CDPCaptcha is a proof-of-work captcha.
Instead of asking people to recognise pictures, the visitor's browser solves a small cryptographic puzzle in the background.
Bots can do that too, but it costs them computing time on every single request, which makes mass abuse expensive.
People hardly notice it.
What you need
- A sitekey: public, one per website or app, created in your account.
- An API key: secret, used by your server to verify responses.
- Two tags in your HTML and one request from your server.
How a check runs
- The widget requests a puzzle from the CDPCaptcha server. The puzzle is signed (HMAC-SHA256) and expires.
- A Web Worker searches nonces so that each sub-puzzle hash starts with a number of zero bits. The number of bits is the difficulty.
- The widget writes the response token into a hidden form field and fires an event.
- Your server sends the token to the siteverify endpoint with your API key. The server checks signature, expiry, single use and the solution, and answers with JSON.
Principles
- No cookies, no local storage, no fingerprinting, no third-party requests.
- Accessible: nothing to see or type, one keyboard-reachable button, live region for screen readers.
- Self-hosted: PHP 8 and MariaDB, one folder, one .env file.
- Every puzzle is single use; replays are rejected.