FCaptcha is a self-hosted, MIT-licensed CAPTCHA with no puzzle. One click or fully invisible. It catches headless browsers, Puppeteer, Playwright, Selenium, and the new wave of AI agents driving real browsers (vision click bots, computer-use agents). Verifies Web Bot Auth signed crawlers so polite agents get through. Drop-in for Turnstile, reCAPTCHA and hCaptcha: same siteverify contract. No cookies, no third-party data. WCAG 2.2 AA, false-positive budget enforced in CI. Go, Node or Python.
WebDecoy: Multi-Layer Bot Detection & Response
Single-layer detection is broken. WebDecoy combines multiple layers so bypassing one triggers another.
Client-side fingerprinting catches headless browsers. Server-side SDKs verify tokens and analyze TLS fingerprints. Honeypot traps catch what bots touch and humans don't.
Every request gets scored. You decide: log, block, challenge, or redirect with integrations for WAFs, SIEMs, and webhooks.
Try it now.
