CDPCaptcha ·
Proof of work, not picture puzzles
A captcha your visitors never have to solve.
CDPCaptcha lets the browser do a little computing work instead of asking people to click traffic lights.
No cookies, no tracking, no third-party scripts.
Self-hosted, under your control.
Made and hosted in the EU, in Germany.
Live widget
Starts automatically, finishes in a moment.
Nothing to click.
Why
Spam protection that does not punish your visitors.
Bots are expensive to run at scale when every request costs computing time.
People hardly notice it.
No cookies, no fingerprinting
The widget stores nothing in the browser and never talks to a third party.
Only a salted hash of the address is kept for rate limiting.
GDPR friendly by design
Nothing to see, nothing to type
No image riddles, no audio challenges.
Screen readers announce the state;
the one button is keyboard reachable.
Works for everyone
Your server, your data
One folder, one MariaDB database, one .env file.
Install with a script, update with git.
No external dependency, no CDN.
Runs on any PHP 8 host
Harder for bots, easy for people
The server raises the difficulty for addresses that request many puzzles.
Every puzzle is signed, expires, and can be used once.
Signed, timed, single use
How it works
Three steps, a few minutes.
1. Embed the widget
One script tag, one stylesheet and a div with your sitekey inside the form.
2. The browser solves a puzzle
A Web Worker searches hash values in the background.
The form field is filled with the proof.
3. Your server verifies
One POST to the verification endpoint with your API key.
Signed, not expired, not used before, solved: accepted.
The facts
What is inside.
Switching from another captcha?
Compatibility mode mounts on the old element classes.
Most sites change two lines.