Frequently asked questions

For most visitors, yes. Katcha scores every request in the background and only shows a one-click checkbox or a short puzzle when the risk is high. Bots it is sure about are blocked outright.

Fake sign-ups and spam, credential stuffing and brute-force logins, card testing at checkout, SMS pumping on one-time codes, scraping, scalping, and bots inflating votes or metrics.

Any site with forms worth attacking: startups and SaaS products, online shops, fintech and payment services, and agencies running many client sites from one account.

Pick a plan on the pricing page and start a 14-day free trial. Every plan includes one.

Three engines score every request from more than 300 signals: fingerprints (TLS, browser and device), behavior (mouse, touch, typing rhythm and request speed) and reputation (IP, VPN, proxy and datacenter data with machine-learning scoring). The score decides whether to pass silently, ask for a check, or block.

Puzzle images carry noise that trips up vision models, image links are single-use and expire quickly, and every result is checked twice: once in the browser and once by your server.

None at all for most visits. When a check is needed it is a one-click checkbox, a puzzle slider, an image grid or a short text question. On Crew and Company you can style them with your own colors and images.

No. Scoring happens in real time in the background, and the script loads asynchronously, so real people do not wait for it.

In the Netherlands, under EU data protection law. Katcha uses no cookies and builds no cross-site profiles.

No. Katcha sets no cookies and stores nothing on the visitor’s device, so there is nothing to add to your cookie banner.

Yes. A GDPR data processing agreement is included on every plan. You can read it on the DPA page.

Every site has its own sensitivity setting, you can add trusted IPs and countries to an allow list, and analytics show what was flagged and why.

JavaScript, React, Vue and Angular in the browser; Node.js, Python, PHP, Go, Java, .NET, Ruby and Laravel on the server; a WordPress plugin; an Android SDK; and a REST verify API with JSON responses.

The script on your page returns a token when a visitor passes. Your server sends that token to the verify API and only accepts the form when Katcha confirms it. Each token works once.

Katcha scales automatically with your traffic, and your forms stay protected even if you go over your monthly requests.

Yes. Every plan from Crew up has IP and country allow lists. Company adds traffic rules, for example: more than 10 requests a minute from one country gets a check, more than 20 is blocked.

Yes. Katcha runs independently of whatever you already have, so you can test it on a single form before replacing anything.

Anytime. Upgrades apply immediately; downgrades apply at the next billing cycle.

Every plan starts with a 14-day free trial. You add a card when you sign up and nothing is charged until the trial ends.

No. Katcha Labs uses the Dutch small business scheme, so the price you see is the price you pay.

Protection never stops. Extra requests are added to your next invoice at your plan rate, and we email you at 80% and 100% of your limit.