# Botpoison > Botpoison is spam protection for web forms: an invisible CAPTCHA alternative and a spam classifier API, made in the EU. ## Products - [CAPTCHA alternative and form spam filter](https://botpoison.com/): Botpoison stops form spam without CAPTCHAs. Challenge is an invisible proof of work with no cookies. Classify reads each message and flags spam. - [Challenge, the invisible CAPTCHA alternative](https://botpoison.com/challenge/): Stop form bots without puzzles. When a visitor presses Send, their browser runs an invisible proof-of-work check. No cookies, no widget, no image grids. - [Classify, the spam classifier API for forms](https://botpoison.com/classify/): Catch spam, whoever wrote it. Classify is a spam classifier API, a spam filter for forms: it reads each submission and returns spam or clean with a score. - [Pricing and plans](https://botpoison.com/pricing/): Botpoison plans and prices: start free with 1,000 challenges and 50 classifications a month, no credit card. Paid plans are never cut off. ## Docs - [Documentation](https://botpoison.com/documentation.md): Guides and reference for Botpoison: add Challenge to a form, verify solutions on your server, and classify messages as spam or clean with Classify. - [Get started with Challenge](https://botpoison.com/documentation/challenge/getting-started.md): Protect a form from bots: the script and public key on the form in HTML, JavaScript, React, Vue, Angular or Svelte, then one verify call on your server. - [Verify Challenge solutions with the REST API](https://botpoison.com/documentation/challenge/rest-api.md): The Botpoison /verify endpoint: send a form's solution and your secret key from any server, read the result, and handle errors and the test key. - [Challenge test mode](https://botpoison.com/documentation/challenge/test-mode.md): Test a Botpoison Challenge integration with the test key: force passing and failing results, and see what test calls skip, such as your plan usage. - [Get started with Classify](https://botpoison.com/documentation/classify/getting-started.md): Classify a form message in two steps: send it from your server in Node.js, PHP, Python, Go or plain HTTP, then read the label, spam or clean, and act on it. - [Classify REST API](https://botpoison.com/documentation/classify/rest-api.md): The Botpoison /classify endpoint: the request body, the label and score it returns, the status codes, and what to do when the service is down. - [Classify labels and scores](https://botpoison.com/documentation/classify/labels-and-scores.md): What the spam and clean labels mean, how to read a Classify score, and how to choose a threshold for a review queue that holds borderline messages. - [Classify models](https://botpoison.com/documentation/classify/models.md): The model behind a Classify verdict: spam-standard, its current release, how releases roll out, languages, and where the message is processed. - [Classify test mode](https://botpoison.com/documentation/classify/test-mode.md): Test a Botpoison Classify integration with the test key: force a spam verdict or an outage with a marker in the message, without counting usage. - [Workspaces and team members](https://botpoison.com/documentation/product/workspaces.md): Share Botpoison projects, keys and one plan with your team: invite members to a workspace, set their roles, and leave or delete a workspace. - [Projects](https://botpoison.com/documentation/platform/projects.md): A Botpoison project is one site or app with one public key and one secret key that every product accepts: how to create one, and where its activity lives. - [Keys](https://botpoison.com/documentation/platform/keys.md): A Botpoison project's two keys: where each goes, why the secret one is shown once and stays on your server, and how a reroll keeps the old key for 1 hour. - [IP address blocking](https://botpoison.com/documentation/product/ip-address-blocking.md): Refuse a project's Botpoison challenges to the IP addresses and CIDR ranges you choose, what a blocked visitor sees, and why single addresses beat ranges. - [Usage and limits](https://botpoison.com/documentation/platform/usage-and-limits.md): How each Botpoison plan counts challenges and classifications, what the test key leaves out, and what happens when a workspace goes over its plan. - [@botpoison/browser reference](https://botpoison.com/documentation/libraries/botpoison-browser.md): Reference for @botpoison/browser, which solves Botpoison challenges in the browser: the script tag, automatic mode and its events, challenge() and progress. - [@botpoison/node reference](https://botpoison.com/documentation/libraries/botpoison-node.md): Reference for @botpoison/node: verify Challenge solutions and classify messages from Node.js, with every option, the errors each call raises and the types. ## Learn - [Learn: form spam, CAPTCHAs and what stops them](https://botpoison.com/learn/): Plain explainers on contact form spam: proof-of-work and invisible CAPTCHAs, honeypot fields, spam typed by people, and reCAPTCHA under the GDPR. - [How to stop contact form