Frictionless Security at Scale
Architecting a privacy-first, WCAG-compliant human verification primitive for the modern enterprise web.
1. The Problem with Legacy Verification
For over a decade, the enterprise standard for bot mitigation has been Google reCAPTCHA. However, as the web has matured, the costs associated with legacy image-grid verification have compounded into three critical liabilities for risk-averse organizations:
- Accessibility Lawsuits (ADA/WCAG): Image-recognition puzzles fundamentally discriminate against visually impaired users. While audio fallbacks exist, they are notoriously difficult to decipher and often fail strict WCAG 2.1 AA compliance audits.
- Privacy & GDPR Friction: Modern reCAPTCHA versions rely heavily on tracking cookies and cross-site browsing history to build a "risk score." In jurisdictions with strict privacy regulations (GDPR, CCPA), injecting third-party tracking into sensitive checkout or lead-generation flows introduces unacceptable compliance risks.
- Conversion Drop-off: Active verification (forcing users to select traffic lights) introduces deliberate friction into the most critical part of a funnel, resulting in measurable revenue loss.
2. Gamified State Verification
TapHuman solves this by replacing historical data analysis with real-time gamified interactions. We verify humanity not by what the user has done previously on the web, but by how they interact with a delightful 2-5 second HTML5 micro-game.
Dynamic Game State Validation
When our lightweight frontend widget loads, it presents the user with a randomized mini-game (e.g., Sunny Day Maze). Verification is driven by the cryptographic validation of the game state payload (win conditions, solve time floors > 250ms), not passive mouse tracking.
Because humans natively understand play, the system verifies humanity seamlessly while drastically reducing the friction and frustration compared to legacy image-classification CAPTCHAs.
Dynamic Challenge Randomization
Defeat machine-learning models trained on static puzzles. Our infrastructure allows publishers to seamlessly deploy unpredictable, multi-game challenge rotations on every page load. This dynamically alters the physics logic, neutralizing bots that attempt to learn specific interaction patterns.
Server-Side Bot Detection
Instead of attempting to detect bots purely on the client side, our SDK asynchronously solves a computationally expensive cryptographic Proof-of-Work puzzle in the background while the user plays. The backend enforces strict validation, ensuring the game was completed within realistic time bounds and the Proof-of-Work solution meets the required difficulty threshold.
Proof-of-Work & Interaction Entropy
While the user plays, our SDK runs a SHA-256 Proof-of-Work computation in the background — searching for a nonce that produces a hash meeting a strict difficulty target. This makes automated attacks computationally expensive and economically unviable. Additionally, the game uses a seeded pseudo-random number generator tied to the challenge token, ensuring each puzzle instance is deterministic and verifiable server-side.
3. Uncompromising Accessibility (WCAG 2.1 AA)
To ensure compliance with WCAG 2.1 AA standards, every game includes native keyboard navigation and screen reader support. Rather than relying on a separate audio CAPTCHA fallback, our games are designed with accessibility as a core feature.
Each game implements standard aria-live regions for real-time screen reader announcements, full keyboard navigation (Tab to select, Arrow keys to move, Space/Enter to interact), and semantic HTML that works natively with VoiceOver, TalkBack, and desktop screen readers. Users with disabilities play the same game through an equivalent, accessible input method — no separate "bypass" required.
4. Cryptographic Handshakes (Server-Side Validation)
Client-side game logic must be protected against malicious actors injecting fake JavaScript events. To secure the pipeline, TapHuman employs an industry-standard cryptographic handshake.
The V2 Architecture (Live Production)
When a user completes a game, the SDK transmits the Proof-of-Work solution and game completion token to the TapHuman backend. Our Node.js backend verifies that the SHA-256 hash meets the difficulty target, confirming that real computational work was performed.
The backend then signs the verified payload using your pre-shared secret key, generating an HMAC SHA-256 signature. When your user submits their form, your backend server re-hashes the payload with your private key. If the resulting signature matches and the timestamp has not expired, you achieve mathematical certainty that the request originated from an authentic, verified human session.