ShieldWall

botproof.app

ShieldWall

Privacy-first captcha that verifies humans — without puzzles.

Frictionless proof-of-work, six-layer scoring, and a drop-in /siteverify. Self-hosted. No third-party trackers. Built for forms, logins, and APIs that need bots gone — not users annoyed.

100% self-hosted · No external verification calls · WCAG-aware

Live verification UX

SHIELDWALLPrivacy protected

Same interaction model as ALTCHA-style checkbox captchas — ShieldWall adds multi-layer scoring behind the progress bar.

Frictionless captcha

Default path is silent proof-of-work. Click once (or auto-start on submit). No image grids. High-risk traffic escalates to an accessible code challenge.

Standard
SHIELDWALLPrivacy protected

Checkbox starts PoW. Progress shows while the browser solves. Checkmark when the server accepts the score.

Verifying
SHIELDWALLPrivacy protected

Memory-hard solve (SHA-256 chain or Argon2id) yields to the main thread every ~12 ms so the page stays responsive.

Code challenge
SHIELDWALLPrivacy protected

Gray-zone scores get a short alphanumeric code (confusable-free charset). Demo code: SW7K.

How verification works

  1. Challenge — Client POST /api/captcha/challenge, receives HMAC-v2 signed nonce + difficulty + algo.
  2. Solve — Widget runs PoW + collects behavior / fingerprint / honeypot; sends nonceBindingMeta.
  3. Verify — Server fail-fasts bad HMAC/nonce, re-checks PoW, scores 0–100 → PASSED / CHALLENGE / REJECTED.
  4. Siteverify — Your backend redeems the token via reCAPTCHA-shaped POST /api/v1/siteverify.

Six layers. One score.

Composite scoring is transparent — Sentinel shows the breakdown. Thresholds default to ≥70 pass, 40–69 challenge, <40 reject.

01
Proof-of-work
SHA-256 chain or Argon2id — attackers pay CPU/RAM.
02
Behavioral biometrics
Mouse, keystroke, scroll, touch — capped at 60 pts.
03
Browser fingerprint
Canvas, WebGL, Audio, CDP artifacts.
04
Consistency
Cross-check UA vs behavior vs renderer.
05
Honeypot
Invisible field bots fill; humans never see.
06
Reputation + edge
IP tiers, JA4, velocity — fail-open at the edge.

Why teams leave reCAPTCHA

Metered assessments, opaque scores, and puzzle fatigue. ShieldWall keeps the familiar siteverify contract — not the vendor lock-in.

ShieldWallreCAPTCHATurnstile
Privacy / self-hostedYes — your infraNo — Google cloudPartial — CF edge
Visual puzzlesNever by defaultOftenRare
Proof-of-workSHA-256 + Argon2idNoneYes
Behavioral biometricsFirst-classOpaque MLLimited
Accessible (WCAG 2.2)Baseline credit + code fallbackMixedGood
Per-request cost$0 after hostingMetered EnterpriseFree tier / CF
Score transparencyLayer breakdownBlack box 0–1Pass/fail

Drop in. Verify on your server.

React widget today; script tag + more frameworks on the roadmap. Backend stays reCAPTCHA-compatible.

import { ShieldWallWidget } from "@shieldwall/client";

<form onSubmit={onSubmit}>
  <ShieldWallWidget
    apiBase="https://api.botproof.app/api/captcha"
    action="login"
    onVerified={(token) => setToken(token)}
  />
  <button disabled={!token}>Continue</button>
</form>
Full quickstart →

Protect forms without punishing humans

Create a site key in the console. Point the widget at your API. Watch Sentinel for score health.

Open consoleView pricing
Protected by ShieldWall
Verifying…