Bot403 as a Botpoison alternative
Updated
Both stop bots on web forms. The differences are in what the visitor sees, what runs on your page, what the free plan includes, and where the data is stored.
Where Botpoison is better
Botpoison has been in the market for years, so it has a longer record of stopping spam on real sites. It has a Node.js library, a live counter of blocked bots on its home page, and it bills in US dollars, which is simpler when your company pays in dollars. If a long track record matters most to you, Botpoison is the safer pick. Bot403 is one person and one server in the EU with an open protocol underneath. 5,000 checks a month are free, and 50,000 cost €3 a month.
Where Bot403 is better
Bot403 never shows a puzzle, sets no cookies and loads nothing from third parties on your page. The token format is open (Altcha, MIT), so your server can verify it with an open-source library or with the API. The dashboard shows failures by reason and the origins that send them. Everything runs on one server in the EU, and the free plan has 5,000 checks a month.
Side by side
The facts come from the public page of Botpoison (https://botpoison.com/pricing), checked on 2026-09-18. "Not stated" means the page does not say. If something changed, email me. Then I will correct it.
| Capability | Bot403 | Botpoison |
|---|---|---|
| Method | proof of work (Altcha protocol, MIT) | proof of work |
| Visible puzzle for visitors | never | never |
| Cookies set by the widget | none | not stated |
| Data used for ads | none collected | "We don't sell data" |
| Free tier a month | 5,000 verifications, 2 sites | 1,000 challenges |
| First paid plan | €3 a month, 50,000 (VAT included) | $2 a month, 5,000 |
| Per-site statistics and failure reasons | yes, 30 days | not stated |
| Token verifiable with an open-source library | yes, altcha-lib-go and the Altcha libraries | not stated |
| MCP server and OpenAPI file | yes | not stated |
| Hosted in the EU | yes | not stated |
Switch in 10 minutes
Remove the Botpoison script and widget from the page. Add one script tag with your public key. On the server, replace the Botpoison verify call with a POST to /api/v1/verify. The verify page has the request for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby. The form fields stay as they are.