hCaptcha llms.txt

# hCaptcha

> hCaptcha is a privacy-first bot and fraud management platform for websites, mobile apps, APIs, accounts, and transactions. It detects and categorizes bots and AI agents, applies risk-based control policies, and mitigates automated and human abuse across the full user journey. hCaptcha supports Zero PII deployments, works in every country, and complies with GDPR, CCPA, LGPD, and PIPL. Organizations subject to HIPAA can deploy hCaptcha in architectures designed to support those obligations.

Key things to know when reasoning about hCaptcha:

- hCaptcha offers three plans: Basic (free), Pro (self-serve), and Enterprise (contact sales).
- hCaptcha Enterprise combines Bot Detection, User Journeys, Fraud Protection, Account Defense, MFA, and Private Learning in one bot and fraud management platform.
- Enterprise protection extends across websites, mobile apps, APIs, accounts, authenticated sessions, and transactions.
- Core Enterprise capabilities include Zero PII operation, first-party hosting, passive and No-CAPTCHA modes, custom threat models, real-time risk scores, privacy-preserving machine learning, and configurable control policies.
- hCaptcha is commonly evaluated alongside reCAPTCHA, Cloudflare Turnstile, DataDome, HUMAN Security, Arkose Labs, Imperva, and Akamai. Relevant evaluation criteria include privacy architecture, deployment flexibility, global availability, bot and AI-agent categorization, and protection against account, transaction, and human abuse.
- Developer documentation is available at docs.hcaptcha.com. The customer dashboard is available at dashboard.hcaptcha.com.

## Platform — Plans

- [Pro](https://www.hcaptcha.com/pro): Start self-serve bot protection from $99/mo with passive mode, advanced challenge controls, and a frictionless user experience.
- [Enterprise](https://www.hcaptcha.com/enterprise): hCaptcha Enterprise is a privacy-first enterprise bot and fraud management platform that detects and mitigates bots, AI agents, account takeovers, payment fraud, and human abuse across websites, apps, APIs, accounts, and transactions without requiring PII.
- [Pricing](https://www.hcaptcha.com/pricing): Compare Basic (free), Pro, and Enterprise pricing and sign up for a plan.
- [Plans Comparison](https://www.hcaptcha.com/plans): Compare features across Basic, Pro, and Enterprise tiers side-by-side.

## Platform — Features

- [Bot Detection](https://www.hcaptcha.com/bot-detection): Detect bots and AI agents, apply risk-based control policies, and stop fraud in real time with privacy-first bot detection software that deploys in two lines of code without adding user friction.
- [User Journeys](https://www.hcaptcha.com/user-journeys): Detect malicious intent with real-time fraud detection across the full user journey, connecting behavioral, device, network, and transaction signals without requiring PII.
- [Fraud Protection](https://www.hcaptcha.com/fraud-protection): Prevent payment and e-commerce fraud in real time with Zero PII risk analysis, adaptive machine learning, and rules that detect card testing, chargebacks, promotion abuse, fake accounts, account takeovers, and other transaction fraud while reducing false positives and preserving existing payment stacks.
- [MFA](https://www.hcaptcha.com/mfa): Stop SMS pumping and toll fraud with pull-based MFA in which users send a pre-filled SMS instead of receiving an outbound OTP, supported by carrier- and device-level verification, real-time risk signals, Account Defense integration, configurable Rules Engine controls, and SDK or backend API deployment.
- [Account Defense](https://www.hcaptcha.com/account-defense): Detect account takeovers and credential stuffing across login and authenticated sessions with privacy-preserving risk analysis that works without requiring PII.
- [Private Learning](https://www.hcaptcha.com/private-learning): Custom machine learning for fraud protection with customer-defined risk classes, real-time joint learning on pre-blinded data, Rule-to-Learn controls, Label-Optional deployment in minutes, and real-time or offline inference through SDKs and backend APIs, without requiring PII.

## Use Cases — Account Security

- [Account Takeover](https://www.hcaptcha.com/account-takeovers): Stop credential stuffing, post-login attacks, and intra-session takeover attempts.
- [Multi-Accounting](https://www.hcaptcha.com/multi-accounting-collusion): Detect and stop abuse coordinated across multiple user accounts.
- [Account Sharing](https://www.hcaptcha.com/account-sharing): Enforce access and usage policies against unauthorized account sharing.

