Guides

Your stack,
bot-proof in minutes.

Step-by-step integrations for invisible, CAPTCHA-free bot protection. Every guide uses the same engine: one API call, behavioral signals, zero PII.

Bot protection for Next.js in 5 minutes

Collect signals client-side, verify in a Server Action with one fetch, reject scripted POSTs.

Stop WordPress spam without CAPTCHA

The official plugin: comments, registration and Contact Form 7 protected with one API key.

Bot protection for Clerk sign-ups

The user.created webhook fires after the account exists. Here is the one place a Clerk signup can still be refused.

Bots never reach Auth0

Verify humans before the Universal Login redirect. Unverified sessions never learn the route.

Refuse the row before it is written

The before_user_created hook blocks a signup, and rejects with HTTP 200 rather than 400, which its own docs get wrong.

Auth.js / NextAuth

signIn can say no

Returning false blocks the sign-in. The callback never sees the request, and that decides where the check goes.

Firebase blocks, but carries nothing

beforeUserCreated stops a signup before the record is written, and receives no custom data from your page.

Just another validation rule

A ValidationRule in Fortify's CreateNewUser action, and the one 'required' that a bot exploits if you forget it.

The form says no, the view never finds out

A ValidationError in clean() blocks through form_invalid. Plain Django and the allauth variant.

The model refuses, Devise renders it

validate on: :create plus one permitted param. Includes the Devise 5 pin Rails 8.1 requires.

It was always going to be middleware

One (req, res, next) before the handler, and the Express 5 body-parsing detail that throws without it.

fail(403) from the form action

use:enhance stamps the signals at submit. Never put redirect() inside the try/catch.

One file in server/api

signup.post.ts with readValidatedBody and createError(403). server/ stays at the root in Nuxt 4.

Coming next: Shopify. Need one sooner? Tell us →