Bot Defense.
Made in Germany.
The CAPTCHA alternative without tracking, without cookies and without picture puzzles. Proof of work and behavioural analysis, processed on our own servers in Germany.
Permanently free for private websites. Pricing for commercial use · Compared with reCAPTCHA
Today: – Verifications · – Bots stopped · in total –
Preview · this is how the widget appears in your forms
Quickstart
Live in 5 minutes — on your platform
- 1 In WordPress, go to Plugins → Add New and search for “CaptchaCore” — or download the plugin from your account
- 2 Enter your site key & secret under Settings → CaptchaCore
- 3 Done — login, registration, comments, Elementor & Formidable are protected
- 1 Get the package from the official WoltLab plugin store and install it (WSC 6.1 / 6.2)
- 2 Enter your site key & secret under ACP → Options → Security → Anti-Spam
- 3 Select CaptchaCore as the captcha type — applies to all system forms
How it works
Three steps. Zero friction.
Real humans notice nothing. Bots fail multiple layers at once.
Widget + Adaptive Policy
The V2 widget (16 KB) fetches an adaptive challenge policy from the server — difficulty, challenge type and profile are controlled per site and form.
PoW + behavioral analysis
SHA-256 PoW in the WebWorker. In parallel: mouse entropy, typing rhythm and scroll behavior are captured passively — only scores, no raw data.
Adaptive Risk Engine
Context-aware scoring: a login is judged more strictly than a contact form. IP archive, campaign detection, confidence score. Answer in under 50 ms.
What really happens between page load and submit is set out stage by stage on the page How CaptchaCore works.
Multi-layered security
5 layers of defense. No single point of failure.
Schematic view — each layer is individually configurable
Layer 1: Proof of Work
SHA-256 — every client has to do computational work. Difficulty follows the site profile and under-attack level and is enforced on the server. Nonces EdDSA-signed, single-use.
The technical and organisational measures behind these layers are listed on the Security page.
Three modes
A fit for every form
From invisible protection to the classic checkbox — you decide how much your users see.
Interactive
RecommendedWidget visible, the checkbox ticks itself once enough human interaction is detected (typing, mouse, scrolling). No click required. Fallback: users can also click manually.
data-captchacore="interactive"
Visible
The checkbox has to be clicked manually. Like the well-known providers, but without their data outflow. Starts the computation on click. Good for forms with high security requirements.
data-captchacore="visible"
Invisible
No UI. PoW solves entirely in the background. Ideal for login forms or pages where a widget would get in the way. Blocks submit until the token is ready.
data-captchacore="invisible"
Features
Built for privacy & performance
Hosted in Germany
Verification, risk engine and database run on our own servers in Germany. On request you can also run CaptchaCore entirely on your own infrastructure.
Privacy by Design
No cookies, no tracking, no raw data. Rolling-salt IP hashing (6h rotation), separate operational/security logs with strict retention periods.
Sub-200ms verification
The risk engine answers in under 50 ms and the computation is solved after roughly 200 ms. The widget weighs 16 KB gzip and, thanks to a web worker, never blocks the interface.
Proof of Work (SHA-256)
Hashcash principle. Difficulty configurable from 2–5. Single-use nonce via Redis with TTL. A WebWorker solves it in the background.
Behaviour & environment signals
Mouse, typing rhythm, touch, paste, canvas timing, software rendering, rAF cadence, storage APIs. Detects even disguised headless browsers. Condensed metrics, no raw data, no re-identification.
Under-Attack-Mode
4-level Under Attack Mode. Automatic escalation and de-escalation. Click check from level 2, without cookies.
Auto-learning
Threat Intelligence learns hourly from blocked patterns. IP ranges, UA patterns and behavioral anomalies are detected automatically.
Customizable widget
Light, dark or automatic appearance, plus accent colour, label, your own branding and size — configurable per site.
Admin dashboard
Reports, verification logs, threat picture, site management, key rotation, user management and a complete audit trail.
Comparison
CaptchaCore in three figures
The three figures that end up in your privacy notice and in your load time. Everything else is set out with sources on the comparison page.
Every check runs on our own servers in Germany — no transfer to third countries.
One file without a framework — loaded only on pages that have a form.
The check runs in the background; if something looks suspicious, a short extra step replaces any puzzle.
Privacy
Privacy by Design. Not as an afterthought.
Which data is processed for which purpose is set out in the privacy centre. As a customer you conclude the data processing agreement electronically in your account.
Technical details
The hard numbers
What the visitor loads
Methods and timings
Current response times and the state of every component are shown on the public system status.
Global infrastructure
Widget delivery via edge network
A European CDN delivers the widget file. The EU endpoint is the default; you only enable the worldwide endpoint if you need it.
src-eu.captchacore.eu
The widget file is delivered exclusively via CDN locations in EU member states. No transfer to third countries takes place.
GDPR · no third-country transfersrc.captchacore.eu
All of the CDN provider’s locations worldwide, for short load times with an international audience. Delivery then also takes place outside the EU, safeguarded by standard contractual clauses.
Excerpt. Full list from the provider: bunny.net/network
Important for your privacy policy: verification always runs in Germany, only the delivery of the script file can happen worldwide. What that means in detail.
Ready for bot defense without compromise?
Try the check in the live demo, look at the pricing, or read in the documentation how the integration works.
Permanently free for private websites · Processing in Germany · Data processing agreement in your account