TiCaptcha

Core Principle

A CAPTCHA result is not enough.

Current leaders already extend far beyond puzzles. TiCaptcha must combine bot management, account defense, transaction protection, API security, AI-agent control, adaptive challenges and shared threat intelligence.

Five questions for every request

Who or what is interacting?
Is it a human, ordinary bot, AI agent or fraud operator?
What is its intention?
How risky is the requested action?
What intervention creates the least friction while stopping the attack?

{
  "valid": true,
  "actor_type": "human",
  "risk_score": 7,
  "confidence": 98,
  "intent": "login",
  "session_trust": 92,
  "device_trust": 87,
  "network_trust": 78,
  "account_risk": 4,
  "recommended_action": "allow",
  "reasons": [
    "trusted_device",
    "normal_behavior",
    "low_velocity"
  ]
}

Product Suite

One trust layer for every high-risk interaction.

The product should retain the memorable TiCaptcha name, while the underlying system becomes much larger than a CAPTCHA.

Verify

The lightweight CAPTCHA replacement: invisible verification, checkbox mode, managed challenge, non-interactive mode, server-side token verification, privacy-first operation, accessibility support, custom branding and one-line installation.

BotShield

Website and application bot management for spam, scraping, credential stuffing, fake registrations, brute force, card testing, inventory hoarding, scalping, click fraud, AI browser agents and headless browsers.

AccountGuard

Continuous account protection across login anomalies, session hijacking, impossible travel, device changes, password resets, profile changes, synthetic identity and multi-account relationship analysis.

TransactionGuard

Protection for payments, card testing, coupon abuse, refunds, chargebacks, fake orders, wallet abuse, marketplace fraud, ticket scalping and subscription trial abuse.

APIShield

REST, GraphQL, mobile and machine-to-machine API protection with credential abuse detection, token replay detection, signed requests, webhook protection, API discovery and shadow API detection.

AgentControl

A dedicated layer for the AI-agent era. Classify verified beneficial agents, search crawlers, accessibility agents, customer-authorized agents, commercial collectors, unknown automation, malicious agents and impersonators.

ScrapeShield

Content scraping and dataset harvesting protection with crawler verification, fake crawler detection, dynamic response shaping, honey endpoints, watermarked content and per-agent licensing rules.

ThreatGraph

The intelligence center connecting IP, network, device, browser, session, account, email, phone, payment, address, behavior and organization into one coordinated attack graph.

Detection Engine

Hundreds of signals, evaluated as a journey.

A request may look normal individually and still become suspicious when viewed as part of a coordinated sequence from landing page to purchase, refund or account change.

Network Intelligence

IP reputation and attack history
ASN and hosting provider
VPN, proxy and Tor probability
Geo consistency and velocity
DNS, TLS and HTTP fingerprints

Browser Integrity

Headless-browser indicators
Automation framework detection
JavaScript environment integrity
WebDriver manipulation
Canvas, rendering and DevTools anomalies

Device Intelligence

Privacy-preserving device identity
Device reputation
Mobile emulator detection
Root and jailbreak indicators
Device-to-account relationships

Behavioral Intelligence

Pointer, touch and typing behavior
Focus, scrolling and navigation path
Form-completion timing
Copy-paste and interaction entropy
Mistake and correction patterns

Landing page
-> Product view
-> Registration
-> Email verification
-> Login
-> Account usage
-> Purchase
-> Payment
-> Refund request

Adaptive Intervention

Stop attacks with the least possible friction.

TiCaptcha should not simply allow or block. It should automatically choose the lowest-friction action that still changes the attacker's economics.

Low Friction

Allow silently
Allow and observe
Reduce request limits
Delay the response
Require JavaScript proof

Escalate

Require browser proof-of-work
Require interaction proof
Present a simple challenge
Present an advanced challenge
Require email verification

Contain

Require OTP or passkey
Require administrator approval
Block temporarily
Block permanently
Tarpit or economically disrupt

Challenge Laboratory

Ordinary image selection cannot be the main defense.

Challenges must be generated dynamically, single-use, cryptographically signed, time-limited, replay-resistant, accessible, localized and continuously evaluated against AI models.

Spatial relationships Object manipulation Visual memory Contextual matching Dynamic paths Physics interaction Audio-spatial alternatives Device-assisted verification Proof-of-presence Cryptographic attestation Browser proof-of-work Trusted-device confirmation

Threat Network

Every protected site improves the defense.

Shared intelligence should include bot fingerprints, malicious infrastructure, fraud clusters, solving services, fake-account factories, AI-agent behaviors, scraping networks and distributed low-volume attacks. Sensitive customer data must not be shared between customers.

New attack discovered on Site A
           |
Fingerprint extracted
           |
TiCaptcha Threat Network updated
           |
Sites B-Z protected automatically

Infrastructure

PHP and MySQL can run the control plane. The detection plane needs more.

The target is low-latency global verification with a control plane for customers and a high-speed data plane for real-time risk decisions.

Control Plane

PHP, MySQL, vanilla JavaScript, HTML/CSS, Redis and REST APIs for customer dashboards, site configuration, billing, API keys, rules, reports and user management.

