botproof.app
ShieldWall
Privacy-first captcha that verifies humans — without puzzles.
Frictionless proof-of-work, six-layer scoring, and a drop-in /siteverify. Self-hosted. No third-party trackers. Built for forms, logins, and APIs that need bots gone — not users annoyed.
100% self-hosted · No external verification calls · WCAG-aware
Live verification UX
Same interaction model as ALTCHA-style checkbox captchas — ShieldWall adds multi-layer scoring behind the progress bar.
Frictionless captcha
Default path is silent proof-of-work. Click once (or auto-start on submit). No image grids. High-risk traffic escalates to an accessible code challenge.
Checkbox starts PoW. Progress shows while the browser solves. Checkmark when the server accepts the score.
Memory-hard solve (SHA-256 chain or Argon2id) yields to the main thread every ~12 ms so the page stays responsive.
Gray-zone scores get a short alphanumeric code (confusable-free charset). Demo code: SW7K.
How verification works
- Challenge — Client
POST /api/captcha/challenge, receives HMAC-v2 signed nonce + difficulty + algo. - Solve — Widget runs PoW + collects behavior / fingerprint / honeypot; sends
nonceBindingMeta. - Verify — Server fail-fasts bad HMAC/nonce, re-checks PoW, scores 0–100 → PASSED / CHALLENGE / REJECTED.
- Siteverify — Your backend redeems the token via reCAPTCHA-shaped
POST /api/v1/siteverify.
Six layers. One score.
Composite scoring is transparent — Sentinel shows the breakdown. Thresholds default to ≥70 pass, 40–69 challenge, <40 reject.
Why teams leave reCAPTCHA
Metered assessments, opaque scores, and puzzle fatigue. ShieldWall keeps the familiar siteverify contract — not the vendor lock-in.
| ShieldWall | reCAPTCHA | Turnstile | |
|---|---|---|---|
| Privacy / self-hosted | Yes — your infra | No — Google cloud | Partial — CF edge |
| Visual puzzles | Never by default | Often | Rare |
| Proof-of-work | SHA-256 + Argon2id | None | Yes |
| Behavioral biometrics | First-class | Opaque ML | Limited |
| Accessible (WCAG 2.2) | Baseline credit + code fallback | Mixed | Good |
| Per-request cost | $0 after hosting | Metered Enterprise | Free tier / CF |
| Score transparency | Layer breakdown | Black box 0–1 | Pass/fail |
Drop in. Verify on your server.
React widget today; script tag + more frameworks on the roadmap. Backend stays reCAPTCHA-compatible.
import { ShieldWallWidget } from "@shieldwall/client";
<form onSubmit={onSubmit}>
<ShieldWallWidget
apiBase="https://api.botproof.app/api/captcha"
action="login"
onVerified={(token) => setToken(token)}
/>
<button disabled={!token}>Continue</button>
</form>Full quickstart →Protect forms without punishing humans
Create a site key in the console. Point the widget at your API. Watch Sentinel for score health.