Guides
Bot403 is an invisible bot shield for HTML forms: one script tag makes the browser solve a small proof of work, and your server checks it with one call.
Updated
Each framework guide has a full contact form and the server code that checks the token. It also shows one common trap of that framework and a way to test the form. Every example was run before it was published.
Frameworks
- Stop form spam in Astro
A contact form in Astro 7 and an on-demand endpoint that checks the token. The trap: the endpoint needs a server adapter. - Stop form spam in Next.js
A server action and a route handler in Next.js 16 that check the token. The trap: redirect() inside a try/catch block. - Stop form spam in Laravel
A Blade form and a controller in Laravel 13 that check the token. The trap: the CSRF token. - Stop form spam in Django
A Django 6 view that checks the token, and tests for the view. The trap: CSRF, and why csrf_exempt is never the fix. - Stop form spam in Hugo
A static Hugo site with a Cloudflare Worker that checks the token. The trap: Hugo removes raw HTML in Markdown.
Switching, privacy and errors
- Migrate from reCAPTCHA in 10 minutes
The diff for the HTML and the server code of an Express form. Also notes for PHP, Python, reCAPTCHA v3 and your privacy policy. - GDPR and CAPTCHAs
What the Austrian court ruled on reCAPTCHA in 2024, and what CNIL and the EDPB say. Then what this means for a form on an EU site. - Troubleshooting
Every failure reason that the verify API returns, with its cause and its fix: replay, expired, quota, invalid, origin not allowed and more.
If you use a different framework, read the verify page. It has the server call for Node.js, Bun, Deno, Hono, Next.js, Cloudflare Workers, PHP, Python, Go and Ruby.