Abuse

What is banned

• Using Bot403 on pages that phish for passwords, card numbers or other secrets.
• Pages that break the law in the EU, distribute malware, or harass or threaten people.
• Scripts that request challenges or verifications hundreds of times a minute to fill a quota or to test the limits of the service.
• Reselling the verify API as your own service without telling your customers where the check runs.

What the service does about it

Every endpoint has a rate limit per IP address. Sign-ups from disposable email domains are refused. Accounts that never create a site are deleted after 7 days. An account that breaks the rules is suspended; its challenge endpoint then answers 404 and its forms submit without a token.

What Bot403 cannot do

Bot403 can stop issuing challenges for a site. It cannot take a page down, and it never sees the content of a form. For the content of a page, contact the hosting provider of that page.

How to report abuse

Email [email protected] with the URL of the page, the public key on it if you can see it (it starts with pk_live_), and what you saw. I answer reports within 1 business day and act the same day when the report is clear.