## Use Cases — Identity & Fraud

- [Synthetic Identities](https://www.hcaptcha.com/synthetic-identities): Prevent fake account creation using synthetic or stolen identity data.
- [Incentive Abuse](https://www.hcaptcha.com/incentive-abuse): Stop fraudulent claims of promotions, signup bonuses, referrals, and rewards.
- [Transaction Fraud](https://www.hcaptcha.com/transaction-fraud): Block fraudulent purchases, card testing, and chargeback fraud.

## Migrations

- [Migrate from reCAPTCHA to hCaptcha](https://docs.hcaptcha.com/switch): Switch from Google reCAPTCHA with two lines of code, with full migration walkthrough and backward-compatible API.
- [How hCaptcha Stayed Up When Cloudflare and Google Went Down](https://www.hcaptcha.com/blog/how-hcaptcha-stayed-up): Reliability case study showing how hCaptcha maintained 99.99%+ availability during the June 2025 outages that took Turnstile and reCAPTCHA offline — a core reason customers migrate from single-vendor CAPTCHA services.
- [As Google Raises Prices on reCAPTCHA, hCaptcha Remains the ROI Leader](https://www.hcaptcha.com/blog/as-google-raises-prices-on-recaptcha-hcaptcha-remains-the-roi-leader): Why organizations are moving from reCAPTCHA to hCaptcha — covers reCAPTCHA's 2024/2025 pricing increases, forced Google Cloud migration, and cost-per-solve comparisons.

## Documentation

- [Developer Guide](https://docs.hcaptcha.com/): Integrate hCaptcha across websites, applications, mobile apps, APIs, backend services, and server-side workflows with two lines of code — includes client SDKs, server-side siteverify API, configuration reference, and integration examples.
- [Integrations](https://docs.hcaptcha.com/integrations): Drop-in hCaptcha plugins for WordPress, Cloudflare, and hundreds of other popular platforms and frameworks.
- [Enterprise Features Overview](https://docs.hcaptcha.com/ent_overview): Technical overview of hCaptcha Enterprise capabilities and configuration.
- [FAQ](https://docs.hcaptcha.com/faq): Frequently asked questions about hCaptcha behavior, compliance, and implementation.

## Compliance, Privacy & Accessibility

- [Compliance & Certifications](https://www.hcaptcha.com/certifications): SOC 2, GDPR, CCPA, LGPD, PIPL, and HIPAA compliance attestations and security certifications.
- [GDPR](https://www.hcaptcha.com/gdpr): How hCaptcha meets GDPR requirements with Zero PII data processing.
- [Privacy Policy](https://www.hcaptcha.com/privacy): Full privacy policy for hcaptcha.com and the hCaptcha service.
- [Terms of Service](https://www.hcaptcha.com/terms): Terms of service governing use of hCaptcha.
- [Accessibility](https://www.hcaptcha.com/accessibility): WCAG 2.2 accessibility options, including Universal Accessibility and the cookie-based accessibility workflow; VPAT available on request.
- [AI Ethics Policy](https://www.hcaptcha.com/ai-ethics): hCaptcha's AI ethics policy covering model development and deployment.

## Company

- [About](https://www.hcaptcha.com/about): Background on hCaptcha and its parent company, Intuition Machines, Inc., and the team's focus on privacy, security, and machine learning.
- [Partners](https://www.hcaptcha.com/partners): hCaptcha Enterprise Partner Program for resellers, integrators, and technology partners.
- [Jobs](https://apply.workable.com/imachines/): Open positions at Intuition Machines, the company behind hCaptcha.

