ALTCHA, hosted: when to self-host and when not to

What ALTCHA gives you for free

The open-source ALTCHA widget is MIT licensed, needs no sign-up, and implements the same proof-of-work idea we do: the browser does a small amount of computation to prove it is worth serving, instead of making the person identify a crosswalk. No cookies and no image puzzles are inherent to the mechanism, not a feature anyone sells you.

If you are running your own infrastructure anyway — you have a server, a deploy pipeline, and monitoring that someone looks at — then self-hosting ALTCHA is the correct answer and this page should send you to altcha.org. Go and use it.

What self-hosting actually costs

Not money. Four things that come out of someone's week:

You run the verification endpoint. Every form submission on every site you look after depends on it answering. When it stops answering, your clients' contact forms stop working, and you find out from the client.

You keep it patched. It is a security component on the public internet. Somebody has to be the person who notices the release.

You get no dashboard and no analytics. The free widget is a widget. If you want to know whether the thing is blocking anything, you build that.

You answer the compliance question with your own paperwork. This is the part people miss. Self-hosting means you are the processor. "We host it ourselves" is a good answer — but you are now the one who has to produce the data-flow description, the retention statement and the server location, rather than pointing at a vendor's document.

None of this is an argument against self-hosting. It is an argument for being honest about who on your team is going to do it. For a lot of agencies the answer is "nobody, and we'll find out in six months."

If you would rather not run it: the two hosted prices

ALTCHA sells the managed version. Here is what each option costs at the same number of sites.

ALTCHA also sells a self-hosted WordPress plugin at €18.90/mo for one site, €119.90/mo for up to 100 sites, and a self-hosted Sentinel product from €99/mo.

Where ALTCHA is genuinely ahead of us. Four things, and we would rather you heard them from us:

• It is open source. You can read every line, fork it, and you are not betting your clients' forms on whether one small company stays in business. That is a real answer to a real risk, and we cannot match it.
• Their hosted product commits to EU-only endpoints. Ours does not. ALTCHA Cloud is described on their pricing page as "hosted in the EU" with "EU-only endpoints". botshield.dev is served through Cloudflare, so Cloudflare terminates TLS for every verification request and sees the visitor's IP. If a contractual EU-only data path is your requirement, their €137 plan meets it on paper and our €19 plan does not. Do not take either claim on faith — ours is checkable in the next section, and theirs you should ask them to evidence.
• It is better known. ALTCHA is listed in the WordPress plugin directory and in the open-source alternative directories. Ours is not yet.
• Unlimited verifications on the self-hosted tiers. Ours are metered.

The continuity question deserves a straight answer, not a dodge. If you self-host ALTCHA and we disappear tomorrow, your forms keep working; that is a real advantage and no amount of copy changes it. What we can tell you is what we publish: BotShield is maintained and in use, and it is not on a fixed release schedule — changes land as they are finished and get grouped into a numbered release when there is enough to name. The last numbered release was v0.2.5 on 23 March 2026; work completed since then is listed as in development on our changelog, dated, so you can judge the pace for yourself rather than take an adjective from us. We are not going to promise you a release cadence we have not kept.

And what you can check about us in forty seconds. Not a counter-claim — a different kind of claim. The widget sets no cookie, uses no client-side storage and calls no fingerprinting API, and it talks to exactly one host:

curl -s https://botshield.dev/sdk.js > sdk.js
grep -c -E 'document\.cookie|localStorage|sessionStorage|indexedDB|canvas|navigator\.userAgent|AudioContext|WebGL' sdk.js
grep -o -E 'https?://[a-zA-Z0-9./_-]+' sdk.js | sort -u
curl -sD - -o /dev/null -X POST https://botshield.dev/api/v1/solve | grep -i set-cookie

Measured 9 October 2026: zero matches, one host, no Set-Cookie header. The server code, including the function that truncates IPv4 to /24 and IPv6 to /56 before anything is logged, is public at github.com/spaghettisi/scaptcha. If you are the kind of reader who was going to self-host ALTCHA, you are exactly the kind who will run those four lines — so we would rather hand them to you than ask you to trust a badge.

Where we are ahead. Also three, and all checkable in the table above:

• Price at more than three sites. €19 against €137 for ten sites.
• A free plan that we host. ALTCHA's free option is the self-hosted widget; ours runs on our infrastructure, so you can test the hosted path without provisioning anything.
• Metering by solves, not by requests per day with an hourly burst cap. A form that gets hammered for one hour does not hit a wall at 100.

How to choose, in three questions

1. Do you already run servers you monitor? → Self-host ALTCHA. Free, MIT, yours.
2. Do you need the source code open for contractual or risk reasons? → ALTCHA Cloud. We cannot give you that, and it is a legitimate requirement.
3. Do you just need a captcha that someone else keeps running across several client sites, without a procurement conversation? → That is the one we built.

Read the docs, then start free

The documentation is public — no account, no login wall. Read the integration you would actually write, decide whether it is better than the afternoon you were about to spend on a server, and then take the free plan: 1,000 solves a month, 2 domains, no card. Two lines of code, the proof-of-work mechanism you already decided you wanted, and invisible mode included rather than reserved for a paid tier.

Read the docs