Cap is a self-hosted tool that checks whether a visitor is a real person without showing puzzles or tracking them. It is for website owners who want to keep bots and AI crawlers off their sites.
Has 2 of 6 · Protects a whole site, no code changes ✗
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does the whole job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
Anubis is a tool that sits in front of a website and blocks automated bots and AI scrapers that flood it with requests. It is meant for website operators, especially small sites, who cannot or will not use Cloudflare for protection.
Has 1 of 6
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
mCaptcha is a free system that checks whether a visitor is a person or a bot, without the image puzzles people usually have to solve. It is for website owners who want to keep bots and automated crawlers off their sites.
Has 1 of 6
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Nobody has changed its code in over a year. It may still work well, but help is less likely.
Does the whole job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
A free code library and command-line tool that creates and checks small computing puzzles, which help tell real visitors apart from bots on a website. It is for programmers who build website protection.
Has 0 of 6 · Protects a whole site, no code changes ✗ +1
How many people bookmarked its code on GitHub. It shows how popular it is, not how good it is or how well it replaces the app.
How hard it is to start using it. Easy: install it like a normal app, or use it in your browser. Advanced: you run it on your own server, use the command line, or it is a tool for developers.
Its code changed within the last year, so someone is still looking after it.
Does part of the job.
Ordered by how fully it replaces the app, Verified, setup and, when there are enough, people's votes.
None of these match. Try another device.
Help me choose
I want to pick an open-source replacement for Cloudflare Turnstile. Below is a list from Open Source Everything (CC BY-SA 4.0), in the order its website shows it. The order is a starting point, not a verdict.
- Cap: Cap is a self-hosted tool that checks whether a visitor is a real person without showing puzzles or tracking them. It is for website owners who want to keep bots and AI crawlers off their sites. [Advanced setup; runs on a server you set up; replaces fully; Apache-2.0; https://github.com/tiagozip/cap]
- Anubis: Anubis is a tool that sits in front of a website and blocks automated bots and AI scrapers that flood it with requests. It is meant for website operators, especially small sites, who cannot or will not use Cloudflare for protection. [Advanced setup; Windows · Linux; replaces partly; MIT; https://github.com/TecharoHQ/anubis]
- mCaptcha: mCaptcha is a free system that checks whether a visitor is a person or a bot, without the image puzzles people usually have to solve. It is for website owners who want to keep bots and automated crawlers off their sites. [Advanced setup; runs on a server you set up; replaces fully; AGPL-3.0; no changes in over a year; https://github.com/mCaptcha/mCaptcha]
- ALTCHA: A free code library and command-line tool that creates and checks small computing puzzles, which help tell real visitors apart from bots on a website. It is for programmers who build website protection. [Advanced setup; Windows · Mac · Linux; replaces partly; MIT; https://github.com/altcha-org/altcha-lib-cpp]
Setup rating: "Easy setup" means you can install it like a normal app, use it in a browser. "Advanced setup" means you must run it on your own server or use the command line, or it is a tool for developers.
Full details: https://opensourceeverything.org/data/groups/captcha.json
Before recommending anything, ask me these three questions (one at a time, in plain words): 1) Which device or devices will I use it on (Windows, Mac, Linux, Android, iPhone)? 2) How comfortable am I with technical setup: only installing apps from a store, happy to follow a step-by-step guide, or comfortable with servers and the command line? 3) What is my budget: free only, or willing to pay for hosting or support? Then recommend one to three projects from this list only, and for each say why, using how fully it replaces the app, its setup rating, and the devices it runs on. If nothing on the list fits me, say so plainly instead of stretching.
Before you build
Read the list of open-source projects at https://opensourceeverything.org/data/groups/captcha.json. Compare it with my project or idea below. Tell me which projects overlap, what I could reuse instead of rewriting, and what mine does that none of them do.
My project or idea: