Procaptcha

Replacing reCAPTCHA, hCaptcha or Cloudflare Turnstile usually means swapping one data collector for another. Procaptcha is described by its authors as a drop-in replacement for all three that protects user privacy and collects zero data, which is the awkward part of every other option on that list.

It works on a risk model rather than a challenge for everyone. Requests are scored to separate a person from an AI agent or a bot, and a verification step only appears when that score crosses a threshold, so ordinary traffic passes without a puzzle.

The pieces around the widget are what make it deployable.

• Front end packages: components for React, Vue and Angular, plus plugins for the common WordPress form builders and other CMS platforms.
• Edge deployment: the check can run on Cloudflare Workers and AWS Lambda at the edge.
• Signals: behavioral analysis, JavaScript checks, proof of work, device context and IP reputation feed the score.
• Compliance: the project claims GDPR, CCPA, LGPD and PIPEDA compliance with no cookies or cross-site tracking, and WCAG 2.1 accessibility.
• Self-hosting: the software can be run as a self-hosted bot protection setup, with the client-side detection library the one closed piece.

The repository is a monorepo of the open source packages behind the product, with a separate document covering the development environment. A sitekey from the hosted service is needed to use the library, and the maintainers offer help to anyone taking the self-hosted route.