fingerprint and IP category (VPN, proxy, datacentre and so on), individually or combined. Rules apply globally or per site. Full rule reference in the Access Control Rules documentation.
How does Prosopo Protect stack against Cloudflare Bot Management or DataDome?
Cloudflare Bot Management is included in the Cloudflare Enterprise WAF contract and works well against unsophisticated bots; it is routinely bypassed by stealth-headless frameworks (puppeteer-extra-stealth, playwright-stealth, undetected-chromedriver) running on residential proxies. Prosopo Protect can run inside the same Cloudflare Worker as a second adversarial layer with a different signal set — JA4 fingerprinting, behavioural analysis, adaptive challenge escalation — and every block comes with a reason you can read (Inconsistent hardware readings for device, Solver service detected, Synthetic interaction timings, etc.) rather than returning a black-box score. DataDome offers a similar model at enterprise pricing; Prosopo is the specialist alternative with an open-source client stack and a plain-language reason on every block.
Does Prosopo Protect break my caching?
No. Protect runs before the cache decision — the request is intercepted, Prosopo returns a verdict, and if the verdict is allow, the request proceeds to the cache/origin fetch normally. Cached responses are unchanged; only the scoring step is added.
More from Prosopo
- Access Control — the Customer-Authored Layer Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
- Accessible CAPTCHA: verification that does not lock people out An accessible CAPTCHA alternative. Invisible for most users, proof of work rather than an image challenge as the first escalation, image challenges disableable per site, keyboard and screen reader support.
- Enterprise Bot Protection — the Prosopo Platform Enterprise bot protection from Prosopo. A widget for your forms (Procaptcha), or protection at the edge that learns your site's normal traffic (Prosopo Protect), with one dashboard for both. Every block comes with a reason, in plain words, rather than a black-box score.
- Invisible CAPTCHA Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot comes with a reason you can read.
- Procaptcha: the GDPR-compliant CAPTCHA widget Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 requests a month.
- Residential proxy detection How Prosopo detects residential proxies: TCP connection checks against the claimed device, live IP intelligence and a proxy exit-IP catalogue we build ourselves, with a readable reason on every block. Available from the Professional plan.