# Friendly Captcha - Privacy-First Bot Protection & Invisible CAPTCHA Alternative

> Friendly Captcha is a privacy-first, invisible CAPTCHA alternative and bot-protection service built by Friendly Captcha GmbH, a German company with a globally distributed team. Instead of asking users to label images or decode distorted text, Friendly Captcha serves a unique cryptographic proof-of-work puzzle that the visitor's device solves silently in the background - usually finished before the user submits the form. Proof-of-work is combined with real-time risk signals (IP intelligence, browser identification, anonymization/VPN and proxy detection, bot and AI-agent detection, behavioral risk) that scale puzzle difficulty: low-risk humans pass instantly and invisibly, while automated and high-risk traffic becomes computationally expensive.

Friendly Captcha sets no cookies, uses no trackers and stores no personal data from end users. It is ISO 27001 certified, GDPR and CCPA compliant, WCAG 2.2 AA certified, PCI DSS compliant and DORA compliant, and offers a dedicated EU-only endpoint hosted in Germany so that data never leaves the EU. The service verifies billions of web interactions per year with 99.99% historical uptime from data centers in the EU, US, Asia and worldwide.

Integration takes about 10 minutes and three steps: create a sitekey, install the widget, verify the response server-side. The Friendly Captcha API is designed to be compatible with Google reCAPTCHA and hCaptcha, so teams can migrate quickly, and open-source SDKs and plugins exist for JavaScript/TypeScript, React, Vue, Angular, Python, Go, PHP, Java/JVM, iOS, Android, WordPress, TYPO3, Joomla, Magento 2 / Adobe Commerce, Shopware, Drupal, Laravel, Django, Craft CMS, Contao, Keycloak, Auth0 and Salesforce. Typical use cases: signup and login protection, contact and comment form spam, account-takeover and brute-force prevention, checkout and password-reset abuse.



**Target Audience:** general

**Key Features:**
- Truly invisible verification: a cryptographic proof-of-work puzzle is solved by the user's device in the background; no image labeling; no puzzles; no audio challenge; no user interaction.
- Adaptive difficulty: risk scores determine puzzle hardness - easy for normal users and exponentially expensive for abusers.
- Risk Intelligence: real-time risk scores plus IP intelligence; anonymization/VPN/proxy detection; browser identification; bot and AI-agent detection - all returned in the verification response for your own decisioning.
- Additional protection layer against advanced automation; headless browsers; WebDriver; scripted abuse and autonomous AI agents - while good bots such as search-engine crawlers stay allowed.
- Privacy by design: zero cookies; zero trackers; no personal end-user data stored; GDPR and CCPA and global privacy compliance.
- Accessibility by design: WCAG 2.2 AA certified with no barriers for users with visual or hearing or motor or cognitive impairments; supports EAA and BFSG and BITV and ADA obligations.
- EU data sovereignty: dedicated EU endpoint processed in Germany (eu.frcapi.com) plus a self-hosted endpoint option on Enterprise.
- Analytics dashboard: usage trends; protection overview (verified / not submitted / rejected) and detailed network and browser and behavior risk analytics.
- Developer-first integration: widget script plus one siteverify POST; 10 minutes to production; drop-in compatible with reCAPTCHA and hCaptcha including dedicated migration guides.
- Broad ecosystem: open-source SDKs (web / Node / Python / Go / PHP / JVM / iOS / Android) and prebuilt plugins for WordPress / TYPO3 / Joomla / Magento 2 / Shopware / Drupal / Craft CMS / Contao / Laravel / Django / Salesforce / Keycloak and Auth0.
- Enterprise controls: SSO; enhanced access control; audit logs; user management; app-specific difficulty controls; professional analytics and reporting.
- Proven scale and reliability: billions of verified web interactions per year; 99.99% historical uptime; 99.9% guaranteed uptime from the Advanced plan.
- Certified security: ISO 27001 and PCI DSS and DORA; relevant for NIS2 scope.
- Flexible plans: free tier for non-commercial low-traffic sites; paid plans from €9/month; 30-day free trial without a credit card.



