Harisecurity at work

Contact form, checkbox

One tick is enough: the proof of work runs in the background and your server gets a verdict.

The HTML used

Sign-in, invisible mode

Nothing to tick: the check runs when the person presses "Sign in".

The HTML used

Sign-up, auto mode

The check starts on its own while the person fills in the form.

The HTML used

Floating badge

A small badge in the corner of the screen, nothing in your form's layout.

The HTML used

Accessibility

Always another way for a human: screen reader, keyboard only, or no wish to wait.

The possible types

• Question: a simple question about a sentence.
• Math: an operation written in words.
• Audio: digits read aloud, generated on the server.
• Drag order: four items, arrows and space.
• Icon grid: drawn shapes, each one named.
• E-mail link: available on your site; turned off in the demo so it never sends e-mails.

What a bot gets

A scripted request without real browser signals is refused or challenged, even with a solved proof of work.

The button does what a script would: it asks for a challenge, tries the proof of work, then sends the result with no widget signal at all. It uses a separate site, so it does not count against you in the other tabs.

The same with curl

Expected answer

{"status":"failed"}

Languages and themes

One widget, tuned live: language, light or dark, accent colour and corner radius.

The HTML used

Without JavaScript

Without JavaScript no token is issued: your server decides, Harisecurity never decides for it.

What happens

• The widget does not render; the form is sent without the xcap-token field.
• If your server calls siteverify anyway, it gets success: false with missing-input-response.

What you should do

• Add a <noscript> message to the form.
• On the server, refuse with a clear message, or send the submission to a path of your own (moderation, another contact channel).

The message to add to the form

To see it, turn JavaScript off and reload this page: the message at the top of the page shows.

Read the full documentation page

Integration

Two pieces of code: the widget in the page, and a siteverify call on your server.

In the page

On your server

The secret key stays on your server, never in the page.

Java

Node.js

PHP