Lost orders and sign-ups
Every extra puzzle is a point where a customer leaves. Invisible verification adds no step at all.
WEDOS PoW
Human verification without images or cookies
WEDOS PoW tells you that a form was sent by a person. The browser solves a short computational task in the background – the visitor solves nothing, while a bot sending thousands of requests pays in computing power. Works on any website. With WEDOS.protection it protects the whole domain, apps and APIs.
- Free plan at no cost, even for business websites
- Data stored in the EU
- No images or puzzles
Computing right now in your browsersimulation · nothing is sent
jane@example.com
Hello, I have a question about my order…
Preparing…
Attempts0
Time0.00 s
Speed–
SHA-256(salt + n) = …
- 0 puzzlesvisitors solve or retype nothing
- Data in the EUyou can even pick a specific EU country
- ISO/IEC 27001certified operation
- BSI qualificationDDoS protection provider (§ 3 BSIG)
- Since 1997independent company without investors
Why not an image CAPTCHA
Image CAPTCHAs slow customers down until they abandon the cart, and they shut out people with visual impairments. Bots, meanwhile, get them solved cheaply. Verification by computation reverses the rules: a person does nothing, while whoever sends thousands of requests pays for each one.
# the server issues: salt = "9f2c…?expires=…", target = SHA-256(salt + ?) # the browser looks for a number that fits: SHA-256(salt + 0) ✗ SHA-256(salt + 1) ✗ … SHA-256(salt + 48 213) ✓ # a fraction of a second for a person, # hours of computing for a million requests
A barrier for people with disabilities
Screen readers cannot read images or distorted codes. Accessibility requirements for e-shops and services in the EU have become stricter.
Spam, password guessing and fake accounts
Bots fill in forms, try leaked passwords, create accounts and buy up stock. Without verification, all of it lands on your server.
How PoW works
The WEDOS network issues and verifies the challenge. You install nothing on your server and don't have to change hosting.
You add the widget
You add one element to the form, with the challenge address for your domain and a key from the administration.
The browser gets a challenge
The nearest WEDOS node sends a one-time, signed task with limited validity.
It solves it in the background
This typically takes tenths of a second. The visitor keeps typing and sees or solves nothing.
Verification only – your website stays where it is
For forms, logins, sign-ups and shopping carts. On any hosting, with any provider. You don't move your website traffic to the protection and don't change DNS.
- Three variants: invisible, checkbox widget, challenge page
- Challenges are issued by the WEDOS network, not your server – even under a bot surge
- Included in every WEDOS.protection plan, free in the Free plan even for commercial websites
pow.wedos.global/<domain>key from the administration
The whole domain – people, apps and machines
When your website traffic goes through WEDOS.protection, the challenge runs right at the network edge, before the request reaches your server. And whoever is already verified doesn't have to verify again.
- Challenge at the network edge for suspicious traffic – on by default
- The challenge pass works on all nodes, even after a network change
- Access without a challenge for machines: signed token, JWT, client certificate
HMACJWTmTLSRFC 9440
What PoW can do
Everything is part of the WEDOS.protection plans. Each option shows the lowest plan that includes it.
People on your website
with or without proxy, any websiteInvisible challengeFree
Computed when the form is submitted. The visitor sees nothing, the form simply goes through.
Checkbox widgetFree
A visible “I'm not a robot”: one click, no images. The user can see that something is happening.
Challenge pageFree
A short interstitial page before entering a protected area – promotions, sign-ups, administration.
Full proxy through the protection
people and apps on the whole domainChallenge at the network edgeFree
Suspicious traffic gets a challenge before it reaches the server. Our team writes the rules and they apply automatically.
Challenge passNoLimit
After solving the challenge, a signed pass in a cookie, header or parameter. It works on all WEDOS nodes even after an IP address change, for example when a phone switches from Wi-Fi to mobile data.
Machines and systems
access without a challenge, with full proxySigned HMAC tokenNoLimit Expert
Your system signs the method, domain, path and expiry time with a secret key. The X-WGP-Token header passes without a challenge, while WAF and limits still apply.
Signed linkNoLimit Expert
A temporary link for a download or a single page. It stops working after expiry or with a changed path.
JWTNoLimit Expert
A token from your own login (HS256, HS384, HS512). We check the signature, issuer, audience and validity.
Client certificate (mTLS)NoLimit Expert
We verify the certificate at the network edge against your certificate authority, optionally as mandatory. We pass it to your server in the Client-Cert header according to RFC 9440.
Try it in your browser
The computation is real – the same principle the live service uses. For this demo, however, your browser creates and verifies the challenge itself and nothing is sent anywhere.
The invisible challenge and the checkbox widget run live here: the WEDOS network issues the challenge and the widget loads from pow.wedos.global. The form is not sent anywhere. The other demos simulate the computation in your browser.
Invisible challenge in a form
The visitor fills in the form and clicks Send. The computation runs in the background at that moment and a signed result is sent along with the form.
