Every feature, built for one job.

Katcha tells humans from bots on every form you run. Here is everything that goes into it.

What it stops

The automated attacks Katcha is built to catch.

Every request is scored in real time from more than 300 signals, without slowing real people down.

Fingerprint engine: TCP, TLS and HTTP fingerprints, browser and device fingerprints, Canvas and WebGL rendering, screen and plugin checks, and forged headers. Hard to fool by switching IPs.
Behavior engine: Mouse paths, speed and how natural the curves look, touch and drag timing, typing rhythm, time on page, and sudden spikes in request volume.
Reputation engine: Known bad IPs, networks (ASN), datacenters, VPNs and proxies, plus each fingerprint’s past results, scored with machine learning that learns from every attack.
One risk score: The three engines combine into a single score from 0 to 100 for every request.

The score decides what happens next, so only risky visits ever see a check.

Silent pass: Low-risk visitors go straight through and never see Katcha.
One-click checkbox: A single click for visits that need a little more proof.
Puzzle slider: Drag one piece into place. Quick on desktop and easy on a phone.
Image grid: Pick the matching images, for the riskiest traffic.
Text question: A short question a person answers at a glance and a script cannot guess.
Block: Requests Katcha is certain about never reach your form.

Bots that try to solve or replay a check get nowhere.

AI-resistant images: Noise in every puzzle image confuses the vision models bots use to solve them.
Single-use links: Image links and tokens expire quickly and work only once, so recorded answers cannot be replayed.
Two-step verification: Every result is checked in the browser and again by your server before the form is accepted.
Hidden parameters: Encrypted, changing request data and our own script obfuscation make the check hard to reverse-engineer.

Tune Katcha to your traffic instead of the other way round.

Sensitivity per site Included in Crew and Company: Decide how strict each site should be.
IP and country allow lists Included in Crew and Company: Trusted offices, partners and regions always pass.
Traffic rules Company plan only: For example: more than 10 requests a minute from one country gets a check, more than 20 is blocked.

The check can look like part of your site.

Your colors Included in Crew and Company: Match colors and corner style to your design.
Your own images Crew: up to 15 · Company: unlimited: Upload your own puzzle images, from product shots to seasonal campaigns.
White label Custom plan: Remove the Katcha name and use your own theme throughout the check.

See what Katcha caught and why.

Analytics dashboard Included in Crew and Company: Requests, solve rates, response times and attack types over time, plus the top reasons requests were blocked.
Attack alerts Included in Crew and Company: Hear about an attack while it is happening.
Usage emails: A heads-up at 80% and 100% of your monthly requests.
Log export and webhooks Company plan only: Send verification events to your own tools in real time.
SIEM and SOC feed Custom plan: Stream human, suspicious and bot events over Syslog into your SIEM and threat-intelligence tools.

One script tag on the page and one call on your server.

Front end: Plain JavaScript, React, Vue and Angular.
Back end: Node.js, Python, PHP, Go, Java, .NET, Ruby and Laravel.
Platforms: A WordPress plugin and an Android SDK.
Verify API: A REST endpoint with JSON responses your server calls before accepting a form.

Protection that respects your visitors and stays up when traffic spikes.

Processed in the EU: All data is handled in the Netherlands under EU law.
No cookies: Nothing is stored on the visitor’s device and nothing goes in a cookie banner.
Data processing agreement: Included on every plan.
Scales with your traffic: Capacity grows automatically during traffic surges.
Uptime SLA Company plan only: A written availability commitment.
On-premises option Custom plan: Run Katcha in your own data centre on Kubernetes or Docker with failover, when data must never leave your network.
Dedicated support Company plan only: A named specialist for your account.