Security · new
Hold.
No pictures.
Netslim Captcha keeps bots out of your forms without making your visitors click on traffic lights, bicycles or zebra crossings. Just hold the button down for a moment, done. No Google, no cookies.
Try it now:
Why it's different
Picture puzzles no longer stop bots.
Modern AI recognises traffic lights and bicycles faster than a human, and for a few euros, solving services crack thousands of them. What's left is a puzzle that mostly annoys real visitors. We turn it around: the check costs a human one second, and a bot that wants to send forms in bulk has to spend computing time every single time.
Traditional captcha
- Searching for pictures, sometimes three rounds
- AI and solving services crack it for pennies
- Loads scripts and cookies from Google
- Hard to use on mobile and for people with poor eyesight
- Token often reusable until it expires
Netslim Captcha
- One button, hold for just over a second
- Detects scripts by movement and browser
- No cookies, no tracking, hosted in the EU
- Works with mouse, finger and space bar
- Each token can be used once, valid for 2 minutes
Under the hood
Six layers in one second
- Signed challengeThe browser gets a random challenge from our server, signed and tied to your site. It can't be forged or reused.
- Computing while you holdWhile you hold the button, your browser works out a proof-of-work. One visitor won't notice it, but spamming a thousand times costs a thousand times the computing time.
- Real inputWe check whether the button was really pressed, for how long, and with a mouse, finger or key. Fake clicks from JavaScript don't count.
- How you movePeople move in an arc, speeding up and slowing down. A script moves in a straight line, at exactly equal intervals, and clicks right in the middle.
- Real browserHeadless browsers, fake Chrome and the traces of Selenium, Puppeteer and Playwright stand out. Only when signals add up does a heavier challenge follow.
- One-time tokenYour server checks the token with a single request. After that it's used up: copying, storing or reusing it no longer works.
To be honest, no captcha stops every bot. A determined attacker with a lot of computing power will get through in the end, just like with any other captcha. The difference is that here it costs money and time per attempt, and your visitors don't notice a thing. For the best protection, combine it with Edge Shield.
Prices
Free for most sites
Free
€ 0 per month
- 10,000 checks per month per sitekey
- Up to 10 sitekeys per account
- All security layers
- Statistics in your portal
- Your own color for € 1 per month, free if you're a customer with a service
Pro
€ 9.00 per month excl. VAT
- 250,000 checks per month
- No Netslim mention in the widget
- Your own color, light or dark
- Priority support
- Help with setup
Test it yourself
Let a bot try it.
On the left, you hold the button. On the right, a script does exactly the same, with fake clicks. See what happens.
// wacht op start
Also in Netslim Edge. When a site behind our edge is attacked, visitors get the same technique: an invisible computing task, and the hold button if someone keeps pushing. See what it looks like
A fair comparison
How it compares to the well-known captchas
| Netslim Captcha | reCAPTCHA v2 | reCAPTCHA v3 | hCaptcha | Turnstile | |
|---|---|---|---|---|---|
| What the visitor does | Hold the button for just over a second | Checkbox, often images | Nothing | Checkbox, often images | Usually nothing |
| Computing work per attempt (proof-of-work) | Yes, heavier with many attempts | No | No | No | Partly |
| Token can be used once | Yes, valid for 2 minutes | Yes | Yes | Yes | Yes |
| Cookies or tracking | None | Google cookies | Google cookies | Own | No ad tracking |
| Details | EU, hashed IPs | Intuition Machines | Cloudflare | ||
| Movement analysis | Yes, on your own site, without a profile of the visitor | Yes, with Google data | Yes, with Google data | Yes | Yes |
| Recognises automation tools | Yes | Yes | Yes | Yes | Yes |
| Without a mouse (keyboard) | Yes, hold the space bar | Yes | Yes | Yes | Yes |
An invisible captcha such as reCAPTCHA v3 is the easiest for visitors, but it relies on what Google knows about you. We deliberately choose one short, visible action plus computation: no profile of your visitor needed, and bulk spam becomes expensive. No captcha stops every bot, ours included.
WordPress plugin, free
Install, click connect, done.
The plugin protects login, registration, lost password, comments, WooCommerce and the well-known form plugins right away: Contact Form 7, WPForms, Fluent Forms, Gravity Forms and Elementor. Connecting takes one click via your Netslim account: you give permission and the keys are added to your site automatically. Updates run automatically.
- Upload. Plugins › Add new plugin › Upload plugin.
- Connect. Settings › Netslim Captcha › Connect with Netslim.
- Allow. You see your domain, click Allow and you are back in WordPress.
- Done. Turn off reCAPTCHA in your form plugin. Netslim takes over.
Works on your platform
One captcha for every platform.
Choose your platform. The same captcha everywhere, the same free keys from your Netslim account.
and WooCommerce
Free plugin. Protects login, registration, forgotten password, comments, WooCommerce and Contact Form 7, WPForms, Fluent Forms, Gravity Forms and Elementor. Connect with one click, updates run automatically.
