The hCaptcha alternative that reads what people send.

Messages that pass a bot check: real submissions and how Doorman judged them

  1. Specimen · Contact formNº 150525 0473

    From growth@rankwise.io

    “Your restaurant isn't showing on page one of Google. We can fix your local SEO in 30 days, guaranteed. Can I send a proposal?”

    Sales pitch

    1% chance it’s real · 82 ms

    Void

  2. Specimen · Contact formNº 148847 2854

    From zara@quill.example

    “I run Quill Legal. We use Xero today. Half our clients are in the UK. Can we get a demo this week?”

    91% chance it’s real · 87 ms

    Genuine

  3. Specimen · Contact formNº 147169 5235

    From hello@pixelcraft.agency

    “We build stunning websites for architects. Your current site feels dated. 15 minute call to show you some concepts?”

    Sales pitch

    2% chance it’s real · 84 ms

    Void

  4. Specimen · Contact formNº 145491 7616

    From kofi@proton.me

    “I run Brightline Dental. Clients keep asking to pay by card and we can't take it. Does it import from what we use now?”

    81% chance it’s real · 78 ms

    Genuine

  5. Specimen · Contact formNº 157236 0949

    From hello@scaleleads.co

    “Are you accepting guest posts? I have a well researched article on small business cash flow that fits your audience.”

    pitch

    2% chance it’s real · 83 ms

    Void

  6. Specimen · Contact formNº 155558 3330

    From claire.m@gmail.com

    “Hi, my son chipped a front tooth at football. Do you have anything this week for children? He's 11.”

    95% chance it’s real · 90 ms

    Genuine
Start free
Paste a pitch you got

Sound familiar?

hCaptcha is good at telling bots from browsers. But most form junk today is typed by people or written to sound like them. Doorman reads each submission against what you sell, with nothing added to your page.

14 days of Pro free, no card. Then free for 100 submissions a month, or Pro from $29.

  1. People pass challengesAn agency pitch typed by a person solves any captcha. It still lands in your inbox.
  2. A widget on your best formEvery challenge, even an occasional one, is friction on the form you most want finished.
  3. No reason below EnterpriseOn the free and Pro plans, verification tells you pass or fail, not why.

Doorman and hCaptcha, side by side.

QuestionDoormanhCaptcha
What it checksWhat the visitor sent, against what you sellVisitor behaviour and bot signals
Pitches from bots that pass the checkKept outPass
What visitors seeNothingA widget that may show a challenge; passive modes on paid plans
Why something was blockedThe exact sentence, on every planError codes; a risk score and reason on Enterprise
SetupA form URL or one server callA script and widget on the page, plus a server-side verify call
PriceFree for 100 submissions a month, Pro $29 for 5,000Basic free; Pro $139 a month ($99 billed yearly) for 100,000 evaluations

Their plans and behaviour as published on their own sites, checked 29 September 2026. Sources: hcaptcha.com/pricing, docs.hcaptcha.com.

Which one is right for you?

Choose Doorman if

  • Your junk is human: agency pitches, SEO offers, partnership outreach
  • You want nothing added to your pages
  • You want the reason for every decision without an enterprise plan
  • You want unsure submissions held for you, not guessed

Choose hCaptcha if

  • Your problem is automated traffic: credential stuffing, scripted sign-ups, scrapers
  • You're happy with a widget on the page
  • You need an enterprise bot-management contract

They work together: hCaptcha in front for bulk bots, Doorman on the forms to read what gets through.

Switch in two minutes

  1. Hosted form change the form's action to your Doorman URL and remove the hCaptcha script and widget.
  2. From your server replace the hCaptcha verify call with one doorman.check call; act on deliver, hold or drop.
  3. Or ask your agent copy one prompt into Claude Code, Codex or Cursor and it does the swap.
  4. Start safely watch mode delivers what it would have dropped, tagged, until you switch it to enforce.

Read the docs

Before → afterhtml
<!-- before: a hCaptcha script and widget -->
<form action="/contact" method="POST"> … <div class="hcaptcha-widget"></div>

<!-- after: no script, no widget -->
<form action="https://withdoorman.com/f/f_yourForm" method="POST"> …

Checked, not guessed.

Every decision comes from Doorman's models reading the submission, in milliseconds, with the reason attached.

13/13
agency and SEO pitches dropped in our labelled set; a bot check passes all of them
0
genuine enquiries dropped; the unsure ones were held for you
~100 ms
to judge a submission, invisible to the visitor

Labelled test set: 104 invented but labelled contact-form and checkout submissions, judged live; latency is the median of those checks. Questions were not tuned to the set.

Questions

Does Doorman stop bots too?

Yes. Scripted and generated submissions are judged like any other and dropped, and hosted endpoints are rate limited per IP. For very high-volume bot attacks you can keep a bot check in front.

Is it harder to set up than hCaptcha?

It's easier: no script or widget. Change the form's action URL, or replace the server-side verify call with one check call.

What about privacy?

Doorman sees only what the form sends plus the sender's IP, and runs no script on your page. Submissions are never used for training.

How much does it cost?

Free for 100 submissions a month. Pro is $29 a month for 5,000 and Business is $79 a month for 50,000, and every account starts with 14 days of Pro. Until November 30, the first 100 paying customers get Pro at $19 and Business at $59, kept for as long as they stay. See pricing.

Try it on your own forms.

Start with 14 days of Pro, free. Turn on watch mode to see every call before you trust it.

Start free Try the live demo