A human check without the puzzles
Forms on the open web fill up with fake sign-ups, stuffed logins and spam. The usual fix makes real people squint at blurry pictures. Rimbra Captcha asks for one click instead.
Behind that click the browser solves a small piece of work that takes a person a fraction of a second and makes running thousands of fake submissions slow and expensive. Visitors asking unusually often get a harder piece of work, and browsers that announce they are automated are refused.
For forms that draw determined bots, set the key to Strong. Visitors then also slide one puzzle piece into a picture. We draw the picture on our servers, so the answer never reaches the page, and we check the drag itself, not just where it ends.
Two lines on the page, one call on the server
- 1
Create a site key in the dashboard and list the hostnames it runs on.
- 2
Add the script and a box to your form: <div class="rimbra-captcha" data-sitekey="…">.
- 3
Your form now sends rimbra-captcha-response. On your server, post it with your secret to siteverify before trusting the form.
siteverify answers with success, challenge_ts, hostname and error-codes, the same shape most captcha services use, so switching is usually a URL and a field name.
Checkbox or invisible
| Style | What visitors see |
|---|---|
| Checkbox | A small box to tick. Most people pass in under a second. |
| Invisible | Nothing. The check runs when the form is sent, then the form goes through. |
Built to be hard to fake
- Tokens are signed, tied to your site key and the page’s hostname, work once and expire after 5 minutes.
- A key only works on the hostnames you list, so it can’t be lifted onto someone else’s site.
- Secrets are stored encrypted and can be replaced at any time.
- Test keys that always pass or always fail, for local development and CI.
Questions
Does it set cookies or track visitors?
No. The check needs no cookies and Rimbra keeps no profile of the people who pass it.
What about people using screen readers or keyboards?
The checkbox is a real button you can reach with Tab and press with Space or Enter, and its result is announced.
Can it run on localhost?
Yes. Add localhost to the key’s hostnames, or use the test keys, which run anywhere.