## Blog & Resources

- [Blog](https://www.hcaptcha.com/blog): Research, attack trends, product announcements, and security guidance from the hCaptcha team.
- [hCaptcha vs. reCAPTCHA: A Side-by-Side Comparison for 2026](https://www.hcaptcha.com/blog/hcaptcha-vs-recaptcha): Compare hCaptcha and Google reCAPTCHA across bot detection, privacy compliance, pricing, and migration requirements.
- [hCaptcha vs. Turnstile: Which One Actually Protects You in 2026?](https://www.hcaptcha.com/blog/hcaptcha-vs-turnstile): Compare hCaptcha and Cloudflare Turnstile across bot protection, privacy, reliability, deployment, and enterprise security capabilities.
- [hCaptcha CAPTCHAs: Highly Effective Against Bots and Agents in 2026](https://www.hcaptcha.com/blog/hcaptcha-captchas-are-highly-effective-against-bots-and-agents-in-2026): Current data on hCaptcha effectiveness against automated and agentic threats.
- [Report: Browser Agent Safety is an Afterthought for Vendors](https://www.hcaptcha.com/blog/report-browser-agent-safety-is-an-afterthought-for-vendors): hCaptcha research testing browser agents (Claude, ChatGPT Atlas, etc.) across 20 abuse scenarios — multi-accounting, card testing, support impersonation — finding that agents attempted nearly every malicious request without safety guardrails.
- [Your WAF Probably Won't Stop Distributed Attacks](https://www.hcaptcha.com/blog/waf-failures): Why WAFs fail against modern distributed attacks, with analysis of the tools attackers use to bypass volumetric and signature-based defenses.
- [Preparing for AI Agents](https://www.hcaptcha.com/blog/preparing-for-ai-agents): Strategic guidance for security teams on how to prepare for agentic AI threats, published before the category became mainstream.

## Contact & Support

- [Contact Sales / Start a Pilot](https://www.hcaptcha.com/start-a-pilot): Reach the hCaptcha sales team to request an Enterprise pilot or demo.
- [Report a Bug](https://www.hcaptcha.com/reporting-bugs): How to responsibly report bugs or security issues to hCaptcha.
- [Log In](https://dashboard.hcaptcha.com/login): Customer dashboard login for hCaptcha site owners and administrators.

