I've been working on FCaptcha, an open source CAPTCHA aimed at detecting bots and AI agents that operate browsers. I'm part of the WebDecoy team behind it.

The case that interests us is automation that can load a page, type, and click. FCaptcha looks at browser automation indicators and interaction signals, including pointer movement, keyboard behavior, and timing, alongside proof of work. It has checkbox and invisible modes and runs on your own server.

I made a small Hono example for the server-side part of that flow. The browser gets a token; Hono verifies it before the route can accept a request.

The middleware calls FCaptcha's /siteverify endpoint with a private verification secret. After checking the response shape, it checks the signed hostname and action too:

if (result.success !== true ||
    result.hostname !== hostname ||
    result.action !== 'contact') {
  return c.json({ error: 'captcha_rejected' }, 403);
}
c.set('message', body.message.trim());
await next();

That keeps the protected operation in a normal route handler:

app.post('/contact', verifyVisitor, c => {
  // Send/save/enqueue c.get('message') here.
  return c.json({ accepted: true, demoOnly: true });
});

The example also uses Hono's body-limit middleware, checks input before contacting the verifier, and has a five-second verification timeout. Invalid tokens return 403. A verifier outage returns 503 rather than accepting an unchecked request. Each browser retry obtains a fresh token because tokens are single-use.

There's a runnable browser demo and local launcher, with no paid account needed. It starts Hono and FCaptcha on loopback with separate temporary secrets. The sample message isn't stored or sent anywhere.

I tested it with Hono 4.13.12 and the Node adapter: 11 tests pass, including real-verifier acceptance, replay, expiry, forgery, and hostname/action checks. Those validate the integration, not detection accuracy. Other runtime adapters haven't been tested here. CAPTCHA also doesn't replace authentication or authorization, and this isn't a log of every crawler visiting a site.

Code and setup · Project · Interactive demo

The example is now merged into the main branch. Feedback on the middleware structure and handling legitimate visitors who get rejected would be useful.