Bot protection is the practice of detecting and stopping automated attacks against your web and mobile app. It combines behavioural analysis, device and TLS fingerprinting (JA4), network reputation and adaptive challenges. Layers stack so if one signal is spoofed, another catches the attacker. Prosopo runs the same stack at the CDN edge, inside your backend SDK and in the widget on any form, so one platform covers your whole site.
Enterprise Bot Protection — the Prosopo Platform
One detection engine, installed where your traffic lands. Procaptcha on individual forms; Prosopo Protect in front of an entire site or JSON API (Cloudflare Worker / Lambda@Edge or nginx / Caddy / custom reverse proxy). Same Access Rules, same dashboard, same event stream in both — every verdict comes back with a reason your team can read, not a black-box score. Spam Filter is available as an add-on to either.
Detect, decide, explain
One rules engine, one dashboard, one event stream. Same behaviour whether the request came through the widget on a form, edge enforcement in front of origin, or the backend SDK inside your app.
Detect
Every request is scored against behavioural signals (cursor, scroll, typing rhythm, SIMD-CPU signatures), JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest and Android Play Integrity, IP reputation and residential-proxy classification.
Decide
Machine-learning models combine the collected signals into a risk score. Real humans and authorised agents pass invisibly. Suspicious sessions get a proof-of-work, puzzle or image challenge, all configurable per site. Known-bad traffic never reaches your server.
Explain
Every block response includes the rule that fired. Drill into the event in the portal (the same view our engineers use) or stream it out to Datadog, Splunk, Elastic or Sentinel.
Why Prosopo
Why teams pick Prosopo
Named detectors on every block
The bulk of what stops bots is a library of named detectors. When a block fires, the response names the specific detector — Apple hardware spoofing, known CAPTCHA-solver service detected, synthetic mouse-event timings, HTTP header fingerprint mismatch. Not a numerical score. Not a vendor-branded policy label. Your team knows what caught the request without opening a support ticket.
Your data in your SIEM
Every event streams to Datadog, Splunk, Elastic or Sentinel. Filter by JA4 fingerprint, timing signal, rule fired, request payload. The raw data our engineers use to build the next detector, not a curated summary.
Open source at the base
Our base captcha is published on GitHub, and self-hosting is available. The advanced site-wide, behavioural and intent-scoring layers are proprietary, but they run on the same open challenge stack that your security team can review before adoption.
One stack, whole site
The same detection runs at the CDN edge, inside your backend SDK, and in the drop-in widget on any form. Same rules, same dashboard, same event stream, whichever way you deploy it.
Signals bots can't fake
JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest, Android Play Integrity, stealth-headless detection and residential-proxy classification. The signals bot toolkits can't spoof cleanly, with every event visible in your dashboard and exportable to your own tools.
Fits your compliance programme
Cookieless widget, no cross-site profiling of humans, EU-only verification endpoints on request. Designed to sit inside GDPR, CCPA and HIPAA programmes without adding an entry to your cookie banner. UK-incorporated, engineered in the UK; enterprise support goes straight to the engineers who built the platform.
What Prosopo stops
Prosopo blocks the automated attacks that most directly impact revenue, security and user trust:
- Credential stuffing and account takeover on login and password-reset flows.
- Scraping by AI-training crawlers, price aggregators and look-alike competitors.
- Ticket scalping toolkits on high-demand on-sales.
- Denial of inventory that reserves stock across sneaker drops and limited releases.
- Spam form submissions and disposable-email signups.
- Unwanted AI shopping agents that sit between real humans and the automation you don't want.
A decade ago, a CAPTCHA and an IP blocklist were sufficient. Today they are not. Stealth headless browsers on rotating residential proxies pass an image CAPTCHA in milliseconds, at fractions of a cent, via CAPTCHA-solving farms that operate at industrial scale. Effective bot protection now requires continuous silent detection, adaptive challenges applied only when the risk score demands it, and a clear, auditable reason for every request that is blocked.