Detection Data Plane

Go or Rust, Redis, ClickHouse, Kafka or Redpanda, PostgreSQL/MySQL, Python, ONNX Runtime, object storage, global edge nodes and later Kubernetes orchestration.

<20 ms

Edge decision target

<50 ms

Standard assessment target

<150 ms

Advanced assessment target

Security and Privacy

The trust platform must itself be hardened.

TiCaptcha should become powerful without becoming an advertising-surveillance network.

Security Requirements

Signed, one-time, short-lived tokens
Domain and action binding
Replay prevention and key rotation
Separate site and secret keys
Public-key verification option
Multi-region key storage and HSMs
Tenant isolation and complete audit logs
Signed SDK releases and subresource integrity
Bug bounty, penetration testing and red-team lab

Privacy Advantage

No advertising and no sale of user data
No cross-site advertising profiles
Minimized raw-data retention
Configurable data residency
Pseudonymous identifiers
Customer-controlled retention
EU, India and GCC hosting options
Private-learning option for enterprises
Self-hosted verification gateway

Developer Experience

Install in one line. Verify on the server.

Initial integrations should include JavaScript, PHP, WordPress, WooCommerce, Node.js, Python, React, Vue, Android, iOS, Flutter, React Native, Laravel, Symfony, Shopify, Magento, WHMCS, cPanel, OpenLiteSpeed, Nginx and Apache.

Browser installation

<script
  src="https://cdn.ticaptcha.com/v1/ticaptcha.js"
  data-sitekey="tc_public_xxxxx"
  data-action="signup"
  async>
</script>

Server verification

$result = TiCaptcha::verify([
    'secret' => getenv('TICAPTCHA_SECRET'),
    'token'  => $_POST['ticaptcha_token'],
    'action' => 'signup',
    'ip'     => $_SERVER['REMOTE_ADDR'],
]);

Decision Modes

Customers choose how much TiCaptcha decides.

The same risk engine can run silently, return scores only, enforce rules, observe in learning mode, tighten during attacks or train private enterprise models.

Managed

TiCaptcha automatically chooses the response.

Score Only

TiCaptcha returns risk intelligence; the customer decides.

Rules

Customer policies decide actions from risk, intent and context.

Learning Mode

Observe traffic without blocking.

Emergency Mode

Automatically activate strict protection during an attack.

Private Model

Dedicated models trained only on one enterprise customer's data.

IF risk_score > 80
AND action = login
AND account_age < 24 hours
THEN require_passkey

Roadmap

A realistic path to a global security network.

The first phase should create a strong independent foundation before expanding into advanced bot defense, fraud protection, AI-agent control and global edge intelligence.

Powerful Foundation

Invisible verification, checkbox fallback, JavaScript integrity checks, risk score, IP and ASN intelligence, headless-browser detection, rate and velocity analysis, signed single-use tokens, domain/action binding, PHP SDK, WordPress plugin, analytics dashboard, managed rules, basic proof-of-work and Cloudflare-independent deployment.

Advanced Bot Defense

Device intelligence, behavior models, journey analysis, API protection, mobile SDKs, advanced challenges, threat graph, coordinated attack detection, scraping protection and customer-defined rules.

Fraud Platform

AccountGuard, TransactionGuard, promotion-abuse detection, payment-risk scoring, private enterprise models, global threat intelligence, 24/7 security operations and automated attack response.

AI-Agent Control

AI-agent classification, beneficial-agent verification, agent identity protocol, permission policies, paid content-access controls, audit logs and human delegation verification.

Global Security Network

Multi-continent edge infrastructure, data-residency regions, enterprise private gateways, self-hosted hybrid mode, independent research laboratory, global red-team program, public benchmarks and large-scale threat sharing.

Proof Standard

"Most powerful" must be earned.

Do not publicly claim the world title because the feature list is large. Publish independently verifiable results first.

Detection

Bot-detection rate, AI-agent detection accuracy, new-attack detection time and resistance against CAPTCHA-solving services.

Accuracy

False-positive rate, challenge rate for legitimate users and accessibility success rate.

Business Impact

Fraud-loss reduction, account-takeover reduction and transaction-risk reduction.

Reliability

Median verification latency, global uptime, peak requests per second and independent testing results.

Product Structure

Domains, dashboard areas and databases.

High-volume telemetry should later move from MySQL to ClickHouse, while customer and configuration records can remain in relational storage.

Domains

ticaptcha.com, api.ticaptcha.com, cdn.ticaptcha.com, edge.ticaptcha.com, status.ticaptcha.com, docs.ticaptcha.com, research.ticaptcha.com, labs.ticaptcha.com and trust.ticaptcha.com.

Dashboard

/dashboard, /sites, /applications, /traffic, /threats, /attack-campaigns, /accounts, /transactions, /api-protection, /agents, /challenges, /rules, /models, /integrations, /logs, /team and /billing.

Databases

ticnob_ticaptcha is the primary application database for the first release. High-volume telemetry can later move to ClickHouse without splitting the core launch into multiple project databases.

References

Official sources used for competitive context.

These links are provided for positioning context. TiCaptcha's implementation and claims should remain independently developed and independently verified.

The Global Trust and Abuse-Defense Platform