I run a website on my own VPS and try to store only the user information that is necessary or legally required. I'd prefer not to use third-party CAPTCHA providers because of tracking, data collection, and potential use of visitor data for AI training. I'm therefore looking for a reliable, open-source CAPTCHA or anti-bot system that I can host myself.
My main concerns are preventing automated account creation and stopping card-testing attempts before they become a problem. I've looked at ALTCHA, Gatcha, Cap.js (trycap.dev), mosparo, and Anubis. ALTCHA seems established, but its free version has limitations and the paid version is expensive. Gatcha appears similar to ALTCHA's free version, although I may be missing some configuration needed to enable its widget features. Cap.js looks promising, but I've run into installation errors and haven't found much support.
What self-hosted option would you recommend, and are there important limitations or deployment tips I should know about?
5 Answers
Private CAPTCHA is worth investigating. It can be self-hosted, is open source, and may be free for noncommercial use, with paid plans that are generally less expensive than ALTCHA’s commercial offering. It’s intended more as a production-ready service than a minimal challenge widget.
ALTCHA’s free version may need more tuning than expected. A fixed proof-of-work cost can make the challenge finish almost instantly on powerful desktops while leaving mobile users waiting several seconds. You may need to measure client performance and choose the cost dynamically, which adds complexity and can still produce an uneven experience.
Cap.js is probably the simplest fit if you want something fully open-source and self-hosted. It supports proof-of-work and instrumentation challenges, but it doesn’t automatically adjust difficulty and has fewer integrations than larger products. The trycap.dev project is Cap.js, so those names refer to the same project.
A CAPTCHA alone won’t reliably stop card testing. Add rate limits per account, IP range, device, and payment method; require email or phone verification where appropriate; limit failed payment attempts; and use your payment processor’s fraud tools and webhooks. For account creation, combine a self-hosted challenge with throttling and monitoring rather than treating the CAPTCHA as the only defense.
Mosparo is another privacy-oriented, self-hosted option. For completely automatic protection at the edge, Anubis is also used by some public software and archive sites. It focuses more on filtering abusive automated traffic than presenting a traditional CAPTCHA, so it may be a better fit for scraping and bot mitigation than for every account-registration flow.
That clears up the naming confusion. I’ll take another look at my deployment setup and see whether the installation issue is specific to my hosting environment.