- No extra element, no interaction
- Suitable for contact forms, comments, newsletters
Checkbox widget
A visible confirmation for places where users should know the website is verifying them – login, sign-up, checkout.
- One click, no images or text to retype
I'm not a robotclick to verify
Protected byWEDOS.protection
Challenge page
A full-page challenge before entering a protected part of the website. Useful for promotions that attract shopping bots, or for the administration login.
- Takes a fraction of a second, then the page opens by itself
- With full proxy, the same challenge runs right at the network edge
https://your-shop.com/
Your e-shop
Click “Open the protected page”.
Challenge pass
The visitor solves the challenge once and then moves around the website without further challenges. The pass is signed and valid across the whole WEDOS network, so even a phone switching to another network does not invalidate it.
- Carrier: cookie
wgp_ok, headerX-WGP-Passor a parameter - You set the validity (15 minutes by default), bound to the domain and the browser fingerprint
- WAF, limits and blocks still apply – the pass only skips the challenge
# Click “Run the demo”.
Tokens for machines
Monitoring, partner integrations, mobile apps or cron jobs cannot solve challenges. They sign the request with a secret key and pass without a challenge. The tokens below are computed live, the same way the protection verifies them.
Client certificate (mTLS)
For interfaces between systems where the client proves itself with a certificate from your certificate authority. Verification happens at the edge of the WEDOS network, before the request reaches your server.
- Optional mode: with a valid certificate no challenge, without it the usual protection
- Mandatory mode: without a valid certificate a 403 response with a log entry
- We pass the certificate to your server in the
Client-Certheader (RFC 9440) and delete one forged by the client
# client with a certificate from your CA
curl --cert client.pem --key client.key https://api.your-site.com/v1/status
← 200
# without a certificate, mandatory mode
curl https://api.your-site.com/v1/status
← 403 # in the log: mTLS client certificate required
# what your server receives
Client-Cert: :MIIC…base64 DER…:
What a challenge costs – a person and a bot
Difficulty sets the range the browser searches. Measure how long a challenge takes on this device and how much computation a million requests would cost.
- A person sends a form once – a few tenths of a second go unnoticed
- A bot sends thousands of requests – and pays for each one
- PoW makes mass attacks expensive, but on its own it cannot tell a person from a bot. That is why we combine it with reputation and limits.
Average challenge–
Speed–
1M challenges–
“1M challenges” = hours of computation on one core of this device.
Where PoW fits
E-shops
Sign-ups, carts, discount codes and promotions that attract shopping bots.
Login
Makes guessing leaked passwords expensive for attackers without slowing down people logging in.
Forms
Contact forms, comments, enquiries and newsletters without spam.
Public sector and NIS2
Accessible verification and data stored in the EU with an independent European company.
Apps and APIs
Challenge pass for single-page apps and mobile websites.
System integrations
Signed tokens, JWT and client certificates for machines that don't solve challenges.
Agencies and hosting providers
One account for dozens of client websites.
Websites anywhere
You don't need WEDOS hosting or to move your website traffic through the protection.
How to deploy PoW
The widget is built on the open-source ALTCHA widget. The machine demos match what the protection verifies.
Turn on the service for your domain
In the WEDOS.protection administration you choose for each domain whether all traffic goes through the protection or verification only. You turn on PoW, generate a salt and the key for your code appears.
Add the widget to your form
The challenge address is
pow.wedos.global/<domain>?key=…. The key is public, visible in the HTML, and unlocks nothing on its own.Key rotation without downtime
A new salt moves the old one to backup. Both keys are valid during the rotation.
<!-- widget from the WEDOS network, no third party --> <script type="module" src="https://pow.wedos.global/_cap/altcha-2.1.0.min.js"></script> <form method="post" action="/contact"> <input name="email" type="email" required> <altcha-widget challengeurl="https://pow.wedos.global/your-site.com?key=YOUR_KEY" auto="onsubmit"></altcha-widget> <button>Send</button> </form>
# with full proxy, access without a challenge (NoLimit Expert) # signature: HMAC-SHA256(key, "h|METHOD|domain|path|expiry"), base64url import base64, hashlib, hmac, time def wgp_token(key_b64u, method, host, path, ttl=300): key = base64.urlsafe_b64decode(key_b64u + "==") exp = int(time.time()) + ttl msg = f"h|{method}|{host}|{path}|{exp}".encode() sig = base64.urlsafe_b64encode(hmac.new(key, msg, hashlib.sha256).digest()) return f"v1.{exp}." + sig.rstrip(b"=").decode() # requests.get(url, headers={"X-WGP-Token": wgp_token(K, "GET", host, path)})
PoW in WEDOS.protection plans
Prices are WEDOS.protection plan prices per protected domain. For each domain you choose whether all traffic goes through us, or only visitor verification.
Verification only
Your website stays where it is and DNS doesn't change. Visitors are verified via pow.wedos.global – invisibly, with a widget or a challenge page.
