How it works
Three steps, one verdict.
From the first page load to a server-side decision, this is everything that happens.
01
Embed
Add the script and a container with your sitekey. The widget loads from the CDN host and solves a quiet proof of work in a Web Worker while the visitor fills in your form.
02
Score
Behaviour and network signals become a calibrated score from 0.00 to 1.00. Riskier traffic pays more work, and on turn sites it sees a checkbox.
03
Verify
When the form is submitted, your backend sends the single-use token to the siteverify endpoint with the site secret and acts on the answer.
The token
What your backend receives.
The token is single use, bound to the site's domain, and expires after 120 seconds. A second verification of the same token is reported as a duplicate, never scored again.
The response carries success, the score, a verdict (pass, fail or scored), the reasons behind it, and the hostname the token was issued for.
Verification is always a 200: check success and the error-codes list rather than the HTTP status.
{
"success": true,
"score": 0.94,
"verdict": "pass",
"action": "signup",
"hostname": "example.com",
"provider": "procaptcha",
"error-codes": []
}Ready to stop the bots?
Start on the free tier. Create a site, copy the sitekey, ship.