spam](https://botpoison.com/learn/stop-contact-form-spam/): A layered guide to contact form spam: honeypot fields, rate limits, a bot challenge, a content classifier and a review queue, and what each one misses. - [Why spam gets past your CAPTCHA](https://botpoison.com/learn/human-spam/): SEO pitches and scams typed by real people pass every test for humans. Why a CAPTCHA cannot stop them, and how reading the message can. - [What is a proof-of-work CAPTCHA?](https://botpoison.com/learn/proof-of-work-captcha/): How a proof-of-work CAPTCHA makes the browser do a small computation instead of the visitor, what it costs each side, and what it does not stop. - [What is an invisible CAPTCHA?](https://botpoison.com/learn/invisible-captcha/): Risk scores, browser challenges and proof of work all call themselves invisible CAPTCHAs. How each works, and what invisible means for accessibility. - [Honeypot fields: how they work and where they fail](https://botpoison.com/learn/honeypot-fields/): How a honeypot field catches form bots, how to hide one from people, screen readers and password managers, and the bots that walk straight past it. - [reCAPTCHA and the GDPR: what EU regulators decided](https://botpoison.com/learn/recaptcha-gdpr/): The French CNIL fined a company in 2023 and an Austrian court ruled in 2024 that reCAPTCHA needed consent. What they decided, with sources. Not legal advice. ## Migration guides - [Migration guides: switch from reCAPTCHA, Akismet and more](https://botpoison.com/migrate.md): Step-by-step guides to moving a form off reCAPTCHA, Turnstile or hCaptcha onto Challenge, or off Akismet or OOPSpam onto Classify. Three edits each, with code. - [Migrate from reCAPTCHA to Botpoison Challenge](https://botpoison.com/migrate/from-recaptcha.md): Move a form off reCAPTCHA v2 or v3 onto Botpoison Challenge in three edits: the script, the key and the siteverify call. With the code for each. - [Migrate from Turnstile to Botpoison Challenge](https://botpoison.com/migrate/from-turnstile.md): Move a form off Cloudflare Turnstile onto Botpoison Challenge in three edits: the script, the widget and the siteverify call. With the code for each. - [Migrate from hCaptcha to Botpoison Challenge](https://botpoison.com/migrate/from-hcaptcha.md): Move a form off hCaptcha onto Botpoison Challenge in three edits: the script, the widget and the siteverify call. Nobody labels images again. - [Migrate from Akismet to Botpoison Classify](https://botpoison.com/migrate/from-akismet.md): Move from Akismet's comment-check to Botpoison Classify in three edits: the key, the request and the answer. A label and a score, with the code. - [Migrate from OOPSpam to Botpoison Classify](https://botpoison.com/migrate/from-oopspam.md): Move from OOPSpam to Botpoison Classify in three edits: the key, the request and the threshold. A label instead of a 0 to 6 score, with the code. ## Agent skills - [botpoison](https://botpoison.com/skills/botpoison/SKILL.md): Replace reCAPTCHA, hCaptcha, Cloudflare Turnstile or another CAPTCHA on a web form with Botpoison Challenge, an invisible proof-of-work check, and optionally add Botpoison Classify to label each submission spam or clean on the server. Use when asked to remove a CAPTCHA, protect a form from bots or spam, or integrate Botpoison. ## Optional - [About Botpoison](https://botpoison.com/about/): Botpoison is spam protection for web forms, made by Trampoline Software SRL and operated from Belgium. What it is built on: privacy, accessibility, honesty. - [Contact](https://botpoison.com/contact/): Questions about Botpoison Challenge, Classify, plans or an integration? Write to the people who build it and get an answer from a person, not a bot. - [California Privacy Rights](https://botpoison.com/legal/ccpa/): What Botpoison collects about California residents under the CCPA, why it holds it, that none of it is sold, and how to exercise your privacy rights. - [Data Processing Agreement](https://botpoison.com/legal/dpa/): The Article 28 contract for the personal data Botpoison processes on your behalf through Challenge and Classify. It is part of the Terms, with no signature. - [Botpoison and the GDPR](https://botpoison.com/legal/gdpr/): How Botpoison handles personal data under the GDPR: operated from Belgium, data stored in Ireland, and where to find the privacy policy and processors. - [Privacy Policy](https://botpoison.com/legal/privacy-policy/): How Botpoison collects, uses and protects personal data: what Challenge and Classify process, where it is stored, and the rights you can exercise. - [Subprocessors](https://botpoison.com/legal/subprocessors/): The third-party companies Botpoison relies on to run Challenge, Classify and the dashboard, what each one processes for us, and where it is located. - [Terms of Service](https://botpoison.com/legal/terms-of-service/): The terms of service for Botpoison, the form spam protection service operated by Trampoline Software SRL: accounts, plans, payment and liability. - [Full text of every page](https://botpoison.com/llms-full.txt): The pages above as Markdown, in this order.