Script options
Updated
The script is served at https://bot403.com/v1/bot403.js, cached for one day with an ETag. It is 6 KB, sets no cookies, reads no storage and makes one request to the challenge endpoint. The same request from a terminal shows whether your public key works:
curl "https://bot403.com/api/v1/challenge?pk=pk_live_YOUR_PUBLIC_KEY"| Option | Where | Effect |
|---|---|---|
data-bot403-key or data-site-key | script tag | Protect every form on the page with this key. |
data-bot403-key on a <form> | form | Protect only this form, or use a different site for it. When the script tag has no key, only forms with the attribute are protected. |
window.Bot403.solve(key) | JavaScript | Get a token for fetch submissions. key is optional when the script tag has one. |
window.Bot403.attach(form) | JavaScript | Protect a form element you created. Forms added to the page are found without this call. |
window.Bot403.field | JavaScript | The hidden field name, _bot403. |
Timing
The script solves the puzzle when a visitor focuses a field. If the visitor submits before the answer is ready, the script holds the submit for up to 10 seconds, then lets the form go with or without a token. A challenge request that fails never blocks a form. Tokens are single-use, so after a submit the script fetches a new one on the next focus.
Nothing visible
The script draws nothing on your page on any plan. It adds two hidden inputs inside each protected form and changes nothing else in the DOM.
Content Security Policy
If your page has a CSP, permit these:
script-src https://bot403.com;
connect-src https://bot403.com;
worker-src blob:;Without worker-src blob: the script solves the puzzle on the main thread. It still works; the page may stall for a fraction of a second.
The Altcha web component
The Altcha widget also works. Point <altcha-widget challengeurl="https://bot403.com/api/v1/challenge?pk=pk_live_YOUR_PUBLIC_KEY"> at the challenge endpoint; Bot403 accepts the altcha field on verify.