Every try costs a bot
Each visit solves a small proof-of-work in the background. A person never notices. A bot farm making a million tries pays for a million of them, and risky networks get harder sums.
Invisible bot protection for every sign-upAI-built applogincheckoutAPI call
Keep bots, fake sign-ups and password guessing out of the apps you ship, including the ones you vibe-coded. People never solve image puzzles, every bot pays for every try, and it takes one prompt to set up.
One prompt or five minutes
Create your account
Create account ✓ Welcome aboardProtected by RevokeGPT · no puzzle shown
bot-farm.py · 40 workers
attacker · replaying a stolen pass
rgtk.v1.Qm9vT2s…x8Kp Used POST /sign-up with the same pass
RevokeGPT Watching
POST api.revokegpt.com/v1/siteverify
Every pass is spent the first time it is checked. A copy is worthless.
Apps built fast with Cursor, Claude Code, Lovable, Bolt or v0 often go live with open forms and no bot protection. RevokeGPT closes that gap with one prompt, and plans start at $5 a month.
Add RevokeGPT bot protection to this app. 1. On pages with sign-up, login or contact forms, load https://js.revokegpt.com/v1/api.js and put <div class="revokegpt" data-sitekey="MY_SITE_KEY" data-action="signup"></div> inside each form (use action "login" or "contact" as fits). 2. On the server, before handling those forms, POST the form's "revokegpt-response" field and secret=process.env.REVOKEGPT_SECRET to https://api.revokegpt.com/v1/siteverify. 3. Reject the request unless success is true, hostname is my domain and score >= 0.5. Keep the secret in an env variable, never in client code.
No puzzles to design, no rules to tune. Turn it on and it starts working.
Paste a script tag and a div into any form. The check runs in the background while the person types.
Your server sends the pass to our siteverify API and gets back a score and plain reasons. One request.
Real visitors go straight through. Bots burn computing power on every try, and their passes are refused.
Your form is protected
Set the mode per site in the dashboard. Switch any time, without changing your code.
Nothing to click. The check runs while the person fills the form. Only when we are truly unsure does a short puzzle appear.
Best for Sign-ups, logins, checkouts
A single “I am human” box for pages where people expect one. One tick, no traffic lights.
Best for Contact forms, comments
Never shows anything. Your server gets a score and reasons, and decides: allow, ask for email code, or block.
Best for APIs, high-value actions
The same check that guards a form also guards logins, accounts and your whole site.
Each visit solves a small proof-of-work in the background. A person never notices. A bot farm making a million tries pays for a million of them, and risky networks get harder sums.
We look at how a visit behaves, never who it is.
Sealed, tied to your site and action, valid five minutes, spent on the first check.
Spot stolen-password attacks, fake sign-up waves and accounts that share a device. Ask for an email code only when a sign-in looks wrong.
Warn people who pick a password from a known breach. Only five characters of a hash leave your server.
Write a rule once, enforce it in Workers, Next.js, Nginx, Lambda@Edge, Fastly and more.
Right-to-left layouts, keyboard and screen-reader support, and an audio puzzle.
I am human|Je suis humain|Soy humano|Ich bin ein Mensch|Sono umano|Eu sou humano|Ben insanım|Ik ben een mens|私は人間です|أنا إنسانNo cookies. No stored IP addresses or user agents. Logs keep a short monthly code per site, a network type and yes-or-no results, for 31 days. Your data lives in an EU-region database.
An MCP server lets assistants list sites, read analytics and draft firewall rules, read-only by default.
Drop the widget into any form, then send the pass to siteverify. You get a score
from 0.0 to 1.0 with plain reasons, and you decide what happens next.
sign-up.html
<script src="https://js.revokegpt.com/v1/api.js" async defer></script> <form action="/sign-up" method="post"> <input name="email" type="email" required /> <!-- Fills a hidden "revokegpt-response" field --> <div class="revokegpt" data-sitekey="rgpk_..." data-action="signup"></div> <button>Create account</button></form> SignUp.tsx
import { RevokeGPT } from '@revokegpt/react'; export function SignUp() { const [token, setToken] = useState(''); return ( <form onSubmit={(e) => submit(e, token)}> <input name="email" type="email" /> <RevokeGPT sitekey="rgpk_..." onVerify={setToken} /> <button>Create account</button> </form> );} SignUp.vue
<script setup>import { ref } from 'vue';import { RevokeGPT } from '@revokegpt/vue';const token = ref('');</script> <template> <form @submit.prevent="submit(token)"> <RevokeGPT v-model="token" sitekey="rgpk_..." /> <button>Create account</button> </form></template> server.ts
import { createClient } from '@revokegpt/node'; const revokegpt = createClient({ secret: process.env.REVOKEGPT_SECRET, // rgsk_... endpoint: 'https://api.revokegpt.com/v1/siteverify',}); const outcome = await revokegpt.verify(token, { expectedHostname: 'shop.example', expectedAction: 'signup', minScore: 0.5,});if (!outcome.ok) return reject(outcome.reason); any server
curl https://api.revokegpt.com/v1/siteverify \ -d secret="$REVOKEGPT_SECRET" \ -d response="$TOKEN_FROM_THE_FORM" 200 siteverify response
{
"success": true,
"score": 0.9,
"action": "signup",
"hostname": "shop.example",
"challenge_ts": "2026-11-11T09:41:00Z",
"mode": "invisible",
"reasons": []
} AUTOMATION or DATACENTER_IPWorks with your stack
live works today · npm soon built, publishing to npm · firewall block bad traffic before it reaches your app · planned on the roadmap
RevokeGPT speaks the reCAPTCHA v2, v3 and Enterprise browser API. Point the script and the siteverify call at us, swap the keys, and your existing pages keep working.
g-recaptcha markup and g-recaptcha-response field<!-- your page -->
<script src="https://www.google.com/recaptcha/api.js"></script>
<div class="g-recaptcha" data-sitekey="6LcXyz…"></div>
// your server
POST https://www.google.com/recaptcha/api/siteverify
secret=6LcXyz… <!-- your page -->
<script src="https://js.revokegpt.com/recaptcha/api.js"></script>
<div class="g-recaptcha" data-sitekey="rgpk_…"></div>
// your server
POST https://api.revokegpt.com/recaptcha/api/siteverify
secret=rgsk_… The short version: people pass, bots pay, nobody gets tracked.
| Feature | RevokeGPT | reCAPTCHA | hCaptcha | Turnstile | Friendly Captcha |
|---|---|---|---|---|---|
| No image puzzles for people | Yes Only if truly unsure | No v2 shows them | No Shows them on some plans | Yes | Yes |
| Bots pay with proof-of-work | Yes | Not stated | Not stated | Yes | Yes |
| No cookies on your visitors | Yes | No Sets cookies | No Sets cookies | Not stated | Yes |
| Score with reasons | Yes | Yes v3 and Enterprise | Partly Enterprise | No Pass or fail | Not stated |
| Account and login protection | Yes | Partly Enterprise, paid | Partly Enterprise | No | Not stated |
From each vendor's public pricing and documentation pages, checked 11 November 2026. Plans change; tell us if something here is out of date. Product names belong to their owners.
Pick a plan by how many checks you need.
a month
For side projects and small sites.
a month
For growing products that need more volume and depth.
a month
For high-traffic products and teams.