How the detection works
Three inspectable layers, in order.
First, a library of named detectors that fires against pattern-matches in the traffic. Signals combined include JA4 TLS fingerprinting, DNS resolver observation, iOS App Attest, Android Play Integrity, stealth-headless-browser detection, residential-proxy classification, cursor and scroll behaviour, and SIMD-CPU signatures. When a detector fires, the block response names it. A few real examples of what the platform catches, with the underlying technical string in each case:
| What it catches | Underlying detector string |
|---|---|
| Apple hardware spoofing — a bot claims Safari-on-macOS in the User-Agent but the CPU behaves like Android or Linux | SIMD timings inconsistent with claimed Apple hardware |
| Known CAPTCHA-solver service — request pattern matches the fingerprint of a commercial solving service | 2Captcha solver detected |
| Synthetic mouse-event timings — mouse-move rhythm no human keyboard-and-mouse produces | Synthetic mouse-event timing pattern |
| HTTP header fingerprint mismatch — client-hints headers don't agree with the claimed User-Agent | User-Agent and sec-ch-ua-platform mismatch |
| Malformed HTTP header signature — request headers no real browser would emit | accept-language contains duplicate q-parameter |
Second, your own Access Rules layer on top for policy the default detectors don't yet cover — block a specific ASN pattern, gate a country on a checkout endpoint, whitelist a partner IP range. Third, in Prosopo Protect, an ML model scores request intent across the human / agent / bot boundary — the layer that decides whether an agentic browser is acting on behalf of a real customer or automating abuse.
Every layer surfaces a readable trigger on a block. Real users pass invisibly. Suspicious sessions get a proof-of-work, puzzle or image challenge. Known-bad traffic never reaches your servers.
Live examples of what Prosopo is protecting in production today:
- Ticketing platforms. Full-traffic edge deployment against professional ticket-touting bots, including VM-iOS and real-device botnets.
- Subscription SaaS with free-tier scraping. The look-alike competitor pattern common in face-search, reverse-image, people-search and small-API businesses.
- Crypto-wallet login endpoints. Blocking CAPTCHA-solver services attempting account takeover.
How Prosopo compares to DataDome, HUMAN and Arkose
| Capability | Prosopo | DataDome | HUMAN | Arkose Labs |
|---|---|---|---|---|
| Behavioural analysis | ● | ● | ● | ● |
| Residential-proxy detection | ● | ● | ● | ● |
| Invisible-first UX (no default challenge) | ● | ● | ● | ● game challenges |
| EU-hosted processing | ● | ● enterprise | ● | ● |
| Widget cookieless by default | ● | ● | ● | ● |
| Named detector reason on every block | ● Technical string | ● GenAI summary | ● Sightline view | ● "Telltales" |
| Raw event stream exportable to your SIEM | ● Datadog / Splunk / Elastic / Sentinel | ● Vendor dashboard | ● Vendor dashboard | ● Vendor dashboard |
| Agent-aware policy (AI agents) | ● | ● | ● | ● |
For a CAPTCHA-layer comparison across the wider market, see Cloudflare Turnstile alternatives.
The alternative to Imperva, HUMAN, AWS WAF and Cloudflare
Evaluating Cloudflare Bot Management, Imperva Advanced Bot Protection, AWS WAF Bot Control or HUMAN Bot Defender (formerly PerimeterX)? Three reasons teams pick Prosopo instead:
- Open source you can inspect. The base captcha is published on GitHub, so your security team can review the client-side code before adoption.
- Rules you can name. Every block traces back to a human-readable Access Rule in your dashboard, not to a black-box model score you cannot audit.
- A self-hosted option. If you need to run the platform fully on your own infrastructure, an obfuscated bundle of the advanced detection layers is available so no data has to leave your network.
