Anubis is a self-hosted web firewall that stands in front of your website and makes suspicious visitors complete a lightweight challenge before their requests are allowed through. Place it between your load balancer or TLS terminator and the application it protects, with one instance guarding each service. Requests that look like scraper bots are weighed and challenged, which raises the cost of mass crawling so automated harvesting stops being free. Requests that pass are forwarded straight to your target service over TCP or a Unix domain socket, so legitimate visitors reach the real site. You define the bot policy: allowlist known good bots and crawlers you want to keep, challenge the ones you are unsure about, and turn away the rest. Challenge difficulty and weight thresholds tune how hard visitors must work, letting you balance protection against friction for real readers. The server listens on port 8923 by default and exposes Prometheus metrics on port 9090, so request and challenge rates show up in your existing monitoring. Deployment is a single Docker image or native package with minimal resource needs, and configuration arrives through environment variables plus the policy file. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.

FCaptcha guards your forms with an invisible check that spots bots, headless browsers, and AI agents steering real browsers, all from a server you run yourself. Drop the widget into a signup or contact form and it quietly watches how the visitor actually behaves: pointer movement, typing cadence, scroll shape, and dozens of other signals that separate a person from a script. Vision agents that screenshot and click, and computer-use agents driving a browser through automation protocols, leave input traces the scoring engine catches. Self-declaring crawlers get flagged by name, and signed agent requests are verified cryptographically so polite, identified bots can be allowed while anonymous automation is blocked. A proof-of-work challenge adds a liveness gate behind the scenes. Humans see no puzzle at all, in any of 34 languages, and the widget meets accessibility standards for screen-reader and keyboard-only visitors. Your backend verifies each token through the same siteverify contract that Turnstile, reCAPTCHA, and hCaptcha use, so switching providers is a change of address rather than a rewrite. No cookies are set, no visitor data travels to a third party, and nothing phones home. Running on a dedicated VPS on RepoCloud with guaranteed CPU, RAM, and SSD, full root SSH access, and a browser serial console. MIT licensed.