Multi-layer abuse protection

Stop automated abuse with one script tag

Kaptcha renders its challenge as a single image, adapts to the risk of each attempt, and only lets genuine browsers through. Drop it into any form in under two minutes — no build step, no dependencies, no third-party scripts.

Get free API keys See it live
No jQuery No build step Unlimited sitekeys SOC2-friendly logs

Try it right here

Live

Everything runs in your browser — nothing is sent until you submit.

Waiting for the widget to load…
Why Kaptcha

Protection that publishers can actually ship

Everything below works together, and none of it asks you to change how your application is built.

Drop-in script

One file, one tag. No framework, bundler or npm package required — it styles and renders itself.

Adaptive difficulty

Each challenge is tuned to the risk of the attempt, so genuine visitors are never slowed down.

Browser integrity

Challenges are only issued to environments that behave like real browsers, closing common automation gaps.

Server-side truth

Only your server decides if a session passed. Nothing a visitor can send can forge that result.

Per-site controls

Independent keys, allowed-origin lists and tuning for every property you run.

Automatic bans

Repeat offenders are throttled and banned for a configurable window, with one-click unbanning.

How it works

Three steps, then you are done

1

Create a site

Register a domain and receive a sitekey instantly. No approval queue, no sales call.

2

Paste the snippet

Drop the container and script into the page where the form lives.

3

Verify on your server

Check the result with your secret key before you accept the submission.

Q&A

Common questions

How do I verify a result?

The widget hands your server a one-time reference. Post it to the verification endpoint with your secret key and check the response. The secret never leaves your server.

Does it need jQuery or a bundler?

No. It is a single self-contained file that ships its own styles and renders the interface itself.

What happens after a wrong answer?

A fresh challenge is issued automatically. After a set number of attempts the visitor is throttled for a configurable period.

Can I restrict it to one domain?

Yes. Each sitekey carries its own allowed-origin list, so a stolen key is useless elsewhere.

Does it work on mobile?

Yes. The challenge scales to the viewport and the whole interface reflows for small screens.

Ready to protect your forms?

Create a sitekey and paste the snippet — you will be live in two minutes.

Create free account