Karma — Bot Protection by Reputation, No CAPTCHAs
Karma scores every visitor by behavioural and transport signals, then lets your gateway pass humans and stop bots in real time — no CAPTCHAs. Start free, no card.
Karma reads behavioural and transport signals from each web session, scores the address against your own reputation base and an optional shared bot blocklist, and lets your gateway pass humans and stop bots, no CAPTCHAs.
From snippet to verdict in four steps
- Add your site — Register a domain in the panel and grab a one-line snippet. It loads before analytics and never slows the page.
- Collect signals — The snippet streams behavioural and transport signals from each session to the collector over TLS.
- Score reputation — Karma turns sessions into verdicts and scores every address against your own base and, optionally, the shared bot blocklist.
- Pass or stop — Your gateway forwards humans and stops bots in real time. Decisions cache locally, so it never takes your site down.
Everything the verdict needs
- Behavioural verdicts — Each session is judged human or bot from real interaction signals, not a checkbox.
- Transport fingerprints — JA3/JA3N and HTTP/2 settings identify the client stack, hard to fake from a browser.
- Per-tenant reputation — Every account has its own reputation base; your traffic shapes your own scores.
- Shared bot blocklist — Optionally read a shared pool of internet-wide bots. Off by default, available from the pre-top plan.
- Your lists win — Your allow and deny lists always override the platform, so you never block a partner by mistake.
- No CAPTCHAs — Visitors are never challenged; the verdict happens invisibly from the session.
- Fail-open by design — If reputation is unavailable the gateway forwards, your site stays up, always.
- Multi-platform snippet — Drop-in for HTML, React, PHP, Vue, WordPress and GTM, one collector, any stack.
Questions, answered
Do visitors see a CAPTCHA?
Never. Karma reads the session invisibly and issues a verdict; humans are forwarded without friction.
Will it slow my site?
No. The snippet loads asynchronously above analytics and buffers early events; it never blocks rendering.
What if reputation is down?
The gateway fails open and forwards traffic. Availability beats strictness, your site stays up.
Whose bots are in the shared blocklist?
Addresses flagged across contributing customers. Reading it is optional, off by default, and enabled from the pre-top plan.
Can I override a block?
Yes. Your allow and deny lists always win over the platform, so you never lose a partner or a good crawler.
Which platforms are supported?
Any site: a plain HTML snippet plus wrappers for React/Next, PHP, Vue/Nuxt, WordPress and GTM.