Weekly report
Traffic, outcomes, attacks, new suspicious networks and solve times, once a week.
Stop automated sign-ups without slowing real customers.
OTCaptcha verifies every visitor in the background, raises the cost for suspicious traffic and tightens by itself during an attack.
For sign-up, login, password reset and any other form.
Most visitors see neither. The loader is about 12 KB gzipped, and a background solve takes 30 to 130 ms in a desktop browser.
The check steps up only as far as the risk warrants.
Each step looks like part of your page, in your colour and in the visitor's language.
- Most visitors
- Nothing at all. The check runs while they finish the form. The page stays responsive, and there is nothing to click.
- Looks suspicious
- A short press and hold. A small box asks them to press and hold until it fills. It says what to do if they let go early, and it works with a finger, a mouse or a keyboard.
- Looks automated
- A slide puzzle. They slide a piece into the gap. A miss shakes the handle and lets them try again. Anyone who cannot drag can switch to the hold.
Try all three in your browser, or see how the box takes your brand.
Three layers, in order
Every attempt goes through all three. None of them asks a normal visitor to do anything.
Proof of work
The visitor's device completes a short calculation in the background. Trivial once, costly at scale.
Risk signals
Automation traces, network origin and inconsistent device details are scored together. No single signal decides.
Server verification
Your backend confirms each pass. A pass works once and expires in minutes.
Attack response that runs itself
OTCaptcha learns your usual traffic. When volume or suspicious activity jumps, it steps up protection, then steps back down once the attack ends. Nobody has to be woken up.
Normal protectionProtection raised automatically
| State | Work per attempt | Suspicious visitors |
|---|---|---|
| Normal | 1x | Standard checks |
| Elevated | 2x | Held sooner |
| Severe | 4x | Held at the lowest risk score |
What your developer does
- On the page
- One script, loaded with the page. It asks for a pass in the background.
- On your server
- One request to confirm the pass before the form is acted on. The secret never leaves your server.
- Size
- About 12 KB gzipped loader, under 11 KB with brotli.
- Hosting
- Host the file yourself or load it from us.
- Outage
- Your sign-ups stay open if our service is unreachable.
- Look
- Brand colour, corner radius and light or dark, set per site.
Sample integration
// In the browser const pass = await otcaptcha.check("[SITE KEY]"); // On your server const valid = await otcaptcha.verify(pass, "[SECRET]"); if (!valid) return rejectSignUp();
What you get back
Protection you can read about, not just trust. Every check is recorded without personal data, and the reports answer the questions a team asks after an attack.
Attack timelines
Every automatic escalation is kept as one event: when it started, what raised it, which networks and countries were involved, and when it ended.
Challenge funnel
How many visitors who saw a hold or a puzzle finished it, gave up, or switched to the other check. Visitors who leave never reach your server, so this is the only place they show up.
Sites that never verify
A site that shows the check but never confirms passes on its server is unprotected. We name it, so an integration gap is noticed before an attacker does.
Request early access
We are onboarding a small number of teams first.