All UK-incorporated, EU-processed, and available on a free tier so the fundamentals are not restricted to enterprise contracts.
Use cases
- Credential stuffing and account takeover. Password-replay and ATO on login and reset flows.
- Web scraping and free-tier abuse. AI-training crawlers, price aggregators, and look-alike competitors mining free-tier output for a look-alike product.
- Denial of inventory. Hoarding bots that reserve stock across sneaker drops, limited releases and on-sales.
- Ticket scalping. Professional scalper toolkits on ticketing platforms and venues, blocked with edge-mode enforcement.
- Spam bot protection. Form spam, fake signups, disposable-email abuse.
- Phishing defence. Verifying inbound traffic on authentication endpoints.
Deploy it wherever your traffic lives
Same detection stack, same rules, same dashboard, wherever it runs:
- Edge enforcement. The primary mode for whole-site coverage. Verifies on Cloudflare Workers, AWS Lambda@Edge or Fastly Compute@Edge before requests reach your origin.
- Backend SDK. For stacks without an edge worker. Node, PHP, Python, Go, Java, Ruby and .NET.
- API gateway. In front of your APIs, returning a risk score on every request so your backend can decide what to do.
- Drop-in widget. For form-level protection: login, signup, checkout, contact, comment. Open source on GitHub for a code review before it goes live.
- WordPress and CMS plugins. 16 WordPress integrations, including Contact Form 7, Gravity Forms and WPForms.
Privacy and compliance built in
- Cookieless widget by default. Nothing to add to your cookie banner under the ePrivacy Directive. Edge-mode deployments may set first-party session cookies for session continuity only.
- Fits GDPR, CCPA and HIPAA programmes. A Data Processing Agreement is available for enterprise customers, and your data is never resold to ad networks or used as a cross-tenant training signal without your opt-in.
- Bots profiled cross-site, real users are not. A scraper we spot on one customer's site is blocked when it shows up on yours; real users are never cross-site tracked.
- EU-only or US-only verification endpoints on request. Pick the region your verification data is processed in.
- UK-incorporated, EU-processed. Full details in the privacy policy.
Book a call with a security engineer
Ready to evaluate? Bring an attack log or your threat model to the first call. The demonstration is far more useful when it runs against your own traffic than against a scripted one, and the first call is 30 minutes with a Prosopo engineer, not a sales representative.
- Book an enterprise call. See what Prosopo catches on your traffic before the pricing conversation.
- Read the Forrester Wave 2026 breakdown. How Prosopo compares against DataDome, HUMAN, Kasada, Arkose, CHEQ, Netacea, hCaptcha and Google reCAPTCHA Enterprise.
- Compare CAPTCHA-layer solutions. How the Prosopo widget stacks up against the rest of the market.
PoC to production in days
Three steps, not a six-month vendor onboarding.
1
Step 1: Talk to an engineer
Book a 30-minute call directly with a Prosopo engineer, not a sales representative. Bring an attack log or your current threat model, and we will demonstrate exactly what Prosopo catches on your live traffic before any pricing conversation.
2
Step 2: Integrate
Drop-in widget for forms. Edge deployment on Cloudflare Workers, AWS Lambda@Edge or Fastly Compute@Edge for full-traffic protection. Backend SDKs for Node, PHP, Python, Go, Java, Ruby and .NET.
3
Step 3: Baseline, deploy, investigate
Prosopo baselines your legitimate traffic before enforcement is enabled, so real users see nothing when the platform goes live. From then on, every block is traceable to a specific rule in the portal or over the API.
By the numbers
Trusted by companies of all sizes.
Active websites
0+
Monthly verifications
0+
Bots stopped per month
0+
Reviews
Our customers love us.
Hundreds of businesses have made the switch from reCAPTCHA and hCaptcha to Prosopo. Here's what they have to say.
Frequently Asked Questions
What is bot protection?
How is bot protection different from a CAPTCHA?
