Live now · plans from $5 a month

Invisible bot protection for every sign-upAI-built applogincheckoutAPI call

Keep bots, fake sign-ups and password guessing out of the apps you ship, including the ones you vibe-coded. People never solve image puzzles, every bot pays for every try, and it takes one prompt to set up.

One prompt or five minutes

shop.example/sign-up

Create your account

Create account ✓ Welcome aboard

Protected by RevokeGPT · no puzzle shown

bot-farm.py · 40 workers

    attacker · replaying a stolen pass

    Pass copied from a real visit rgtk.v1.Qm9vT2s…x8Kp Used

    POST /sign-up with the same pass

    RevokeGPT Watching

    1. 1
      Proof of workA small sum, solved in the background
      0.00 s
    2. 2
      SignalsBrowser, network, behaviour
      8 / 8 normal
    3. 3
      Score1.0 = human · 0.0 = bot
      0.9
    4. 4
      Single-use passSealed, bound to this page, 5 min
      Issued
    Attempts0
    CPU time the bots burned0 s
    Typical score0.1
    AUTOMATION DATACENTER_IP TOO_MUCH_TRAFFIC
    Accounts created0

    POST api.revokegpt.com/v1/siteverify

     

    Every pass is spent the first time it is checked. A copy is worthless.

    Illustration · real flow, sample numbers
    0 image puzzles for people in invisible mode, unless we are truly unsure
    0 cookies set by RevokeGPT on your visitors
    1 × each pass can be checked once, then it is spent
    28 languages in the widget, with an audio puzzle option
    Built for vibe-coded apps

    You shipped it with AI. Bots found it the same day.

    Apps built fast with Cursor, Claude Code, Lovable, Bolt or v0 often go live with open forms and no bot protection. RevokeGPT closes that gap with one prompt, and plans start at $5 a month.

    • Fake sign-ups Scripts make thousands of accounts on your app.
    • Burned AI credits Bots call your AI features and you pay the bill.
    • Password guessing Stolen passwords tried on your login, one by one.
    • Spam and scraping Forms filled with junk, content copied by the page.
    1 prompt ~5 minutes from $5 a month
    Your AI coding tool
    Copy the prompt for your AI tool
    Add RevokeGPT bot protection to this app.
    1. On pages with sign-up, login or contact forms, load
       https://js.revokegpt.com/v1/api.js and put
       <div class="revokegpt" data-sitekey="MY_SITE_KEY" data-action="signup"></div>
       inside each form (use action "login" or "contact" as fits).
    2. On the server, before handling those forms, POST the form's
       "revokegpt-response" field and secret=process.env.REVOKEGPT_SECRET
       to https://api.revokegpt.com/v1/siteverify.
    3. Reject the request unless success is true, hostname is my domain
       and score >= 0.5. Keep the secret in an env variable, never in
       client code.
    Get a site key, then paste the prompt
    How it works

    Three steps. About five minutes.

    No puzzles to design, no rules to tune. Turn it on and it starts working.

    1. 1

      Add one script

      Paste a script tag and a div into any form. The check runs in the background while the person types.

    2. 2

      Check the pass on your server

      Your server sends the pass to our siteverify API and gets back a score and plain reasons. One request.

    3. 3

      Bots pay, people pass

      Real visitors go straight through. Bots burn computing power on every try, and their passes are refused.

    Your form is protected

    See the whole flow, message by message →

    Three modes

    Pick how visible you want it.

    Set the mode per site in the dashboard. Switch any time, without changing your code.

    Default

    Invisible

    Nothing to click. The check runs while the person fills the form. Only when we are truly unsure does a short puzzle appear.

    Best for Sign-ups, logins, checkouts

    Familiar

    Checkbox

    A single “I am human” box for pages where people expect one. One tick, no traffic lights.

    Best for Contact forms, comments

    You decide

    Score only

    Never shows anything. Your server gets a score and reasons, and decides: allow, ask for email code, or block.

    Best for APIs, high-value actions

    Everything in the box

    More than a CAPTCHA.

    The same check that guards a form also guards logins, accounts and your whole site.

    Every try costs a bot

    Each visit solves a small proof-of-work in the background. A person never notices. A bot farm making a million tries pays for a million of them, and risky networks get harder sums.

    Signals, not surveillance

    We look at how a visit behaves, never who it is.

    • Real browser engine ok
    • Driven by a script AUTOMATION
    • Cloud server network DATACENTER_IP
    • Too many tries TOO_MUCH_TRAFFIC

    Passes work once

    Sealed, tied to your site and action, valid five minutes, spent on the first check.

    Account protection

    Spot stolen-password attacks, fake sign-up waves and accounts that share a device. Ask for an email code only when a sign-in looks wrong.

    Leaked password check

    Warn people who pick a password from a known breach. Only five characters of a hash leave your server.