## Development Approach

- API-first and integration-first: every capability is reachable through the documented v2 REST API and typed SDKs; the widget is a thin, framework-agnostic layer that works with any stack.
- Privacy by design and data minimization: no cookies, no tracking, no storage of end-user personal data; EU-only processing available as a first-class configuration, not an add-on hack.
- Accessibility by design: verification requires no user action at all, so WCAG 2.2 AA conformance is structural rather than retrofitted.
- Open source and transparency: widget SDK, proof-of-work library, server-side SDKs and CMS plugins are public on GitHub (Open Source / MPL-2.0 / MIT) and accept community contributions; bot protection is deliberately not a black box - risk signals are exposed to customers.
- Drop-in compatibility: the API mirrors reCAPTCHA/hCaptcha verification semantics so migration is a small, reversible change, with documented migration and upgrade paths.
- Versioning and immutability: pinned, immutable widget script URLs and documented SDK versioning so deployments are reproducible and cannot break unexpectedly; self-hosting of the widget script is supported.
- Defense in depth: layered proof-of-work, continuously learning risk signals and Friendly Guard rather than a single detection heuristic.
- Testability and DX: dedicated test sitekeys and guidance for automated E2E/CI testing, explicit CSP directives, documented browser-support and no-JavaScript behavior.
- Reliability engineering: multi-region infrastructure, public status page, 99.99% historical uptime and contractual 99.9% uptime from the Advanced plan.
- German quality and security standards: ISO 27001-certified processes, PCI DSS and DORA compliance, EU-based legal entity and contracts.

## Setup Instructions

Integration takes three steps and about 10 minutes.

Prerequisites: a Friendly Captcha account (free 30-day trial, no credit card) and a form you want to protect.

1) Create a sitekey
Sign up at https://friendlycaptcha.com/signup/, open the Dashboard (https://app.friendlycaptcha.eu/), create an application, and copy the sitekey (public) and API key (secret, server-side only). In the Dashboard's application API Endpoint section choose the global endpoint or the dedicated EU endpoint.

2) Install the widget in your frontend
The easiest way to integrate Friendly Captcha into your website is by using the site script.
This script automatically loads a widget for every element on your website with the frc-captcha class.
Add the scripts that can be found at the following documentation URL to your website's HTML: https://developer.friendlycaptcha.com/docs/v2/getting-started/install
Pin the SDK version and check the Versioning guide for the exact immutable script URL for your setup; self-hosting the script is supported.

3) Verify the response on your server
On form submission, read the frc-captcha-response value and POST it to the siteverify endpoint with your secret API key:
   POST https://global.frcapi.com/api/v2/captcha/siteverify   (or https://eu.frcapi.com/... for EU-only)
   Body: { "response": "", "sitekey": "" }
   Header: X-API-Key: 
   Accept the submission only if the response contains "success": true. On Advanced and Enterprise plans the reply also contains Risk Intelligence data you can use for step-up authentication, rate limiting or blocking. Never call siteverify from the browser and never expose the API key client-side.
The latest information about verifying the response on your server can be found at the following documentation URL: https://developer.friendlycaptcha.com/docs/v2/getting-started/verify

Shortcuts and extras:
- Use an official SDK instead of raw HTTP: Node/JavaScript, Python, Go, PHP, JVM, iOS, Android.
- Use a prebuilt plugin for WordPress, TYPO3, Joomla, Magento 2, Shopware, Drupal, Craft CMS, Laravel, Django, Salesforce, Keycloak or Auth0 - no custom code required.
- Migrating from Google reCAPTCHA or hCaptcha: follow the migration guides; the verification flow is compatible.
- Allow the widget and API hosts in your Content Security Policy (see the CSP guide) and use the documented test sitekeys in CI/E2E tests.

## Documentation

[Friendly Captcha Homepage](https://friendlycaptcha.com/): Product overview, live demo, plans and pricing, trust and compliance badges for the privacy-first bot protection service.
[Developer Hub](https://developer.friendlycaptcha.com/): Entry point to all technical documentation, integration guides, API and SDK references and the tech blog.
[Introduction Docs)](https://developer.friendlycaptcha.com/docs/v2/): What Friendly Captcha is, how the proof-of-work puzzle and risk scoring work, and how it differs from reCAPTCHA and hCaptcha.
[Getting Started](https://developer.friendlycaptcha.com/docs/v2/getting-started): Three-step integration (create a sitekey, install the widget, verify the response) - typically about 10 minutes.
[Widget SDK](https://developer.friendlycaptcha.com/docs/v2/sdk/): Browser-side JavaScript/TypeScript SDK: mounting widgets, options, lifecycle events, callbacks and programmatic control.
[Risk Intelligence](https://developer.friendlycaptcha.com/docs/v2/risk-intelligence/): Risk scores and signal data (network, browser, behavior, IP intelligence, anonymization and bot detection) returned on verification.
[Friendly Guard](https://developer.friendlycaptcha.com/docs/v2/friendly-guard/): Additional protection layer against advanced automation, scripted abuse and AI agents.
[Use Cases](https://developer.friendlycaptcha.com/docs/v2/use-cases): Recommended setups for signup and login forms, contact forms, checkout, password reset, account-takeover and brute-force protection.
[Prebuilt Integrations](https://developer.friendlycaptcha.com/integrations): Ready-made plugins and libraries for CMS, e-commerce, frameworks and identity platforms.
[Integrations Overview](https://friendlycaptcha.com/integrations/): Per-platform CAPTCHA integration pages (WordPress, Shopify, Shopware, Magento/Adobe Commerce, TYPO3, Drupal, Keycloak, Auth0, React, Vue, Python, Go, Laravel, Django and more).
[Free CAPTCHA Plan](https://friendlycaptcha.com/free-captcha/): Free tier for non-commercial, low-traffic sites: 1 protected domain, up to 1,000 requests per month.
[Create Account / Free Trial](https://friendlycaptcha.com/signup/): Sign up for a 30-day free trial, no credit card required, or start on the free non-commercial plan.

