hCaptcha

The classic widget asks a visitor to solve a small task before a form submits. Passive mode is the quieter option: it scores the session in the background and only interrupts when the risk justifies it, which hCaptcha puts at 99.9% of traffic passing without a puzzle on the Pro plan. For a support form or a newsletter signup, that difference decides whether anyone finishes the form.

Every session gets a score built from device, network, behavior, and intent signals. Threat Signatures cluster attackers across thousands of IPs and devices, which matters because most modern botnets rotate addresses faster than a blocklist can follow. Instead of maintaining an IP list, you set a threshold and let the score decide.

User Journeys stitch a session together across pages and actions, so an isolated event gets context. A failed login looks harmless alone. A failed login after ten product page visits, a password reset, and a checkout attempt reads differently. Investigators get that timeline in one view, which cuts the guesswork out of a fraud review.

Agent Controls handle the traffic that isn't clearly a bot or a person: AI assistants, crawlers, and agentic browsers acting for a user. hCaptcha reads its own signals even when an agent hides its identity, and it supports Web Bot Auth for platforms that sign their requests. You set a policy per sitekey, so an assistant can browse a catalog, needs a valid token before it reserves inventory, and gets denied on flows where automation isn't allowed. WebMCP tool calls are captured by name for review, without arguments or results.

Account Defense watches signup, login, and authenticated sessions for takeovers and multi-accounting. Fraud Protection covers payments: card testing, chargeback fraud, incentive abuse, and SMS pumping. Both feed the same risk model, so a suspicious signup raises the score on the payment that follows it ten minutes later.

hCaptcha doesn't require personally identifiable information to score traffic, and customers can blind account and transaction fields before sending them. The compliance list covers GDPR, CCPA, LGPD, and PIPL. For a company whose legal team has already said no to another data warehouse, that limits the scope of the review.

Enterprise plans add reporting APIs, a multi-user dashboard with SAML SSO, and enterprise SLAs. Managed Defense goes further and puts a 24/7 SOC on the account, so alerts get triaged by people who watch the same attack patterns across many customers. Teams without a night shift get coverage they can't staff themselves.