Bot detection APIs compared: CAPTCHAs, bot managers and risk APIs

A bot detection API tells your server whether a visit came from a person or a script. There are three kinds: a challenge widget your server verifies (Cloudflare Turnstile, Google reCAPTCHA, hCaptcha, Friendly Captcha), a bot manager in front of every request (Cloudflare Bot Management, AWS WAF Bot Control, DataDome, HUMAN, Kasada), and a risk API your server calls at signup, login or checkout (Arkose Labs, Castle, IPQS, Maskbreak). Turnstile is free with unlimited challenges, reCAPTCHA and hCaptcha are free up to 10,000 a month, and the bot managers sold on AWS Marketplace by their makers start at $45,960 a year. I read every fact below on the vendor’s own pages and listings on 26 October 2026, and every row links to them.

Maskbreak publishes this page and is one of the thirteen, so read it as a vendor’s comparison: every other row says where that tool beats Maskbreak, and Maskbreak’s own row says what it does not do. Akamai Bot Manager is not in the tables: akamai.com answered my reader with HTTP 403 and its documentation needs a login, so I could not read its facts myself. For the wider field, see fraud prevention APIs compared; for signups in particular, fake account prevention software compared.

Bot detection APIs compared: what the visitor sees and what your server gets

“Not published” means I found no price on the vendor’s pages, not that the vendor has none. Neither table rates detection: no vendor here, Maskbreak included, publishes an independent benchmark I could cite, so test on your own traffic. datadome.co answered my reader with HTTP 403 on 26 October 2026, as a bot-protection vendor’s own site may, so DataDome’s rows come from its documentation and the AWS Marketplace listing it sells through; IPQS’s plans page did not draw its table, so its figures are the plan data in the page’s source.

Three kinds of bot detection API

They answer different questions, in different places:

• A challenge your server verifies. A widget on the form proves to your server that a browser passed a test: Cloudflare Turnstile, Google reCAPTCHA, hCaptcha and Friendly Captcha. The widget alone protects nothing; in Cloudflare’s words, “The client-side widget alone does not protect your forms.” Your server sends the token to the vendor’s verify endpoint and refuses the form when it fails or is missing.
• A bot manager in front of every request. It sits at the edge or in your web server and scores each request before your application sees it: Cloudflare Bot Management, AWS WAF Bot Control, DataDome, HUMAN and Kasada. It covers pages, APIs and logins alike, and is priced by request volume.
• A risk API your server calls. A script on your page collects evidence, and your server asks the API about it at the moment that matters, such as a signup, a login or a checkout: Arkose Labs, Castle, IPQS and Maskbreak. Each answers with a score or a decision your code acts on, and none of them sees the requests your server does not ask about.

They combine. A bot manager keeps scrapers and floods off the whole site, a risk API decides about the one request that opens an account or moves money, and a challenge is a step your app can show when that answer is uncertain.

Do you need a CAPTCHA to detect bots?

Not to detect them. Most of the tools here can answer without showing anything: Turnstile in invisible mode, reCAPTCHA with score keys and Arkose Labs in transparent mode, while Kasada, Castle and Maskbreak never show a challenge themselves. A challenge is a second step for the uncertain cases, and it has costs:

• Real people fail it or leave. A puzzle on every signup costs signups; a challenge only on review keeps it away from most real visitors.
• Bots can pay for it. CAPTCHA farms solve challenges for scripts, as the guide to CAPTCHA farms shows, so a passed challenge proves less than it seems.
• Some free tiers always challenge. hCaptcha’s free tier runs in an “Always Challenge” mode and its passive mode starts at Pro, and Friendly Captcha’s widget asks for a click by default.
• Invisible modes carry terms. Cloudflare asks sites that use Turnstile’s invisible mode to reference its privacy addendum in their own privacy policy (widget modes).

For stopping bots without any puzzle, see bot detection without CAPTCHAs.