A CAPTCHA is one layer: a challenge shown to the user. Bot protection is the whole system: silent detection, adaptive escalation to a challenge only when the score demands it, and an integrated response (block, throttle, step-up). Modern bots defeat single-layer CAPTCHAs cheaply via solving farms, so the detection has to happen before the CAPTCHA fires.
Can Prosopo stop credential stuffing and account takeover?
Yes. Every login and password-reset request is scored against behavioural, device, JA4 and network signals. Real users pass invisibly, credential-replay infrastructure is throttled or blocked, and every block returns the reason and the signals that fired. See the credential stuffing use case for the full pattern.
Does Prosopo fit our GDPR, CCPA and HIPAA compliance work?
Yes. The widget is cookieless by default (edge-mode deployments may set first-party session cookies for continuity), real users are not profiled across sites, and EU-only verification endpoints are available on request. The data-handling posture is designed to sit inside GDPR, CCPA and HIPAA programmes; a Data Processing Agreement is available for enterprise customers. UK-incorporated, engineered in the UK. See the GDPR-compliant CAPTCHA page for the full data-handling posture.
Can Prosopo run self-hosted?
Yes. The base captcha (challenges, collectors, client integration) is open source on GitHub, so you can review the code and self-host the challenge stack. The advanced site-wide, behavioural and intent-scoring layers are proprietary; if you need those running fully on your own infrastructure, we provide a periodic obfuscated bundle so the open-source side remains reproducible and the proprietary side stays current with the threat model.
Which bot management vendors did Forrester name in Q2 2026?
Forrester's Q2 2026 Wave for Bot and Agent Trust Management named DataDome, HUMAN and Kasada as Leaders; Arkose Labs, CHEQ and Netacea as Strong Performers; hCaptcha and Google reCAPTCHA Enterprise as Contenders. Prosopo is the specialist alternative in the same category, with every verdict traceable to a human-readable rule instead of a black-box score. Full comparison on the Forrester Wave 2026 breakdown.
More from Prosopo
What else can Prosopo protect for you?
No matter the threat, we have a solution to keep your business safe.
Product
Access Control — the Customer-Authored Layer
Access Control is the customer-authored rules layer of the Prosopo platform — layered on top of the named-detector library that catches the bulk of bots by default.
Learn moreProduct
Enterprise Bot Protection — the Prosopo Platform
Enterprise bot protection from Prosopo. One detection engine, delivered as a widget (Procaptcha) or at the edge (Prosopo Protect), same dashboard for both. Every block names the specific detector that caught it — not a black-box score.
Learn moreProduct
Invisible CAPTCHA
Prosopo's Invisible CAPTCHA is the invisible-first mode of Procaptcha — real users see nothing, and every block on a suspected bot names the detector that caught it.
Learn more
Product
Procaptcha: the GDPR-compliant CAPTCHA widget
Procaptcha is Prosopo's CAPTCHA widget — a drop-in reCAPTCHA and hCaptcha replacement, cookieless by default, GDPR-compliant, free for the first 10,000 verifications per month.
Learn more
Product
Prosopo Protect — Site-Wide and API Bot Protection
Site-wide and API bot protection from Prosopo — deploy at the edge (Cloudflare Workers, AWS Lambda@Edge) or as a server-side integration (nginx, Caddy, custom reverse proxies). Access Rules on every request, allow/block/challenge verdicts, branded interstitials on HTML pages, clean HTTP status + header on JSON APIs.
Learn moreProduct
Residential proxy detection
How Prosopo detects residential proxies — TCP fingerprint interrogation, IP intelligence, and a self-maintained proxy-vendor catalogue. Available on the Enterprise plan.
Learn moreProduct
Spam Filter: Add-on for Procaptcha and Prosopo Protect
Spam Filter is a Procaptcha add-on that blocks fake signups, throwaway emails and abusive-network traffic during each verification — without you writing any extra integration code.
Learn more