Spam protection without puzzles.
hostily Captcha protects forms from bots and spam without making your visitors pick traffic lights or decipher distorted text. The browser solves a small computational task in the background. No cookies, no tracking, servers in Germany.
- No cookies
- IP addresses hashed only
- Hosted in Germany
- Open-source widget (Apache-2.0)
Two layers that stay out of your visitors’ way
Bots are slowed down by computational cost and sorted out by rules. People hardly notice.
Fetch a task
The widget requests a small proof-of-work task from the service.
Solve in the browser
The browser solves it in the background, usually within a few seconds. Barely noticeable for one visitor, expensive for mass submissions.
One-time token
The service exchanges the solution for a token that is submitted with the form. Each token is valid exactly once.
Your server verifies
Your server asks us, using your secret key. Only then is the submission considered genuine.
Proof-of-work
The task makes automated mass submissions uneconomical. Difficulty is configurable per project.
Content rules
Words, regular expressions, link count, email domains and IP ranges add up to a score. Above a threshold the submission is rejected.
Honeypot, minimum time, IP block
A hidden field, a minimum fill-in time and a daily-reset block after too many requests or failures catch the rest.
Everything a form protection needs
Visible or invisible
With a checkbox or with no control at all. In invisible mode the widget submits the form itself once the token is ready.
Built for accessibility
A real checkbox with keyboard support, status messages for screen readers and sufficient contrast. No image puzzle that excludes anyone.
German and English
The widget follows the page language or is set by attribute; light and dark follow the system.
reCAPTCHA-compatible
Server-side verification understands the reCAPTCHA format. In many systems it is enough to swap the URL.
Client accounts for agencies
Projects and users can be assigned to clients. Included in the Agency plan; roles (owner, reader) are available in every plan.
Statistics
Usage and checks per day in every plan; from Start also why submissions were rejected.
Content rules
Your own rules per project, from the Business plan, plus viewable rejected submissions.
Small and fast
The widget is about 17 KB (7 KB gzipped), the WASM module 22 KB. It falls back to plain JavaScript if WASM is unavailable.
Data-minimal
No cookies, no third-party requests, IP addresses only as a daily-rotating hash, deleted after 14 days.
Try it yourself
This is the real widget from captcha.hostily.de. It fetches a task from our server on load; nothing is stored when you submit.
Honest and data-minimal
We say what the service does and claim nothing we cannot prove. These points apply today:
- No cookies, neither in the widget nor on this website.
- IP addresses made unrecognisable: only a checksum of the IP address is stored, formed with a secret key that changes daily. The IP address itself is not stored anywhere in the database and cannot be recovered from it.
- 14-day retention for events, IP counters and submission hashes.
- Hosted at Hetzner in Germany, operated by connect – Media & Teledienst.
- No third-party requests: the widget loads everything from captcha.hostily.de, including the WASM module.
- Open-source widget under Apache-2.0, based on Cap; changes are documented.
What we do not claim
We currently hold no certifications such as ISO 27001 and show no customer logos or usage figures. A data processing agreement and privacy notes for the service are available as drafts.
Accessibility
The checkbox is a real control with keyboard support, focus ring and status messages. There is no image puzzle. The state of our self-assessment is in the accessibility statement.
Privacy & sub-processors of the service · Data processing agreement (draft)
Integrate in two steps
Add the widget, verify the token on your server. Both take a few minutes.
1. Widget in the form
You find the site key in the management area, in your project. On submit the token is in the field hostily-captcha-token.
<script src="https://captcha.hostily.de/widget/hostily-captcha.js?v=0.1.0" defer></script>
<form method="post" action="/senden">
<input name="nachricht">
<hostily-captcha data-site-key="SITE_KEY"></hostily-captcha>
<button>Absenden</button>
</form>Invisible: data-modus="unsichtbar". To also fill g-recaptcha-response: data-recaptcha-kompatibel.
2. Verify the token on your server
The secret belongs on the server only, never in the browser. Verification is reCAPTCHA-compatible (POST /recaptcha/api/siteverify). The response contains success; each token is valid once.
PHP
<?php
$antwort = file_get_contents('https://captcha.hostily.de/recaptcha/api/siteverify', false,
stream_context_create(['http' => [
'method' => 'POST',
'header' => 'Content-Type: application/x-www-form-urlencoded',
'content' => http_build_query([
'secret' => getenv('HOSTILY_CAPTCHA_SECRET'),
'response' => $_POST['hostily-captcha-token'] ?? '',
]),
]]));
$ergebnis = json_decode($antwort, true);
if (empty($ergebnis['success'])) { http_response_code(400); exit('Spam check failed'); }Python
import os, requests
r = requests.post(
"https://captcha.hostily.de/recaptcha/api/siteverify",
data={"secret": os.environ["HOSTILY_CAPTCHA_SECRET"],
"response": request.form.get("hostily-captcha-token", "")},
timeout=5,
)
if not r.json().get("success"):
abort(400, "Spam check failed")Node.js
const r = await fetch("https://captcha.hostily.de/recaptcha/api/siteverify", {
method: "POST",
body: new URLSearchParams({
secret: process.env.HOSTILY_CAPTCHA_SECRET,
response: req.body["hostily-captcha-token"] ?? "",
}),
});
const ergebnis = await r.json();
if (!ergebnis.success) return res.status(400).send("Spam check failed");Switching from reCAPTCHA
Server verification: replace https://www.google.com/recaptcha/api/siteverify with https://captcha.hostily.de/recaptcha/api/siteverify and swap the secret. In the form, include the widget instead of the reCAPTCHA script; with data-recaptcha-kompatibel the field g-recaptcha-response is kept.
