10,000 free checks a month · no card
Stop bots on sign-up, login, contact and checkout forms. Most visitors tick one box; only suspicious ones get a quick puzzle. Free for 10,000 checks a month, Starter from ₹99.
How it works
When the box is ticked, the visitor's browser solves a small proof-of-work puzzle in the background: half a second on a phone, real cost for a bot farm.
Pointer, keyboard and touch signals plus automation checks give a score. Low scores get a quick picture puzzle, drawn fresh every time.
The form carries a one-time token. Your server sends it to siteverify with your secret and gets success, a score and the hostname back.
Built differently
Each visitor's browser does a small piece of maths before the box ticks: about half a second on a phone, but real money for anyone sending thousands of fake sign-ups. The widget also looks at light signals, such as whether a pointer, key or finger touched it and whether the browser is an automation tool. A low score gets a quick puzzle in the style you choose, drawn fresh for every visitor, so there's no fixed image set to train a bot on.
No cookies, no cross-site tracking, no advertising profile. The widget never sees your form's content. IP addresses are only used, scrambled, for a few minutes to make the work harder after repeated failures. The servers are in India, which keeps it simple under the DPDP Act.
The widget reads hCaptcha's markup and fills the h-captcha-response and g-recaptcha-response fields, and siteverify answers in the same shape as hCaptcha and reCAPTCHA. Switching usually means changing the script address, the keys and the verify address, nothing else.
The box and the puzzle work with a keyboard and screen readers, follow the visitor's light or dark theme, and speak 35 languages, from English, Hindi and Tamil to Spanish, Arabic and Japanese, right-to-left ones included.
Yes, up to 10,000 verifications a month on 1 website, with a small “Protected by FitMyKB” link. Starter (₹99 a month on offer) removes the link and raise the limits; going over never breaks your forms.
No. Like hCaptcha and reCAPTCHA, the check runs in the browser.
Your server decides: the docs show how to time out the verify call and choose whether to let the form through.
Yes, in a WebView. The docs have the pattern.
Two lines of code
Free up to 10,000 checks a month on 1 website, to try it properly. Going over never breaks your forms.
<!-- in your page --> <script src="https://fitmykb.com/captcha/api.js" async defer></script> <div class="fmk-captcha" data-sitekey="YOUR_SITE_KEY"></div>
Privacy · Terms