## Technical Details

[API Reference](https://developer.friendlycaptcha.com/docs/v2/api/): REST API v2 reference, including the POST /api/v2/captcha/siteverify verification endpoint and response schema.
[SDK Reference](https://developer.friendlycaptcha.com/docs/v2/sdk/reference): Full reference for widget SDK methods, options, states and events.
[Dedicated EU Endpoint](https://developer.friendlycaptcha.com/docs/v2/guides/eu-endpoint): EU-only processing in Germany via https://eu.frcapi.com/api/v2/captcha/siteverify and data-api-endpoint="eu" (Advanced/Enterprise); global endpoint is https://global.frcapi.com/api/v2/captcha/siteverify.
[Migrating from reCAPTCHA](https://developer.friendlycaptcha.com/docs/v2/guides/migrating-from-recaptcha): Step-by-step replacement of Google reCAPTCHA, including the compatible verification flow.
[Migrating from hCaptcha](https://developer.friendlycaptcha.com/docs/v2/guides/migrating-from-hcaptcha): Step-by-step replacement of hCaptcha.
[Upgrading from v1 to v2](https://developer.friendlycaptcha.com/docs/v2/guides/upgrading-from-v1/): Differences between Friendly Captcha v1 and v2 and the upgrade path.
[SDK Versioning and Immutability](https://developer.friendlycaptcha.com/docs/v2/guides/sdk-versioning): Version pinning, immutable script URLs and self-hosting the widget script.
[Browser Support](https://developer.friendlycaptcha.com/docs/v2/guides/browser-support): Supported browsers, WebAssembly requirements and fallback behavior.
[Content Security Policy (CSP)](https://developer.friendlycaptcha.com/docs/v2/guides/csp): CSP directives required to load the widget and reach the API endpoints.
[Automated Testing](https://developer.friendlycaptcha.com/docs/v2/guides/automated-testing): Test sitekeys and patterns for CI, E2E and integration tests.
[Localization / Language Detection](https://developer.friendlycaptcha.com/docs/v2/guides/localization): Automatic language detection and manual locale configuration for widget text.
[Risk-Based Authentication Guide](https://developer.friendlycaptcha.com/docs/v2/guides/risk-based-authentication-using-risk-intelligence/): Using Risk Intelligence signals to trigger step-up authentication or block flows.
[Enterprise Documentation](https://developer.friendlycaptcha.com/docs/v2/enterprise/): Enterprise capabilities such as SSO, audit logs, advanced analytics and self-hosted endpoint options.
[GitHub Organization](https://github.com/FriendlyCaptcha): All open-source SDKs, framework packages and CMS plugins maintained by Friendly Captcha.
[Widget SDK Source](https://github.com/FriendlyCaptcha/friendly-captcha-sdk): TypeScript client SDK used to embed Friendly Captcha v2 widgets (MPL-2.0).
[Server-side SDK: JavaScript/Node](https://github.com/FriendlyCaptcha/friendly-captcha-javascript): Backend verification client for Node.js and TypeScript (v2).
[Server-side SDK: Python](https://github.com/FriendlyCaptcha/friendly-captcha-python): Python SDK for verifying Friendly Captcha v2 responses.
[Server-side SDK: Go](https://github.com/FriendlyCaptcha/friendly-captcha-go): Go SDK for verifying Friendly Captcha v2 responses.
[Server-side SDK: PHP](https://github.com/FriendlyCaptcha/friendly-captcha-php): PHP SDK for verifying Friendly Captcha v2 responses.
[Server-side SDK: Java/JVM](https://github.com/FriendlyCaptcha/friendly-captcha-jvm): JVM SDK (Java, Kotlin, Scala, Groovy, Clojure) for server-side verification.
[Mobile SDK: iOS](https://github.com/FriendlyCaptcha/friendly-captcha-ios): Swift SDK for native iOS apps.
[Mobile SDK: Android](https://github.com/FriendlyCaptcha/friendly-captcha-android): Kotlin SDK for native Android apps.
[WordPress Plugin](https://github.com/FriendlyCaptcha/friendly-captcha-wordpress): Official WordPress plugin protecting comment, login, registration and contact forms.
[Proof-of-Work Library](https://github.com/FriendlyCaptcha/friendly-pow): The open-source WebAssembly/AssemblyScript proof-of-work challenge library behind Friendly Captcha.
[Dashboard](https://app.friendlycaptcha.eu/): Customer dashboard for applications, sitekeys, API keys, endpoint settings, usage statistics and risk analytics.
[Service Status](https://friendlycaptcha.com/status/): Live availability and incident history for Friendly Captcha services.
[Tech Blog](https://developer.friendlycaptcha.com/blog): Engineering posts on bot detection, fingerprinting, proof-of-work and platform changes.

