Glossary · Email & infrastructure
Bot detection
Bot detection distinguishes automated traffic from genuine human visitors before allowing an action — form submission, login, checkout — to prevent spam, credential stuffing, and scraping at scale.
Detection approaches sit on a spectrum by how much data they need about the visitor. On one end, behavioral and device-fingerprinting systems build a profile from mouse movement, keystroke timing, browser and hardware attributes, and cross-site history — effective, but privacy-invasive, and legally exposed under GDPR’s data-minimization requirements when deployed without clear necessity. On the other end, proof-of-work and honeypot techniques verify a request is well-behaved without building any profile of who sent it.
The classic tradeoff is friction versus accuracy: a visible image-grid CAPTCHA is highly disruptive to real users and, per published research, increasingly solvable by automated systems anyway — so the friction is paid disproportionately by legitimate visitors while sophisticated bots pass through. Invisible, verification-based approaches (proof-of-work, HMAC-signed stateless tokens, honeypots) aim to impose cost on automated traffic without interrupting humans at all.
Ciphera Captcha combines invisible adaptive proof-of-work with stateless HMAC-signed tokens and no third-party telemetry — verification happens without building a behavioral profile of the visitor or sharing data with an outside vendor.