What is Bot Check

Bot Check is a lightweight bot-detection widget that verifies whether a visitor is human before allowing form submissions or sensitive interactions. It is built around splitbrain’s botcheck project and is intended for sites that prefer self-hosted verification or tighter control over privacy and data flow.

Compared with Google reCAPTCHA, Bot Check trades the global telemetry and managed service model for a small footprint and local control. Against hCaptcha, it offers a simpler integration path for self-hosting rather than relying on a third-party service that monetizes challenge solving. Compared with Cloudflare Turnstile, Bot Check focuses on minimal dependencies and direct control over verification logic rather than an integrated CDN/edge solution.

All of this makes Bot Check well suited for developers and organizations that need a low-friction, privacy-respecting verification layer they can host and audit. It is especially useful for small to medium sites that want to avoid sending visitor interaction data to large third-party providers.

How Bot Check Works

Bot Check injects a client-side challenge into a page or form, typically as a small JavaScript widget. When a visitor interacts with the form, the widget performs lightweight behavioral checks and generates a token that the server can validate using a server-side verification endpoint.

Server-side verification involves sending the token to the self-hosted verification handler, which applies heuristics and checks to confirm human interaction before accepting the submission. This flow makes it possible to integrate Bot Check with existing form handlers, CMS plugins, or custom application logic without routing traffic through an external vendor.

What does Bot Check do?

Bot Check centers on low-friction human verification, offering a client widget, server verification endpoint, accessibility considerations, and options for customization. It emphasizes self-hosting and privacy, allowing site operators to keep verification data on their own infrastructure while still blocking automated spam and abusive submissions.

Client-side widget

The widget embeds in pages with a small JavaScript snippet and presents an invisible or visible verification step depending on configuration. This reduces friction for legitimate users while still collecting enough signals to distinguish automated traffic.

Server-side verification

A server endpoint validates tokens produced by the client widget and applies configurable heuristics or rate limits before accepting requests. This separation keeps sensitive logic off the browser and allows consistent enforcement across endpoints.

Accessibility support

Bot Check includes options to present accessible challenges or fallback verification paths so users with assistive technologies can complete forms. Accessibility options reduce false rejections and help comply with accessibility guidelines.

Privacy-friendly design

Because the project can be self-hosted, verification data remains under the operator’s control and is not automatically shared with large telemetry services. This reduces third-party tracking exposure and supports privacy policies that restrict external data transfers.

Customization and extensibility

Developers can tune challenge sensitivity, integrate with existing rate-limiting, or extend server-side checks with IP reputation and application-specific rules. The project structure supports adding new heuristic checks or integrating with logging and monitoring pipelines.

With these capabilities, the biggest benefit is a compact and self-hostable verification option that reduces spam while preserving user privacy and control.

Bot Check pricing

Bot Check follows an open-source, self-hosting model rather than a managed subscription service. That approach means there are no mandatory license fees to run the software on your own servers, and hosting costs depend on your infrastructure choices.

For organizations that want a hosted or managed option, third-party providers or custom integrations may introduce hosting or support fees. For details about deployment and any paid support options, consult splitbrain’s project page for Bot Check and related documentation on deployment and hosting strategies.

What is Bot Check used for?

Bot Check is commonly deployed to protect contact forms, signups, comment systems, and lightweight APIs from automated submissions. It is suitable for sites that need a verification gate without adding heavy vendor dependencies or tracking.

Teams that maintain their own web stack or run privacy-sensitive services use Bot Check as a first line of defense, combining it with server-side rate limiting and monitoring to reduce false positives while keeping control over data flows.

Pros and Cons of Bot Check

Pros

• Self-hostable verification: Running the verification stack on your servers gives full control over data, retention, and privacy settings. This reduces reliance on external vendors and simplifies compliance with strict data policies.
• Lightweight and low-friction: The client widget is compact and can operate invisibly for most users, reducing user friction while still capturing behavioral signals useful for bot detection.
• Customizable heuristics: Developers can adapt verification rules and integrate additional checks such as IP reputation or rate limits to match their threat model.
• Accessibility options: Built-in accessibility fallbacks help reduce false rejections for users who rely on assistive technologies.

Cons

• No managed service out of the box: Unlike commercial providers, there is no hosted, fully-supported service unless you contract a third party, which increases operational overhead. This means you must handle scaling, updates, and maintenance yourself.
• Limited commercial threat intelligence: It does not provide the broad telemetry and fraud signals that large vendors collect across many sites, so very advanced bot attacks may require supplementary defenses.
• Requires some developer effort: Integration and tuning require web development and operational work, which can be a hurdle for non-technical teams.