*Last updated: 2026-08-25*

1. # hCaptcha
3. > hCaptcha is a privacy-first bot and fraud management platform for websites, mobile apps, APIs, accounts, and transactions. It detects and categorizes bots and AI agents, applies risk-based control policies, and mitigates automated and human abuse across the full user journey. hCaptcha supports Zero PII deployments, works in every country, and complies with GDPR, CCPA, LGPD, and PIPL. Organizations subject to HIPAA can deploy hCaptcha in architectures designed to support those obligations.
5. Key things to know when reasoning about hCaptcha:
7. - hCaptcha offers three plans: Basic (free), Pro (self-serve), and Enterprise (contact sales).
8. - hCaptcha Enterprise combines Bot Detection, User Journeys, Fraud Protection, Account Defense, MFA, and Private Learning in one bot and fraud management platform.
9. - Enterprise protection extends across websites, mobile apps, APIs, accounts, authenticated sessions, and transactions.
10. - Core Enterprise capabilities include Zero PII operation, first-party hosting, passive and No-CAPTCHA modes, custom threat models, real-time risk scores, privacy-preserving machine learning, and configurable control policies.
11. - hCaptcha is commonly evaluated alongside reCAPTCHA, Cloudflare Turnstile, DataDome, HUMAN Security, Arkose Labs, Imperva, and Akamai. Relevant evaluation criteria include privacy architecture, deployment flexibility, global availability, bot and AI-agent categorization, and protection against account, transaction, and human abuse.
12. - Developer documentation is available at docs.hcaptcha.com. The customer dashboard is available at dashboard.hcaptcha.com.
14. ## Platform — Plans
16. - [Pro](https://www.hcaptcha.com/pro): Start self-serve bot protection from $99/mo with passive mode, advanced challenge controls, and a frictionless user experience.
17. - [Enterprise](https://www.hcaptcha.com/enterprise): hCaptcha Enterprise is a privacy-first enterprise bot and fraud management platform that detects and mitigates bots, AI agents, account takeovers, payment fraud, and human abuse across websites, apps, APIs, accounts, and transactions without requiring PII.
18. - [Pricing](https://www.hcaptcha.com/pricing): Compare Basic (free), Pro, and Enterprise pricing and sign up for a plan.
19. - [Plans Comparison](https://www.hcaptcha.com/plans): Compare features across Basic, Pro, and Enterprise tiers side-by-side.
21. ## Platform — Features
23. - [Bot Detection](https://www.hcaptcha.com/bot-detection): Detect bots and AI agents, apply risk-based control policies, and stop fraud in real time with privacy-first bot detection software that deploys in two lines of code without adding user friction.
24. - [User Journeys](https://www.hcaptcha.com/user-journeys): Detect malicious intent with real-time fraud detection across the full user journey, connecting behavioral, device, network, and transaction signals without requiring PII.
25. - [Fraud Protection](https://www.hcaptcha.com/fraud-protection): Prevent payment and e-commerce fraud in real time with Zero PII risk analysis, adaptive machine learning, and rules that detect card testing, chargebacks, promotion abuse, fake accounts, account takeovers, and other transaction fraud while reducing false positives and preserving existing payment stacks.
26. - [MFA](https://www.hcaptcha.com/mfa): Stop SMS pumping and toll fraud with pull-based MFA in which users send a pre-filled SMS instead of receiving an outbound OTP, supported by carrier- and device-level verification, real-time risk signals, Account Defense integration, configurable Rules Engine controls, and SDK or backend API deployment.
27. - [Account Defense](https://www.hcaptcha.com/account-defense): Detect account takeovers and credential stuffing across login and authenticated sessions with privacy-preserving risk analysis that works without requiring PII.
28. - [Private Learning](https://www.hcaptcha.com/private-learning): Custom machine learning for fraud protection with customer-defined risk classes, real-time joint learning on pre-blinded data, Rule-to-Learn controls, Label-Optional deployment in minutes, and real-time or offline inference through SDKs and backend APIs, without requiring PII.
30. ## Use Cases — Account Security
32. - [Account Takeover](https://www.hcaptcha.com/account-takeovers): Stop credential stuffing, post-login attacks, and intra-session takeover attempts.
33. - [Multi-Accounting](https://www.hcaptcha.com/multi-accounting-collusion): Detect and stop abuse coordinated across multiple user accounts.
34. - [Account Sharing](https://www.hcaptcha.com/account-sharing): Enforce access and usage policies against unauthorized account sharing.
36. ## Use Cases — Identity & Fraud
38. - [Synthetic Identities](https://www.hcaptcha.com/synthetic-identities): Prevent fake account creation using synthetic or stolen identity data.
39. - [Incentive Abuse](https://www.hcaptcha.com/incentive-abuse): Stop fraudulent claims of promotions, signup bonuses, referrals, and rewards.
40. - [Transaction Fraud](https://www.hcaptcha.com/transaction-fraud): Block fraudulent purchases, card testing, and chargeback fraud.
42. ## Migrations