    Firewall at your edge

    Write a rule once, enforce it in Workers, Next.js, Nginx, Lambda@Edge, Fastly and more.

    28 languages, built for everyone

    Right-to-left layouts, keyboard and screen-reader support, and an audio puzzle.

    Private by design

    No cookies. No stored IP addresses or user agents. Logs keep a short monthly code per site, a network type and yes-or-no results, for 31 days. Your data lives in an EU-region database.

    • Tracking cookies
    • Stored IP addresses
    • Ad profiles
    • Selling data

    Talk to it from your AI tools

    An MCP server lets assistants list sites, read analytics and draft firewall rules, read-only by default.

    For developers

    A div on the page.
    One call on the server.

    Drop the widget into any form, then send the pass to siteverify. You get a score from 0.0 to 1.0 with plain reasons, and you decide what happens next.

    sign-up.html

    <script src="https://js.revokegpt.com/v1/api.js" async defer></script> <form action="/sign-up" method="post">  <input name="email" type="email" required />  <!-- Fills a hidden "revokegpt-response" field -->  <div class="revokegpt" data-sitekey="rgpk_..." data-action="signup"></div>  <button>Create account</button></form>

    200 siteverify response

    {
      "success": true,
      "score": 0.9,
      "action": "signup",
      "hostname": "shop.example",
      "challenge_ts": "2026-11-11T09:41:00Z",
      "mode": "invisible",
      "reasons": []
    }
    • score 1.0 is a person, 0.0 is a bot, in steps of 0.1
    • reasons plain codes such as AUTOMATION or DATACENTER_IP
    • success is false for a copied, expired or wrong-site pass

    Works with your stack

    • Script tag live
    • JavaScript npm soon
    • React npm soon
    • Vue / Nuxt npm soon
    • Node npm soon
    • Cloudflare Workers firewall
    • Next.js firewall
    • Python firewall
    • Laravel firewall
    • Go firewall
    • Spring firewall
    • Nginx / OpenResty firewall
    • AWS Lambda@Edge firewall
    • Fastly firewall
    • iOS · Android planned
    • Flutter · React Native planned
    • WordPress planned

    live works today · npm soon built, publishing to npm · firewall block bad traffic before it reaches your app · planned on the roadmap

    Moving from reCAPTCHA

    Change two addresses. Keep your code.

    RevokeGPT speaks the reCAPTCHA v2, v3 and Enterprise browser API. Point the script and the siteverify call at us, swap the keys, and your existing pages keep working.

    • Same g-recaptcha markup and g-recaptcha-response field
    • Same score direction: 1.0 is a person
    • Tested against Google's own unmodified example pages
    Before
    <!-- your page -->
    <script src="https://www.google.com/recaptcha/api.js"></script>
    <div class="g-recaptcha" data-sitekey="6LcXyz…"></div>
    
    // your server
    POST https://www.google.com/recaptcha/api/siteverify
    secret=6LcXyz…
    After
    <!-- your page -->
    <script src="https://js.revokegpt.com/recaptcha/api.js"></script>
    <div class="g-recaptcha" data-sitekey="rgpk_…"></div>
    
    // your server
    POST https://api.revokegpt.com/recaptcha/api/siteverify
    secret=rgsk_…
    Compare

    How RevokeGPT stacks up.

    The short version: people pass, bots pay, nobody gets tracked.

    RevokeGPT compared with reCAPTCHA, hCaptcha, Cloudflare Turnstile and Friendly Captcha
    Feature RevokeGPTreCAPTCHAhCaptchaTurnstileFriendly Captcha
    No image puzzles for people Yes Only if truly unsure No v2 shows them No Shows them on some plans Yes Yes
    Bots pay with proof-of-work Yes Not stated Not stated Yes Yes
    No cookies on your visitors Yes No Sets cookies No Sets cookies Not stated Yes
    Score with reasons Yes Yes v3 and Enterprise Partly Enterprise No Pass or fail Not stated
    Account and login protection Yes Partly Enterprise, paid Partly Enterprise No Not stated

    From each vendor's public pricing and documentation pages, checked 11 November 2026. Plans change; tell us if something here is out of date. Product names belong to their owners.

    Pricing

    Plans that start at $5.

    Pick a plan by how many checks you need.

    Basic

    Available now

    a month

    For side projects and small sites.

    • 1M checks a month
    • All verification modes
    • Scores with reasons
    • Basic analytics
    Get Basic

    Pro

    Available now

    a month

    For growing products that need more volume and depth.

    • 3M checks a month
    • Everything in Basic
    • Full analytics
    • Leaked-password check
    • Account protection
    • Email codes
    Get Pro

    Business

    Available now

    a month

    For high-traffic products and teams.

    • 15M checks a month
    • Everything in Pro
    • Mobile app checks
    • Firewall policies and integrations
    • MCP write tools
    Get Business

    Protect your first form
    in five minutes.

    Pick a plan, no sales call.