FAQ
HumanProof questions, answered.
Plan limits, widget variants, server verification, risk signals, and how HumanProof differs from puzzle-first CAPTCHA providers.
What is HumanProof? +
HumanProof is a managed CAPTCHA control plane around proof-of-work challenges. It provides hosted widget assets, project keys, backend verification, usage limits, billing state, and organization controls.
How is this different from reCAPTCHA or hCaptcha? +
HumanProof focuses on proof-of-work and operational control instead of puzzle-first flows. It keeps project, billing, risk, and audit state in your own product workflow.
How is this different from Friendly Captcha? +
Friendly Captcha also uses a proof-of-work style approach. HumanProof adds a custom branded/unbranded widget layer, project management, Stripe-aware plans, risk telemetry, and support-ready recovery workflows.
What does the Free plan include? +
Free includes one project, 100 protected attempts per month, the branded default visible widget, no usage metrics, and community support.
When do I get unbranded widgets? +
Starter and higher plans can use unbranded widgets. Starter includes default and compact variants; Growth and Business add invisible CAPTCHA.
What is a protected attempt? +
A protected attempt is counted when a challenge is solved or blocked by the challenge flow. The following backend verification call does not double-count that same browser solve.
Can I use compact or invisible CAPTCHA on Free? +
No. Free intentionally stays simple: branded default widget only. Compact starts on Starter, while invisible starts on Growth.
How long does a solved token last? +
The hosted widget defaults to a 10 minute expiry. After expiry it clears the token and can solve again based on the configured trigger.
Does risk scoring block users? +
Growth and Business include risk signals and protection presets. Projects can stay in observe mode, or enforce risk blocking when the score reaches the selected preset threshold.
Do I need to expose the challenge backend publicly? +
No. HumanProof proxies public challenge traffic through project sitekeys and keeps the internal challenge engine/admin API isolated.
Where should the backend secret live? +
Only on your server. Browser code uses the public sitekey endpoint; your backend posts humanproof-token plus the secret to siteverify.
Can I use this with WordPress or plain PHP? +
Yes. The docs include plain PHP and WordPress examples. The main requirement is reading humanproof-token from the submitted form and verifying it server-side.