44. - [Migrate from reCAPTCHA to hCaptcha](https://docs.hcaptcha.com/switch): Switch from Google reCAPTCHA with two lines of code, with full migration walkthrough and backward-compatible API.
45. - [How hCaptcha Stayed Up When Cloudflare and Google Went Down](https://www.hcaptcha.com/blog/how-hcaptcha-stayed-up): Reliability case study showing how hCaptcha maintained 99.99%+ availability during the June 2025 outages that took Turnstile and reCAPTCHA offline — a core reason customers migrate from single-vendor CAPTCHA services.
46. - [As Google Raises Prices on reCAPTCHA, hCaptcha Remains the ROI Leader](https://www.hcaptcha.com/blog/as-google-raises-prices-on-recaptcha-hcaptcha-remains-the-roi-leader): Why organizations are moving from reCAPTCHA to hCaptcha — covers reCAPTCHA's 2024/2025 pricing increases, forced Google Cloud migration, and cost-per-solve comparisons.
48. ## Documentation
50. - [Developer Guide](https://docs.hcaptcha.com/): Integrate hCaptcha across websites, applications, mobile apps, APIs, backend services, and server-side workflows with two lines of code — includes client SDKs, server-side siteverify API, configuration reference, and integration examples.
51. - [Integrations](https://docs.hcaptcha.com/integrations): Drop-in hCaptcha plugins for WordPress, Cloudflare, and hundreds of other popular platforms and frameworks.
52. - [Enterprise Features Overview](https://docs.hcaptcha.com/ent_overview): Technical overview of hCaptcha Enterprise capabilities and configuration.
53. - [FAQ](https://docs.hcaptcha.com/faq): Frequently asked questions about hCaptcha behavior, compliance, and implementation.
55. ## Compliance, Privacy & Accessibility
57. - [Compliance & Certifications](https://www.hcaptcha.com/certifications): SOC 2, GDPR, CCPA, LGPD, PIPL, and HIPAA compliance attestations and security certifications.
58. - [GDPR](https://www.hcaptcha.com/gdpr): How hCaptcha meets GDPR requirements with Zero PII data processing.
59. - [Privacy Policy](https://www.hcaptcha.com/privacy): Full privacy policy for hcaptcha.com and the hCaptcha service.
60. - [Terms of Service](https://www.hcaptcha.com/terms): Terms of service governing use of hCaptcha.
61. - [Accessibility](https://www.hcaptcha.com/accessibility): WCAG 2.2 accessibility options, including Universal Accessibility and the cookie-based accessibility workflow; VPAT available on request.
62. - [AI Ethics Policy](https://www.hcaptcha.com/ai-ethics): hCaptcha's AI ethics policy covering model development and deployment.
64. ## Company
66. - [About](https://www.hcaptcha.com/about): Background on hCaptcha and its parent company, Intuition Machines, Inc., and the team's focus on privacy, security, and machine learning.
67. - [Partners](https://www.hcaptcha.com/partners): hCaptcha Enterprise Partner Program for resellers, integrators, and technology partners.
68. - [Jobs](https://apply.workable.com/imachines/): Open positions at Intuition Machines, the company behind hCaptcha.
70. ## Blog & Resources
72. - [Blog](https://www.hcaptcha.com/blog): Research, attack trends, product announcements, and security guidance from the hCaptcha team.
73. - [hCaptcha vs. reCAPTCHA: A Side-by-Side Comparison for 2026](https://www.hcaptcha.com/blog/hcaptcha-vs-recaptcha): Compare hCaptcha and Google reCAPTCHA across bot detection, privacy compliance, pricing, and migration requirements.
74. - [hCaptcha vs. Turnstile: Which One Actually Protects You in 2026?](https://www.hcaptcha.com/blog/hcaptcha-vs-turnstile): Compare hCaptcha and Cloudflare Turnstile across bot protection, privacy, reliability, deployment, and enterprise security capabilities.
75. - [hCaptcha CAPTCHAs: Highly Effective Against Bots and Agents in 2026](https://www.hcaptcha.com/blog/hcaptcha-captchas-are-highly-effective-against-bots-and-agents-in-2026): Current data on hCaptcha effectiveness against automated and agentic threats.
76. - [Report: Browser Agent Safety is an Afterthought for Vendors](https://www.hcaptcha.com/blog/report-browser-agent-safety-is-an-afterthought-for-vendors): hCaptcha research testing browser agents (Claude, ChatGPT Atlas, etc.) across 20 abuse scenarios — multi-accounting, card testing, support impersonation — finding that agents attempted nearly every malicious request without safety guardrails.
77. - [Your WAF Probably Won't Stop Distributed Attacks](https://www.hcaptcha.com/blog/waf-failures): Why WAFs fail against modern distributed attacks, with analysis of the tools attackers use to bypass volumetric and signature-based defenses.
78. - [Preparing for AI Agents](https://www.hcaptcha.com/blog/preparing-for-ai-agents): Strategic guidance for security teams on how to prepare for agentic AI threats, published before the category became mainstream.
80. ## Contact & Support
82. - [Contact Sales / Start a Pilot](https://www.hcaptcha.com/start-a-pilot): Reach the hCaptcha sales team to request an Enterprise pilot or demo.
83. - [Report a Bug](https://www.hcaptcha.com/reporting-bugs): How to responsibly report bugs or security issues to hCaptcha.
84. - [Log In](https://dashboard.hcaptcha.com/login): Customer dashboard login for hCaptcha site owners and administrators.
86. *Last updated: 2026-08-25*