What a bot detection API can and cannot see

• Headless and scripted browsers. Puppeteer, Playwright and Selenium leave traces that most of these look for: Castle lists headless_browser among its signals, AWS WAF Bot Control labels signal:automated_browser, Cloudflare’s Super Bot Fight Mode on Pro targets “simple bots and headless browsers”, and Maskbreak returns automation_detected. Stealth plugins hide the common traces, so test with them; the guides to headless browser detection and detecting Puppeteer and Playwright show what they change.
• Fake browsers worked by hand. A person running many accounts in a fake browser is not a script, so a bot score can call the visit human. Castle reports spoofed and emulated devices, and Maskbreak names a fake browser with its own reason, antidetect_browser; see detecting fake browsers.
• Residential proxies. Scripts rent home and mobile connections so that each request comes from a different ordinary address. Arkose Labs, Castle and IPQS return proxy flags, and Maskbreak flags the proxy exits it recognises; one it does not recognise looks like a home connection, which is why the browser evidence matters (proxy detection APIs compared).
• Requests that never load your page. A script can post straight to your endpoint and skip the widget or the browser script. A challenge widget then has no token, and Turnstile’s tokens are single-use and “valid for 300 seconds”, so a missing or reused token fails verification. A bot manager in front of the endpoint still sees the request. A risk API knows only what your server sends: Maskbreak answers a check without the browser token with allow and degraded: true, so hold those rather than read them as clean.
• Bots you want. Search engines and some AI agents are bots you may want in. Cloudflare Bot Management marks verified bots with a verified_bot field (fields) and AWS WAF with a bot:verified label. Maskbreak keeps no list of verified bots, so a crawler or agent its device check catches is blocked by default; the Rules tab can send automation to review instead (should you block AI agents?).

How Maskbreak answers a bot

Your page loads Maskbreak’s browser script, and your server sends what it collects to POST /v1/evaluate when the form arrives. There is no challenge: the answer is allow, review or block, a risk_score from 0 to 100 and named reasons. The documented sample for a script driving a fake browser, GET /v1/evaluate/sample?scenario=bot, is computed by the code that answers customers:

The network looks like a home connection; the device check is what catches it. Other visits, computed the same way:

A script driving a browser blocks on its own, wherever it connects from; a cloud server or a virtual machine alone does not, because real people browse from both. The reason codes are listed on /api, and the Rules tab can change the action for most of them. Framework guides show where the call goes: Next.js and Cloudflare Workers.

What Maskbreak does not do, so you can weigh it against the others:

• No challenge: a visit it finds nothing against gets allow, and if you want a puzzle or an emailed code on review, your app shows it.
• It checks the visits your server asks about, such as a signup, a login or a checkout, not every request to your site: it is not a bot manager in front of your pages.
• It names the kind of tool, not the framework: automation_detected says a script drove the browser, not whether it was Puppeteer, Playwright or Selenium.
• No list of verified crawlers or signed AI agents: a script the device check catches is blocked by default, whoever runs it.
• Browser visits only: there is no iOS or Android SDK. A check sent without the browser token is answered allow with degraded: true, and a bare IP lookup, GET /v1/lookup, checks only Tor exits and published cloud ranges.

How to test a bot detection API before you buy

Run the same visits through every candidate on a staging copy of your form, and keep the raw answers:

• Same visit, every tool: proxy exits rotate, so send each case to every candidate within a minute.
• Count false positives on real people: run the check in log-only mode on your real traffic for a week and read what it would have blocked or challenged, as in rolling out fraud detection.
• Count the cost of a challenge: if a tool shows one, count how many real people finish it, on a phone as well as a desktop.

Notes on each bot detection API

Cloudflare Turnstile

Free, with unlimited challenges and up to 20 widgets, and it “can be used independently without requiring other Cloudflare services” (plans). Managed mode “automatically chooses between non-interactive or checkbox challenge”. Siteverify returns no score, and tokens are single-use and “valid for 300 seconds” (server-side validation). See Turnstile alternatives.

Google reCAPTCHA

Google now calls reCAPTCHA its “visual bot defense technology” (product page). The free 10,000 assessments a calendar month are counted per organisation, across all its sites (tiers), and past them Essentials requests return a “Resource Exhausted (429)” error (billing). Without a billing account the score has four levels, 0.1, 0.3, 0.7 and 0.9, and no reason codes (interpreting an assessment); with checkbox keys the visitor “might” have to solve a challenge (checkbox keys). See reCAPTCHA alternatives.

hCaptcha

The free tier’s 10,000 requests a month count across every account an organisation uses (plans, terms), and it runs in an “Always Challenge” mode; the passive, no-CAPTCHA mode starts at Pro (FAQ), which has a 14-day trial with no payment (pricing). A score is an Enterprise feature (documentation), and the terms count bot scores as confidential information. See hCaptcha alternatives.

Friendly Captcha

A click by default (“interactive”) or none in non-interactive mode (widget modes), and “No image labeling tasks for users” (plans). The free plan is for non-commercial projects (free plan). Risk Intelligence, with network and browser scores from 1 to 5 and the automation tools it recognises, is a paid add-on on Advanced and Enterprise; without it, siteverify returns risk_intelligence as null (siteverify). See Friendly Captcha alternatives.

