FAQ
HumanProof questions, answered.
Plan limits, widget variants, server verification, risk signals, and how HumanProof differs from puzzle-first CAPTCHA providers.
What is HumanProof? +
HumanProof is a managed CAPTCHA control plane around proof-of-work challenges. It provides hosted widget assets, project keys, backend verification, usage limits, billing state, and organization controls.
How is this different from reCAPTCHA or hCaptcha? +
HumanProof focuses on proof-of-work and operational control instead of puzzle-first flows. It keeps project setup, billing state, risk evidence, and audit history close to the forms your team already manages.
How is this different from Friendly Captcha? +
Friendly Captcha also uses a proof-of-work style approach. HumanProof adds brand control, project management, Stripe-aware plans, risk evidence, and recovery tools for support teams.
What does the Free plan include? +
Free includes one project, 1,000 protected attempts per month, the branded default visible widget, no usage metrics, and community support.
When do I get unbranded widgets? +
Starter and higher plans can use unbranded widgets. Starter includes default and compact variants; Growth, Business, and Agency add invisible CAPTCHA.
What is a protected attempt? +
A protected attempt is counted when a challenge is solved, a solve fails, or risk enforcement blocks the browser challenge flow. The following backend verification call does not double-count that same browser solve.
Can I use compact or invisible CAPTCHA on Free? +
No. Free intentionally stays simple: branded default widget only. Compact starts on Starter, while invisible starts on Growth.
How long does a solved token last? +
The hosted widget defaults to a 10 minute expiry. After expiry it clears the token and can solve again based on the configured trigger.
Does risk scoring block users? +
Growth, Business, and Agency include risk signals and protection presets. Projects can stay in observe mode, or enforce risk blocking when the score reaches the selected preset threshold.
Do I need to expose the challenge backend publicly? +
No. HumanProof proxies public challenge traffic through project sitekeys and keeps the internal challenge engine/admin API isolated.
Where should the backend secret live? +
Only on your server. Browser code uses the public sitekey endpoint; your backend posts humanproof-token plus the secret to siteverify.
Can I use this with WordPress or plain PHP? +
Yes. The docs include plain PHP and WordPress examples. The main requirement is reading humanproof-token from the submitted form and verifying it server-side.