## Optional

[How Friendly Captcha Compares](https://friendlycaptcha.com/solution/difference/): Why proof-of-work plus risk signals differs from image-labeling and score-based CAPTCHAs.
[Bot Management](https://friendlycaptcha.com/solution/bot-management/): Bot and AI-agent management capabilities, analytics and traffic insights.
[Privacy Overview](https://friendlycaptcha.com/privacy/): Privacy commitments - no cookies, no tracking, no personal data stored from end users.
[GDPR](https://friendlycaptcha.com/privacy/gdpr/): How Friendly Captcha supports GDPR compliance, including EU-only processing options.
[CCPA](https://friendlycaptcha.com/privacy/ccpa/): CCPA compliance details for US-facing websites and apps.
[Compliance Overview](https://friendlycaptcha.com/compliance/): Certifications and frameworks: ISO 27001, GDPR, WCAG 2.2 AA, PCI DSS, DORA, NIS2.
[Accessibility](https://friendlycaptcha.com/accessibility/): Accessible-by-design verification and conformance with WCAG, EAA, BFSG, BITV and ADA.
[WCAG Conformance](https://friendlycaptcha.com/accessibility/wcag/): How an invisible CAPTCHA removes the accessibility barriers of visual and audio challenges.
[Security](https://friendlycaptcha.com/security/): Security posture, ISO 27001 certification and sector requirements such as DORA and NIS2.
[Insights: Proof-of-Work CAPTCHA](https://friendlycaptcha.com/insights/proof-of-work-captcha/): Explainer on how proof-of-work CAPTCHAs deter automated abuse.
[Insights: Invisible CAPTCHA](https://friendlycaptcha.com/insights/invisible-captcha/): What makes a CAPTCHA truly invisible to end users.
[Insights: CAPTCHA Security](https://friendlycaptcha.com/insights/captcha-security/): How proof-of-work and continuously learning risk signals work together.
[Insights: reCAPTCHA Alternative](https://friendlycaptcha.com/insights/recaptcha-alternative/): Evaluation criteria when replacing Google reCAPTCHA.
[Insights: Bot Protection](https://friendlycaptcha.com/insights/bot-protection/): Bot protection concepts, attack types and mitigation strategies.
[Insights: Account Takeover Prevention](https://friendlycaptcha.com/insights/account-takeover-prevention/): Protecting login flows against credential stuffing and ATO.
[Wiki / Learn](https://friendlycaptcha.com/wiki/): Reference glossary of CAPTCHA, bot-protection, privacy and accessibility terminology.
[Free Tools](https://friendlycaptcha.com/tools/): Free checkers for cookies, GDPR, WCAG and EU data sovereignty.
[About the Company](https://friendlycaptcha.com/company/about/): Friendly Captcha GmbH - German company, globally distributed team, mission and values.
[Contact](https://friendlycaptcha.com/contact/): General contact, support requests and sales enquiries.
[Careers](https://friendlycaptcha.com/company/jobs/): Open roles at Friendly Captcha GmbH.
[Legal & Terms](https://friendlycaptcha.com/legal/): Terms of service, DPA, imprint and legal documents.

---
Generated by ThinkRank SEO Plugin on 2026-08-18 10:39:44 UTC