Open source · AGPL-3.0 · self-hosted
Catch the bots that look like browsers.
Veritell is a gateway you run in front of your own site. It checks whether a visitor's claims agree with each other, from the handshake up to the page, and stops the ones that don't. No CAPTCHA, no proof-of-work wall, and nothing leaves your server.
One request, four witnesses
Every request makes claims at every layer. Real devices come in a limited number of combinations that fit together. Evasion tools fix one layer at a time, so they leave combinations that don't exist in the wild.
- 1
Network
The TLS and HTTP/2 handshake and the TCP SYN show which network stack and kernel really sent the request.
- 2
Browser
A small probe checks that the JavaScript engine and the hardware match the browser the User-Agent claims.
- 3
Behaviour
How the page is actually used: pointer, keys, timing. Only counts are kept, never what anyone typed.
- 4
Population
What all the clients of your site are doing together, over a sliding window.
The answer is graduated: pass, a silent check, a small cost, or a block. Signed agents (Web Bot Auth) and Private Access Tokens are recognised.
Yours
Runs on your server. Visitor addresses are stored as daily keyed hashes and kept 30 days.
Reversible
Goes in front of nginx, Caddy, Apache or a container without changing them. One command takes it out.
Shadow first
It scores everything and blocks nothing until you've seen, on your own traffic, what it would do.
Become a design partner
We're looking for a few sites to run Veritell in shadow mode for 4 to 8 weeks. It's free, we set it up with you, and every week you get a report of what it would have blocked and why. It fits best if your site:
- is hit by scrapers, spam sign-ups, card testing or credential stuffing,
- ends TLS on its own server, with no CDN proxy in front,
- runs on one Linux server you can reach over SSH.