hCaptcha

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me bot protection that replaces hCaptcha — and read this first, because the verdict is unusually pointed.

**A challenge model trained on traffic across the whole web is the only thing that identifies a bot reliably, and you cannot have one.** What you can do is remove most of the reason to need it. The majority of what a captcha stops on a small site is stopped just as well by a honeypot, a timing check and a rate limit — and those cost your real users nothing, which a captcha always does. Build those first, and add a challenge only if abuse survives them.

STACK
- Node 20+ with Fastify
- SQLite through better-sqlite3, WAL mode
- A small client script, or none at all for the server-side measures
- Caddy in front

THE MEASURES THAT COST HONEST USERS NOTHING, IN ORDER
- **A honeypot field**: hidden from people, filled by naive bots. Free, invisible, and it stops a large share
- **A timing token**: a signed value issued when the form is rendered, checked on submission. A form completed in under a second was not completed by a person. Also free and invisible
- **Rate limits** per salted address hash, per form and globally, with a burst allowance
- **Content signals** scored rather than judged: link count, all-capitals, known phrases, a missing or mismatched referrer, a user agent that is a library
- **Nothing silently dropped.** Everything above a threshold is held for review, because a false positive is a real person who thinks they were ignored
- Measure what each one catches. Most sites discover that the first two account for nearly all of it, and then the captcha was never needed

A PROOF-OF-WORK CHALLENGE, IF YOU STILL NEED ONE
- The client solves a small computational puzzle before submitting: find a nonce whose hash meets a difficulty target
- Invisible to the user, costs a bot a measurable amount of time and electricity per attempt, and requires no image recognition, no third party, and no data about the visitor
- Difficulty adjusted by risk: near zero for a first submission, higher after failures from the same address hash
- Verified on the server against a signed challenge with a short expiry and single use
- It does not stop a determined attacker with hardware. It makes mass submission expensive, which is the actual goal, and it is what the open alternatives in this category do

WHAT NOT TO BUILD
- Image challenges. They are solved commercially for a fraction of a penny each, so they stop nobody who is paying, and they are a genuine barrier for people with visual impairments, motor difficulties or a slow connection
- A behavioural fingerprint of mouse movement and typing rhythm. It is invasive, it is a privacy problem you do not want, and it fails for anybody using a keyboard or assistive technology
- Anything that blocks submission with no alternative path. Every challenge needs a route for somebody who cannot complete it

ACCESSIBILITY, WHICH IS THE ARGUMENT AGAINST THIS WHOLE CATEGORY
- A captcha is the most common accessibility barrier on the web. Whatever you build must be operable by keyboard, invisible to a screen reader when it is invisible to everyone, and never the only way to reach the thing behind it
- If a person fails the challenge, offer a way through: a queued submission a human reviews, or an email route. That path is not optional

THE DATA MODEL
- challenges: id, token_hash, difficulty, issued_at, expires_at, solved_at, ip_hash
- attempts: id, form_key, outcome, score, reasons_json, ip_hash, user_agent_bucket, at — append-only, and this is how you learn what is actually attacking you
- blocklist: kind, value, reason, expires_at

OPERATIONS
- .env: DATABASE_PATH, SIGNING_SECRET, HASH_SALT, BASE_URL
- Migrations on boot, each once; a retention policy with a sweeper
- Health endpoint

WHAT MATTERS MOST
Measuring before adding friction. Instrument the honeypot, the timing token and the rate limits, run them for a fortnight, and look at what still gets through. On most sites the answer is nothing, and the right build is the one with no challenge in it at all.