Self-host captcha
v3.9.7Privacy-focused CAPTCHA with self-hosted bot protection
- Stars
- 305
- RAM
- 4 GB
- Ports
- 80 (HTTP (Caddy ACME challenge)), 443 (HTTPS (Caddy TLS termination)), 9229 (Provider HTTP API (loopback only for setup))
- Requires
- MongoDB, Redis Stack
prosopo/providerWhat is captcha?
Prosopo Procaptcha is a privacy-first CAPTCHA service that replaces reCAPTCHA, hCaptcha, and Turnstile without collecting user data. It provides several challenge types: an invisible proof-of-work option, a slider puzzle with procedural graphics, and image tasks that work with a custom dataset. The self-hosted stack runs in four containers — MongoDB, Redis Stack, the provider API, and Caddy for TLS — using the prosopo/provider Docker image. First-party integrations cover WordPress, major JavaScript frameworks, Cloudflare Workers, AWS Lambda@Edge, and Qualtrics. The code is Apache-2.0 licensed with no usage caps. Self-hosting handles challenge delivery and verification; the managed tiers add machine-learning scoring, automatic blocking, access rules, and analytics.
Should you self-host captcha?
captcha scores 50/100 on selfhost.directory (how scoring works) and ranks #42 of 78 in Security. It has 305 GitHub stars.
It shipped 28 stable releases in the past year. The latest, v3.9.7, came out on 28 October 2026. New versions land roughly every 1 days.
Setup is advanced: plan for several services and some ongoing maintenance. An official Docker image is available. It is Apache-2.0-licensed and written mostly in Typescript.
Its closest alternative on selfhost.directory is capjs (72/100, 8 197 stars). It scores higher overall, so compare the two before you pick. See captcha vs capjs side by side.
Features
- Apache-2.0 LicenseClient-side detection library for frictionless mode is closed-source
- Asset URL SigningOpt-in, requires CDN support and configuration variables
- Custom Detector SupportExample detector provided; custom detectors require building a detector pool
- Edge Runtime Support
- Framework Integrations
- Frictionless Dynamic CAPTCHARequires loading a custom detector (e.g., BotD example) when self-hosted; managed detector is closed-source
- Image CAPTCHARequires building and hosting your own image dataset
- Multi-Provider Load Balancing
- Proof-of-work CAPTCHA
- Server-side Token Verification
- Slider Puzzle CAPTCHA
- WordPress Plugin
- Zero Data Collection
captcha README
FAQ
The widget doesn't appear at all, and there is no error message.
Some failures are only written to the browser console. Open developer tools and check the console for errors.
What does CAPTCHA.PARSE_ERROR mean?
Prosopo received a request from the widget it could not read, usually from a stale or modified copy of the Procaptcha bundle. Hard-refresh and ensure you're loading the official bundle.
Are requests made with a test site key billed?
No, requests with reserved test site keys are excluded from billable usage and plan quota. A site key you create for staging is an ordinary key and its verifications are billable.
How do I test my integration without solving a CAPTCHA?
Use reserved test site keys — one always passes and one always fails, so tests never have to solve a challenge. The widget shows a warning banner with test keys.
What does No session found mean?
The challenge session expired or was already used. The widget resets after about 10 seconds, or refresh the page.
What does Incorrect CAPTCHA type mean?
The widget requested a different CAPTCHA type than the site key is configured for. Usually a stale session (refresh clears it) or a direct API integration asking for a type the site key isn't configured for.
What does Unauthorized origin URL mean?
The domain serving the widget is not on the site key's list of allowed domains. Add it in the Prosopo portal including staging and preview domains.
What does Invalid site key mean?
The data-sitekey value is not well-formed, usually truncated or a placeholder that was never substituted. Copy the key from the Prosopo portal.
What does Site key not registered mean?
The site key is not registered in the Prosopo system, usually because the account was never activated. Click the activation link in your email or contact support.
More in Authentication
CasdoorSelf-hosted open-source IAM and SSO server with a web console, a built-in MCP server for AI agents, and support for more than 100 identity providers.
clinSelf CLI provisions a production-ready backend — PostgreSQL, Hasura GraphQL, Auth, Nginx — on your own server in minutes via Docker. MIT licensed with 171 plugins.
cosmos-server☁️ The Most Secure and Easy Selfhosted Home Server. Take control of your data and privacy without sacrificing security and stability (Authentication, anti-DDOS, anti-bot)
DaptinAn open-source, self-hosted application server: model your data once and Daptin serves JSON:API and GraphQL endpoints, users, permissions, files, jobs and realtime.
dashgateSelf-hosted, open-source app gateway for web services with multi-method auth, group access control, and auto-discovery from Docker, Traefik, Nginx, and more.
defguardSelf-hosted WireGuard VPN platform bundling an identity provider, per-connection MFA, LDAP/AD sync and firewall ACLs; open-source AGPL core written in Rust.
DexOpen-source, self-hosted OIDC and OAuth 2.0 identity service that fronts LDAP, SAML, GitHub, Google and other IdPs, so every app just speaks OpenID Connect.
directory-serverApache Directory Server is a self-hosted, open-source LDAPv3 directory server in Java with Kerberos, multi-master replication, and password policies.
docker-sso-serverLightweight self-hosted SSO server with OAuth2 and OTP, runs in a tiny container (<1% CPU, ~15 MiB RAM) and works as Traefik Forward Auth backend.
dockserverDockServer is a self-hosted, open-source Docker management system that automates Traefik, Authelia, and 100+ apps via a menu-driven CLI on Ubuntu with Cloudflare.
email-oauth2-proxySelf-hosted open-source proxy adding OAuth 2.0 to legacy email clients for Exchange, Gmail, and more.
FCaptchaSelf-hosted, open-source CAPTCHA detecting AI agents and bots with behavioral analysis and proof-of-work. Drop-in replacement for Turnstile, reCAPTCHA, hCaptcha.
0 comments