Does Bot Check Offer a Free Trial?

Bot Check is free and open-source for self-hosting, so you can deploy and test it without subscription costs. Operators only incur hosting and maintenance costs, and you can evaluate the verification flow on staging or production systems directly by following the project documentation on splitbrain’s site.

Bot Check API and Integrations

The project exposes a server-side verification endpoint that applications call to validate tokens produced by the client widget. The splitbrain Bot Check project page provides implementation notes and example server handlers for common stacks.

Integrations are implementation-level rather than plugin-based, so Bot Check is commonly paired with CMS form handlers, custom backend APIs, and web frameworks; operators often connect verification results with logging, rate-limiting, or WAF tools for layered protection.

10 Bot Check alternatives

Paid alternatives to Bot Check

• Google reCAPTCHA — Managed, widely used service with strong telemetry and risk analysis that is free for many sites but routes signals through Google’s infrastructure. See the reCAPTCHA documentation for details.
• hCaptcha — A privacy-focused commercial alternative that offers a managed service and monetization options for websites, with enterprise plans for higher-volume customers. Review the hCaptcha features to compare offerings.
• Cloudflare Turnstile — Free managed verification from Cloudflare that integrates with their edge network and provides low-latency checks for sites on Cloudflare. Check Cloudflare’s Turnstile overview for implementation details.
• Arkose Labs — Enterprise-grade bot mitigation and fraud prevention with challenge orchestration and risk scoring geared toward high-value targets. Explore Arkose Labs’ enterprise solutions for more information.
• PerimeterX — A commercial bot protection platform that uses behavioral signals and ML to protect web and API traffic, targeted at large e-commerce and SaaS providers. Learn about PerimeterX’s bot protection features.
• Imperva Bot Management — Enterprise WAF and bot defense integrated into a broader security platform with managed services and threat intelligence. See Imperva’s bot management for details.

Open source alternatives to Bot Check

• Securimage — A PHP CAPTCHA library that generates image and audio CAPTCHAs for self-hosted sites, useful for classic challenge-response verification on forms. Visit the Securimage project for setup instructions.
• php-captcha (SimpleCaptcha variants) — Lightweight libraries that create image-based CAPTCHAs and are easy to embed in PHP applications for simple bot deterrence. Search for language-specific implementations like SimpleCaptcha for integration examples.
• Captcha Library implementations — Various language-specific open-source CAPTCHA libraries exist for Java, Python, and Node.js that offer self-hosted challenge generation and verification; pick one that fits your stack and accessibility requirements.

Frequently asked questions about Bot Check

What is Bot Check used for?

Bot Check is used to verify human visitors before allowing form submissions or other interactions. It is commonly applied to contact forms, signups, comment systems, and lightweight APIs to reduce spam and automated abuse.

Does Bot Check have an API for verification?

Yes, Bot Check uses a server-side verification endpoint. The client widget produces a token that your backend posts to the verification handler to confirm human interaction before accepting the request.

Is Bot Check free to use?

Bot Check is free to self-host under its open-source project terms. You only pay for infrastructure, hosting, and any optional third-party managed services you add on top.

Can Bot Check replace Google reCAPTCHA on my site?

Yes, Bot Check can replace reCAPTCHA for many use cases. It provides a self-hostable verification flow that reduces reliance on third-party telemetry, though very large sites may still prefer managed services with broad threat intelligence.

How do I integrate Bot Check into a form workflow?

Integration involves embedding a small client widget and adding a server-side verification step. The widget generates a token at submission time and your backend validates that token using the verification endpoint before processing the form.

Final verdict: Bot Check

Bot Check is a practical choice for teams that want a compact, self-hostable human verification layer with minimal user friction and stronger control over privacy. It does not provide the broad cross-site telemetry of large commercial offerings, but that trade-off is intentional for operators who prioritize data control and simplicity.

Compared to Google reCAPTCHA, which is free and managed but routes signals through Google’s infrastructure, Bot Check requires more operational work but offers local control and easier auditing. For organizations that prefer a managed, telemetry-rich approach, a paid option such as Arkose Labs may provide deeper risk intelligence at a cost; for those who want ownership and privacy, Bot Check is a suitable, low-complexity alternative.