No bots. No spam. No CAPTCHAs
Botpoison keeps bots out of your forms and spam out of your inbox, without asking anyone to prove they are human.
No credit card required.
- npm install @botpoison/browser, in your form
- npm install @botpoison/node, on your server
Two products. Use one, or both
01Before the submit
Challenge
Invisible CAPTCHA alternative
An invisible check runs in the visitor's browser before the form is sent. People never see it. Bots pay for every submission in CPU time.
How Challenge works02After the submit
Classify
Spam classifier
Send us a message, get back a verdict: a label and a score. It reads what was written, so it catches spam whoever, or whatever, typed it.
How Classify worksChallenge. A check only bots notice
An invisible CAPTCHA alternative that works in the background, in the visitor's browser. People never see it, and bots pay for every form they send.
Fig. 1Cost of the check
Classify. A spam classifier for every message
Classify reads each message and scores it. It catches spam from real people, and from not so real ones.
Fig. 2Contact form inbox
Review from a score of 0.5
- growth@rankfast.exampleSpamBoost your SEO ranking today, guaranteed page one0.8+
- Alex MoreauHeldCleanIs there a nonprofit discount? Our site is in my signature.0.62
- Jordan LeeCleanHi, could you send a quote for 40 seats?0.03
How it works. Before the submit, and after
Challenge
Invisible CAPTCHA alternative · before the submit
A check starts
The visitor presses Send, and their browser runs an invisible proof-of-work check.The solution rides along
The solution is sent with the form, in one hidden field.Your server checks it
One call to /verify. No valid solution, no submission.
Classify
Spam classifier · after the submit
Your server sends the submission
Post the form's fields as they arrived, or one string.Classify reads it
A label comes back, spam or clean, with the score behind it.You decide what happens
Deliver clean, file spam away, or hold the borderline ones for a look.
Where does spam reach you?
Each place needs a different mix. Pick yours to see the setup.
Contact and quote forms
Bots hit contact forms hardest, and the people who get through are mostly selling something.
- Add the public key to your form
- Verify the solution on your server
- Classify the message, file spam away
const { ok } = await verify(body._botpoison);if (!ok) return reject();const { label } = await classify({ message: body.message,});if (label === "spam") return fileAway(body);Private by design. Accessible by default
A CAPTCHA asks people to prove something. Botpoison asks nothing of them, and keeps only what the check needs.
Nothing to solve
No cookies
No visitor profile
Processed in the EU
Challenge never asks a person to do anything, so there is nothing to fail; only a browser that cannot run the check is stopped. Classify flags about 1 in 1,000 good messages at 0.8, counted across all the traffic in our reference set; a single site's own rate is usually higher. You choose what happens to flagged messages: file them away, or hold them for a look.
Challenge sets no cookies and builds no visitor profile. Classify runs in the EU (Ireland).
No. Use Challenge to stop bots, Classify to catch spam by what it says, or both. One plan covers both, with a separate allowance for each.
Classify answers a 503 that is not counted, and the docs show how to deliver the message as clean. Challenge needs our API to hand out a challenge, so the form reports an error you can handle on the page, and your server decides what to do with anything it receives.
Challenge counts each challenge issued, Classify each message classified, over the last 30 days. Test keys never count. We email a workspace's admins at 80% and at 100% of an allowance. Paid plans are never cut off. If a workspace stays over for 3 months in a row, we'll get in touch about a plan that fits.