Cloudflare Bot Management

“Bot Management for Enterprise is a paid add-on” (Bot Management), sold through “Contact sales” (product page). Its score, “from 1 to 99” (bot score), lives in Cloudflare’s rules and Workers; your origin gets it only if you forward it (plan features). On the Free plan, Bot Fight Mode issues “a computationally expensive challenge” (Free plan) that “cannot be customized” and “may challenge API or mobile app traffic” (Bot Fight Mode); Super Bot Fight Mode on Pro targets “simple bots and headless browsers” (Pro plan). Pro is $20 a month billed yearly and Business $200 (plans).

AWS WAF Bot Control

The common level labels known bots and blocks the ones it cannot verify; the targeted level adds rate limits, CAPTCHA and background browser challenges (rule group), and most of it needs the tokens AWS’s application integration SDKs create (tokens). Beyond the free requests it costs $1 or $10 per million, $10 a month per web ACL and $4 per 10,000 CAPTCHA attempts at the common level, on top of AWS WAF’s own $5 a month per web ACL, $1 per rule and $0.60 per million requests (pricing). Your backend sees a label only if you forward it as a header.

DataDome

A module on your CDN, web server or framework, a Cloudflare Worker, CloudFront, Fastly, Nginx and Node.js among them, beside a JavaScript tag that “displays challenges, collects signals” (integrations). Each request gets “allow or challenge”, and when DataDome’s answer header is missing the request passes (request validation). Visitors usually see nothing, sometimes a device check page (device check) or a slider CAPTCHA (CAPTCHA). Its AWS Marketplace listing also says “Long term contract cancellations or downgrades are not supported.” See DataDome alternatives.

HUMAN

An Enforcer on your CDN, load balancer or origin acts on the sensor’s score from 0 to 100, blocking from a score you set, 100 by default (Enforcer); its challenge is a “press and hold” button (HUMAN Challenge). Its own plans page notes “Revenue Minimums Required”, and its AWS Marketplace listing, sold by HUMAN, leaves mobile, API and services out of its Bot Defender price (AWS Marketplace). See HUMAN alternatives.

Kasada

Three server-side integrations, at the edge, as a proxy or in your backend; its sample calls kasada.classify(request) and returns the block response it hands back. It promises “No CAPTCHAs: Challenges are entirely invisible to the user”, and its documentation needs a login, so what the classification contains is not public.

Arkose Labs

Its script runs detection only or adds Arkose’s own challenge (setup); the Verify API answers with a risk band, a category such as BOT-STD or BOT-ADV, IP flags for VPNs, proxies and Tor, and a device ID, depending on what you have enabled. Its pages offer a demo instead of a price (Bot Manager), and its AWS Marketplace listing adds sessions at $1,000 per million. See Maskbreak vs Arkose Labs.

Castle

Castle.js makes a request token in the browser (browser SDK) for the Filter API, for anonymous requests, or the Risk API, for signed-in users. Scores run “between 0.0 and 1.0” (risk scoring), and the signals include headless_browser, spoofed_device and residential_proxy_access (signals). Castle shows nothing itself: “Do you need a CAPTCHA with Castle? In most cases, no.” (CAPTCHA guide). The Free plan’s budget is for evaluation, with no overages. See Maskbreak vs Castle.

IPQS

Its IP lookup answers bot_status, whether bots have recently used the address (IP API fields), and its device script has a bot_status of its own, listed as a premium feature. The free plan has “1,000 Free Lookups per Month!” (bot detection). On 26 October 2026 the plans page did not draw its table; the prices are the plan data in its source, which lists device fingerprinting in the Enterprise column. Its terms forbid extra accounts for extra free credits. See Maskbreak vs IPQS.

Which bot detection API should you choose?

• You want a free check on a form: Turnstile is free with unlimited challenges, reCAPTCHA Essentials and hCaptcha’s free tier cover 10,000 a month, and Friendly Captcha’s free plan is for non-commercial projects.
• Bots hit the whole site, APIs included: put a bot manager in front of every request: Cloudflare Bot Management on a Cloudflare Enterprise plan, AWS WAF Bot Control on AWS, or DataDome, HUMAN or Kasada.
• You want no challenge at all: Kasada, Castle and Maskbreak show nothing themselves, and Turnstile and reCAPTCHA have invisible modes.
• The abuse is at signup, login or checkout: a risk API decides about the one request that matters. Castle scores bots and account abuse, Arkose Labs adds its own challenge, and Maskbreak names the automation, fake browser or proxy behind each blocked visit (Maskbreak bot detection).
• You have only an IP address: IPQS answers for an address with no browser; Maskbreak’s bare lookup checks only Tor exits and published cloud ranges.

Maskbreak’s Free plan includes 10,000 visitor checks a month with no card, and paid plans start at €29 a month, including VAT (pricing). To see the answer for your own browser, open the live check on the homepage.