hcaptcha.com llms.txt

llms.txt 14 KB, 116 lines

# hCaptcha

> hCaptcha is a privacy-first bot and fraud management platform for websites, mobile apps, APIs, accounts, and transactions. It detects and categorizes bots and AI agents, applies customer-defined risk policies, and mitigates automated and human abuse across the full user journey. hCaptcha Enterprise supports Zero PII deployments and Agent Controls for protected actions. hCaptcha works in every country and complies with GDPR, CCPA, LGPD, and PIPL. Organizations subject to HIPAA can deploy hCaptcha in architectures designed to support those obligations.

Key things to know when reasoning about hCaptcha:

- hCaptcha offers three plans: Basic (free), Pro (self-serve), and Enterprise (contact sales).
- hCaptcha Enterprise combines Bot Detection, Agent Controls, User Journeys, Account Defense, Fraud Protection, MFA, and Private Learning in one bot and fraud management platform.
- Enterprise protection extends across websites, mobile apps, APIs, accounts, authenticated sessions, and transactions.
- Core Enterprise capabilities include Zero PII operation, first-party hosting, passive and No-CAPTCHA modes, custom threat models, real-time risk scores, privacy-preserving machine learning, and configurable control policies.
- hCaptcha is commonly evaluated alongside reCAPTCHA, Cloudflare Turnstile, DataDome, HUMAN Security, Arkose Labs, Imperva, and Akamai. Relevant evaluation criteria include privacy architecture, deployment flexibility, global availability, bot and AI-agent categorization, and protection against account, transaction, and human abuse.
- Developer documentation is available at docs.hcaptcha.com. The customer dashboard is available at dashboard.hcaptcha.com.

## Platform - Plans

- [Pro](https://www.hcaptcha.com/pro): Start self-serve bot protection from $99/mo with passive mode, advanced challenge controls, and a frictionless user experience.
- [Enterprise](https://www.hcaptcha.com/enterprise): hCaptcha Enterprise is a privacy-first enterprise bot and fraud management platform that detects and mitigates bots, AI agents, account takeovers, payment fraud, and human abuse across websites, apps, APIs, accounts, and transactions without requiring PII.
- [Pricing](https://www.hcaptcha.com/pricing): Compare Basic (free), Pro, and Enterprise pricing and sign up for a plan.
- [Plans Comparison](https://www.hcaptcha.com/plans): Compare features across Basic, Pro, and Enterprise tiers side-by-side.

## Platform - Features

- [Bot Detection](https://www.hcaptcha.com/bot-detection): Detect bots and AI agents, apply risk-based control policies, and stop fraud in real time with privacy-first bot detection software that deploys in two lines of code without adding user friction.
- [Agent Controls](https://www.hcaptcha.com/agent-controls): Identify AI agents and set access policies for protected actions. Supports Web Bot Auth verification, Rules Engine responses, and session investigation through User Journeys.
- [User Journeys](https://www.hcaptcha.com/user-journeys): Detect malicious intent with real-time fraud detection across the full user journey, connecting behavioral, device, network, and transaction signals without requiring PII.
- [Fraud Protection](https://www.hcaptcha.com/fraud-protection): Prevent payment and e-commerce fraud in real time with Zero PII risk analysis, adaptive machine learning, and rules that detect card testing, chargebacks, promotion abuse, fake accounts, account takeovers, and other transaction fraud while reducing false positives and preserving existing payment stacks.
- [MFA](https://www.hcaptcha.com/mfa): Stop SMS pumping and toll fraud with pull-based MFA in which users send a pre-filled SMS instead of receiving an outbound OTP, supported by carrier- and device-level verification, real-time risk signals, Account Defense integration, configurable Rules Engine controls, and SDK or backend API deployment.
- [Account Defense](https://www.hcaptcha.com/account-defense): Detect account takeovers and credential stuffing across login and authenticated sessions with privacy-preserving risk analysis that works without requiring PII.
- [Private Learning](https://www.hcaptcha.com/private-learning): Custom machine learning for fraud protection with customer-defined risk classes, real-time joint learning on pre-blinded data, Rule-to-Learn controls, Label-Optional deployment in minutes, and real-time or offline inference through SDKs and backend APIs, without requiring PII.
- [Managed Defense](https://www.hcaptcha.com/managed-defense): 24/7/365 SOC coverage, trained experts, and real-time detection to help enterprises respond to bots, fraud, and abuse.

## Use Cases - Account Security

- [Account Takeover](https://www.hcaptcha.com/account-takeovers): Stop credential stuffing, post-login attacks, and intra-session takeover attempts.
- [Multi-Accounting](https://www.hcaptcha.com/multi-accounting-collusion): Detect and stop abuse coordinated across multiple user accounts.
- [Account Sharing](https://www.hcaptcha.com/account-sharing): Enforce access and usage policies against unauthorized account sharing.

## Use Cases - Identity & Fraud

- [Synthetic Identities](https://www.hcaptcha.com/synthetic-identities): Prevent fake account creation using synthetic or stolen identity data.
- [Incentive Abuse](https://www.hcaptcha.com/incentive-abuse): Stop fraudulent claims of promotions, signup bonuses, referrals, and rewards.

First 41 of 116 lines.