The extended call POST /api/v1/pruefen additionally checks minimum time, honeypot, duplicate submissions and your content rules when you pass the form fields.
Simple and predictable
Start for free and upgrade when you need more. All plans – including Free – may be used for private and commercial websites. Prices in euros including statutory VAT.
Free
- 1.000 checks / month
- 1 website
- Form protection with proof-of-work, honeypot and IP blocking
- Basic statistics: quota usage and checks per day
- Users with owner and reader roles
- “Protected by hostily” notice stays visible
Start
- 10.000 checks / month
- 3 websites
- Everything in Free, plus:
- Full statistics with rejection reasons
Business
- 50.000 checks / month
- 10 websites
- Everything in Start, plus:
- Content rules
- View rejected submissions
- Notice can be hidden
Agency
- 250.000 checks / month
- 50 websites
- Everything in Business, plus:
- Client accounts (tenants)
- Priority support
Custom
- Everything in Agency, plus:
- > 250.000 checks / month
- unlimited websites
- dedicated server / contract
For hostily hosting customers: The Free plan is included, with no separate sign-up and for all websites in your hosting account (quota 1,000 checks per month). You can upgrade at any time.
When your needs grow: When you approach your plan’s quota we let you know by email in good time and recommend the right plan – you can switch at any time.
Ordering and billing through our customer portal is coming. Until then we set up plans on request by email.
Frequently asked questions
What is a proof-of-work captcha?
Instead of solving an image puzzle, the visitor’s browser computes a small task in the background. Barely noticeable for a person, expensive for bots submitting forms in bulk.
Do I need a cookie banner?
The widget sets no cookies and stores nothing in the browser. Whether your site as a whole needs a banner depends on your other services. Mention hostily Captcha in your privacy policy; we provide documents for that.
What data is processed?
Technically required are the origin of the request (domain), timestamps and a checksum of the IP address formed with a secret key that changes daily (the IP itself is not stored). Details are in the service’s privacy notes. Events are deleted after 14 days.
What happens when my quota is no longer enough?
We let you know by email in good time before the quota is reached and recommend the right larger plan. You can switch at any time.
Refer a customer: what do I get for a recommendation?
Every customer has a personal link in the dashboard under “Weiterempfehlen” (recommend). With a paid plan you get one month free for each referred customer who books a paid plan for the first time (your next due date moves back by one month, also on annual billing). With Free you get a one-time 500 extra checks for each referred customer who proves themselves (account confirmed and at least 100 successful checks, or they book a paid plan), in the month the referral counts. If a paid account refers a customer who stays on Free, there is no reward. Each referred customer counts at most once per kind; your own accounts and accounts with the same company email domain do not count (for providers such as gmail.com or web.de they do). The link works without cookies and without storing IP addresses.
Can I use it instead of reCAPTCHA?
Yes. Server verification is reCAPTCHA-compatible. See the “Developers” section.
Does it work without JavaScript?
No. The proof-of-work runs in the browser and requires JavaScript. Without it no token can be created; your form should show a note for that case.
Is there a WordPress plugin?
Yes. It protects comments, login, registration, password reset, WooCommerce and the common form plugins (Contact Form 7, WPForms, Gravity Forms, Elementor Pro, Formidable, Ninja Forms, Gwolle Guestbook) as well as your own forms via a hook. Download and instructions are in the dashboard under “Plugins”.
Is there a WHMCS module?
Yes. The addon protects login, registration, checkout, contact form, tickets, password reset and the admin login and runs on WHMCS 7.7 to 9 with any theme. Download and instructions are in the dashboard under “Plugins”.
Is there a plugin for Shopware?
Yes, for Shopware 6 (6.5 to 6.7) and Shopware 5 (5.5 to 5.7). In Shopware 6 it protects the contact form, newsletter and registration (also in checkout); in Shopware 5 additionally reviews, blog comments and tell-a-friend, and optionally login and password reset. Download and instructions are in the dashboard under “Plugins”.
Is there a module for Odoo?
Yes, for Odoo 17, 18, 19 and 20. It protects website forms (contact, job applications …), sign-up, password reset and login, and with the matching apps also events, newsletter, shop guest checkout, forum and course reviews. Enter site key and secret per website in the website settings.
Are there libraries for my own applications?
Yes: PHP (composer require hostily/captcha), Python (pip install hostily-captcha) and Node.js (npm install @hostily/captcha). Ready-made examples for HTML/PHP, Laravel, Symfony, Express, Next.js, Django, Flask and FastAPI are in the dashboard under “Code”. Any other language verifies the token with a simple HTTP call.
Where do the servers run?
At Hetzner in Germany. The operator is connect – Media & Teledienst.
How do I get help?
By email at info@hostily.de. You can see the operating state on the status page.
Ready for forms without spam?
Questions or want an account? Write to info@hostily.de.