Full proxy
Domain traffic goes through the WEDOS network. On top of that: challenge at the network edge, challenge pass, access without a challenge for machines and full protection against DDoS, with WAF and bot protection.
In all plans:
invisible challenge, widget and challenge page
commercial websites included
no cookies
data stored in the EU
key rotation without downtime
Free root + 1 subdomain
For small businesses, associations and personal websites. Free for any number of domains, commercial ones too.
€0/ month
Start for free
- Invisible challenge, widget, challenge page
- Full proxy: challenge at the network edge
- No support, documentation
Suitable forcontact formsblogsassociations
NoLimit full protection
For e-shops and business websites. A verified visitor isn't verified again.
€8.25/ month billed annually
€99 per year · €13 monthly
Choose NoLimit
€99 per year · €13 monthly
- Challenge pass – cookie, header, parameter
- Support without guarantee
- Everything in Free
Suitable fore-shopscompanieslogin and sign-up
NoLimit Expert people, apps and machines
For companies with apps, APIs and connected systems. Machines pass without a challenge, protection still applies.
€100/ month billed annually
€1,200 per year · €110 monthly
Choose NoLimit Expert
€1,200 per year · €110 monthly
- Signed HMAC token, signed link, JWT
- Client certificate (mTLS) and Client-Cert
- Everything in NoLimit
Suitable forAPIssystem integrationsagencies
Organisations and NIS2
NIS2 plans are based on NoLimit Expert, so they include PoW with all options. On top of that: longer log retention, a managed service and support for entities obliged under NIS2.
NIS2 Important€165 / month billed annually
- For important entities under NIS2
- Everything in NoLimit Expert, 6-month logs
NIS2 Essential€340 / month billed annually
- For essential entities under NIS2
- Everything in NoLimit Expert, 18-month logs
Managed€1,000 / month billed annually
- Managed protection
- Named security analyst
| PoW in plans | Free€0 | NoLimit€8.25 / month | NoLimit Expert€100 / month |
|---|---|---|---|
| Invisible challenge, widget, challenge page | |||
| Verification only (website stays where it is) | |||
| Full proxy: challenge at the network edge | |||
| Commercial use | |||
| Challenge pass | – | ||
| HMAC, signed link, JWT, mTLS | – | – | |
| Support | documentation | no guarantee | no guarantee |
Prices from the WEDOS.protection price list as of 5 Nov 2026, excl. VAT, per protected domain.
Data in the EU, operation worldwide
The challenge is issued by the nearest WEDOS network node, wherever the visitor is. We store data in the European Union and you can restrict processing to a specific EU country. The service is run by an independent European company without investors or subsidies.
- ISO/IEC 27001plus 27017 and 27018
- Qualified providerof DDoS protection according to BSI (§ 3 BSIG)
- NIS2 and GDPRessential entity under NIS2 in the Czech Republic
- Independent European companyexperience since 1997
What the service doesn't do
Sets no cookies
Verification without proxy needs no cookie and no consent banner. The challenge pass with full proxy is optional.
Doesn't track visitors across websites
Verification serves protection only. No advertising profiles, we sell nothing.
Gives no puzzles
No images, traffic lights or text to retype. The invisible variant needs no action at all.
Frequently asked questions
Does the visitor have to solve anything?
No. With the invisible variant they see nothing at all, with the widget they click a checkbox once. The browser does the computation itself.
How long does the computation take?
Typically tenths of a second, longer on an older phone. We set the difficulty so that a person doesn't notice. Try it on your own device in the Difficulty demo.
Does PoW stop all bots?
No, and we don't claim it does. The computation makes mass attacks expensive – spam, password guessing, account creation – because a bot pays for every request. On its own it cannot tell a person from a bot. That is why we combine it with IP reputation, browser fingerprinting and limits. Domains behind WEDOS.protection also get the full network protection.
Does it work without JavaScript?
No. The computation runs in the browser, so JavaScript is required. For machines that don't run JavaScript, full proxy offers signed tokens, JWT and client certificates.
What visitor data do you process?
For protection and operational logs we process the IP address and technical request data. We store data in the EU in compliance with GDPR. The service sets no cookies and creates no advertising profiles.
What is a challenge pass?
Signed proof that the visitor has solved the challenge. It is valid for a set time (15 minutes by default) on all WEDOS nodes, so a new challenge doesn't stop them even after a network change. The pass does not switch off attack protection, WAF or limits.
Do I have to move my website to WEDOS.protection?
No. PoW is part of the WEDOS.protection plans and for each domain you choose: either all traffic goes through the protection, or verification only and your website stays where it is. The Free plan is enough. Passes, machine tokens and client certificates require full proxy, because we verify them right at the network edge.
The network that protects websites now verifies people too.
PoW is part of WEDOS.protection – website protection against DDoS, with WAF and bot protection on the global WEDOS anycast network.
Also running on the WEDOS network