- Upload. Plugins › Add new plugin › Upload plugin.
- Connect. Settings › Netslim Captcha › Connect with Netslim.
- Done. Turn off reCAPTCHA in your form plugin.
Magento 2 (Adobe Commerce)
Free module for login, account creation, forgotten password and the contact form. The token is checked on your server before Magento processes the form. If netslim.nl is briefly unavailable, it simply lets customers through.
- Unpack in the Magento root folder (folder
app/code/Netslim/Captcha). - Turn on:
bin/magento module:enable Netslim_Captcha && bin/magento setup:upgrade, thensetup:di:compileandcache:flush. - Enter the keys: Stores › Configuration › Netslim › Netslim Captcha.
Shopify processes forms on its own servers, so nobody can check a captcha afterwards, including us. Our captcha blocks submitting until a person holds the button. This stops spam through your contact and registration form. It does not stop bots that post directly to Shopify, so leave Shopify's spam filter on.
- Create a site key with both your own domain and your
.myshopify.comaddress. - Script: Webshop › Themes › Edit code ›
layout/theme.liquid, just before</head>:<script src="https://netslim.nl/captcha.js" defer></script>
- Widget: in your contact form (usually
sections/main-contact-form.liquid) and registration (main-register.liquid), within{% form %}just above the submit button:<div class="netslim-captcha" data-sitekey="nsk_…"></div>
PrestaShop
Put the script and the widget in your theme (e.g. customer/_partials/customer-form.tpl and contact-form.tpl) and check the token in a small override of the form, with your secret key. Prefer not to do it yourself? We build it in for you.
- Script in
head.tpl:<script src="https://netslim.nl/captcha.js" defer></script>
- Widget above the submit button of each form.
- Check on the server with the PHP code below, before saving.
, Joomla, Drupal, Laravel and custom sites
Anywhere you can edit HTML and a bit of server code: script and widget in the form, and verify the token on your server. Two lines of HTML and a few lines of code.
- Script and widget in your form:
<script src="https://netslim.nl/captcha.js" defer></script> <div class="netslim-captcha" data-sitekey="nsk_…"></div>
- Check: the form sends
netslim-captcha-tokenalong. Send it with your secret key tohttps://netslim.nl/api/captcha/siteverify. - Done. Is the answer
success: false, reject the form.
6
Place the widget in the Twig blocks of your forms (e.g. component_account_register and the contact form) and check the token in a small subscriber on FormValidationevents. We are happy to build it in for you.
- Script in
base.html.twig(blocklayout_head_javascript_trackingor your own head block). - Widget above the submit button.
- Check on the server, as in the PHP code below.
Embed
Two lines in your form.
Works on any site and in any language: Magento, Laravel, Node, Python, or plain HTML. For WordPress there is the free plugin. The form sends the field netslim-captcha-token along, and your server checks it with your secret key.
<form method="post" action="/contact"> <!-- je velden --> <script src="https://netslim.nl/captcha.js" defer></script> <div class="netslim-captcha" data-sitekey="nsk_…"></div> <button>Versturen</button> </form>
$r = file_get_contents("https://netslim.nl/api/captcha/siteverify", false, stream_context_create(["http" => [
"method" => "POST",
"header" => "Content-Type: application/x-www-form-urlencoded",
"content" => http_build_query(["secret" => "nss_…", "token" => $_POST["netslim-captcha-token"], "remoteip" => $_SERVER["REMOTE_ADDR"]]),
]]));
if (!json_decode($r)->success) { http_response_code(403); exit; }
const r = await fetch("https://netslim.nl/api/captcha/siteverify", {
method: "POST",
body: new URLSearchParams({ secret: process.env.NETSLIM_SECRET, token: req.body["netslim-captcha-token"], remoteip: req.ip }),
});
if (!(await r.json()).success) return res.status(403).end();
r = requests.post("https://netslim.nl/api/captcha/siteverify", data={
"secret": os.environ["NETSLIM_SECRET"],
"token": request.form["netslim-captcha-token"],
"remoteip": request.remote_addr,
}).json()
if not r["success"]:
abort(403)
curl -X POST https://netslim.nl/api/captcha/siteverify \
-d secret=nss_… -d token=… -d remoteip=203.0.113.7
{ "success": true, "score": 1 }Often chosen together
Attacks, bots and brute force stopped before they reach your server.
per site per month→Netslim SpeedPage cache, WebP and smaller videos. Your site faster in an afternoon.
per site per year→Netslim SEOSEO plugin for WordPress: check, AI meta and sitemaps for up to millions of products.
per site per year→
Certification
Your data is in ISO/IEC 27001 certified data centers.
Our servers run at Hetzner. Their data centers have been assessed by SOCOTEC Certification against ISO/IEC 27001, the international standard for information security: access, power, cooling, fire protection and management. On top of that, we take care of the security of your server and your site.
- DDoS protectionon by default
- Free SSLrenewed automatically
- Automatic updatesPlesk and WordPress
- GDPRdata processing agreement
