No image puzzles. No "click all the traffic lights." Veriloop Bot Shield hands each browser a tiny cryptographic proof-of-work that Chrome, Safari, and Firefox solve in ~200 ms — invisibly, in a Web Worker. Scripted bots either can't solve it, or pay real CPU per request. Free-abuse economics: broken.
Real users solve the PoW in a background Web Worker. No prompt, no image, no click. Median solve: 180–260ms on a modern laptop.
Every request costs CPU. Solving one is trivial; solving a million is expensive. Scrapers, credential stuffers and enumeration bots die.
HMAC-signed challenges bound to your workspace. No shared database, no cross-tenant learning, no third-party trackers.
Monitor scores unproven traffic slightly riskier. Enforce forces STEP_UP_AUTH until a valid proof arrives. Flip per workspace.
<script src="…/veriloop-bot.js" data-key="vl_live_…"></script>. That's it. Auto-token, auto-refresh, auto-attach.
Missing proofs, headless UAs, and burst patterns become learned signals — your workspace weights adapt from real feedback.
<script src="https://veriloop.lovable.app/veriloop-bot.js" data-key="vl_live_..."></script> <form data-veriloop-protect action="/signup" method="post"> <input name="email" /> <button>Sign up</button> </form>
Any form with data-veriloop-protect gets gated: the widget solves the PoW, injects veriloop_bot_token, then submits.
const r = await fetch(".../v1/evaluate", {
method: "POST",
headers: { authorization: `Bearer ${KEY}` },
body: JSON.stringify({
action: "login",
userId, ip,
botToken: req.body.veriloop_bot_token,
}),
}).then(r => r.json());
if (r.decision === "BLOCK") return res.status(403).end();Or call window.Veriloop.evaluate({...}) from the browser — the widget attaches the token automatically and refreshes on expiry.