ForHosting KIT · Validation

Score bot traffic

A form submission, a login attempt or a comment doesn't announce whether a human or a script sent it, and treating every request the same way either lets bots through or annoys real people with friction they didn't need. This endpoint scores the likelihood that a given request came from automation, so you can decide what happens next.

● BetaPer request + per item$0.002

Run — $0.002 How it works & API

Use it from WebAPIEmailApp soonTelegram soon

Run it online

Run this on our servers with your account. Free tools run in your browser; this one bills your KIT balance per the price above.

The question every open endpoint eventually has to answer

Any form, API or login page that's reachable from the open internet will eventually receive traffic from scripts, headless browsers and scraping tools alongside real visitors. The hard part isn't blocking the obvious bots — it's telling apart the ones that look almost human from the people who genuinely browse or type a little unusually, on a slow connection, an unfamiliar device, or through assistive technology that behaves differently from a default browser.

What the score represents

The endpoint returns a numeric score reflecting how likely the request is to be automated, based on signals available in the request itself — things like header consistency, connection characteristics and patterns associated with scripted traffic versus a typical browser session. It's a probability, not a certainty, and it's deliberately designed to feed a decision your system makes, not to be the decision entirely by itself.

Why scoring beats a binary yes or no

A flat bot-or-not answer forces you into one rigid policy for every case, but a score lets you set different thresholds for different stakes: a low-value newsletter signup can tolerate a looser threshold than a password reset or a checkout attempt. That flexibility to tune per use case is really the entire point of returning a score instead of a fixed label.

An arms race that automation made necessary

As scraping and credential-stuffing tools got better at mimicking real browser behavior over the years, simple checks like user-agent strings stopped being enough on their own, which is why scoring based on multiple request-level signals became the more durable approach — no single signal tells the whole story, but combined together they're substantially harder to fake convincingly.

Fitting it into your flow

Submit the request context, get a task_id back immediately, and receive the score through your signed webhook or a signed link valid for 24 hours, whichever fits how your system is built. Most integrations call it inline at the moment of submission and route the response into existing rate-limiting or verification logic rather than replacing that logic outright.

What you can do with it

Form spam reduction

Score contact and signup form submissions to silently drop likely-automated spam without adding a visible CAPTCHA for everyone.

Login protection

Add step-up verification only to login attempts that score as likely automated, keeping the flow frictionless for real users.

Scalper and inventory bot defense

Flag high-speed, repetitive checkout attempts that score as automated during limited-stock product launches.

Review and comment quality

Filter out likely bot-generated reviews or comments before they reach moderation queues.

FAQ

How does this bot detection api generate its score?

It evaluates signals present in the request itself, such as header and connection consistency and patterns typical of scripted traffic, and returns a numeric score reflecting how likely the request is automated.

Is a bot score the same as a CAPTCHA?

No. A CAPTCHA interrupts the user to prove they're human; this endpoint scores a request silently in the background, letting you decide whether to add friction only when the score warrants it.

What score counts as a bot?

There's no universal cutoff — the score is a probability, and the right threshold depends on how much risk a given action can tolerate, from loose for low-value forms to strict for logins or checkout.

Does it guarantee catching every bot?

No detection method catches everything; sophisticated automation that closely mimics real behavior can still score low, which is why the score is meant to complement other defenses, not replace them.

Is it free to use?

There's no free tier — free tiers get abused and slow everyone down. Access runs on a prepaid ForHosting KIT balance: top up from $10.00 (it never expires) and each request is charged at its published price, so a call with no balance returns HTTP 402. No subscription, no tokens, no invented credits, and a failed task is never charged.

Can I score requests in bulk?

Each call scores one request; for high traffic, send a request per event and let the asynchronous model handle throughput in parallel.

How quickly do I get the score?

A task_id returns immediately, and the score arrives via your signed webhook or a signed link valid for 24 hours.

Is request data kept after scoring?

No, it's deleted after the retention period and never used to train anything, and failed requests are retried up to three times and never billed.

For developers — API access

Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.

API endpoint

POSThttps://api.kit.forhosting.com/verify/bot-score

Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, and soon from our app, email and Telegram.

Call it from your stack

curl -X POST https://api.kit.forhosting.com/verify/bot-score \
  -H "Authorization: Bearer $KIT_KEY" \
  -H "Content-Type: application/json" \
  -d &#39;{"items":["valor-1","valor-2"]}'

const res = await fetch("https://api.kit.forhosting.com/verify/bot-score", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.KIT_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "items": [
      "valor-1",
      "valor-2"
    ]
  })
});
const { task_id } = await res.json();

import os, requests

res = requests.post(
    "https://api.kit.forhosting.com/verify/bot-score",
    headers={"Authorization": f"Bearer {os.environ[&#39;KIT_KEY']}"},
    json={
    "items": [
        "valor-1",
        "valor-2"
    ]
},
)
task_id = res.json()["task_id"]

<?php
$res = file_get_contents("https://api.kit.forhosting.com/verify/bot-score", false, stream_context_create([
  "http" => [
    "method"  => "POST",
    "header"  => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
    "content" => &#39;{"items":["valor-1","valor-2"]}',
  ],
]));
$task = json_decode($res, true);

body := bytes.NewBufferString(`{"items":["valor-1","valor-2"]}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/verify/bot-score", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)

Example request

{
  "items": [
    "valor-1",
    "valor-2"
  ]
}

Example response

{
  "task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
  "type": "verify.bot_score",
  "status": "queued",
  "_links": {
    "result": "/tasks/tsk_…/result"
  }
}

The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.

Pricing

Per request$0.002

Published price — no tokens, no invented credits. A failed task is never charged.

Errors

HTTP	Code	Meaning
`401`	`unauthorized`	Missing or invalid API key.
`402`	`insufficient_balance`	Your balance doesn't cover the task price.
`404`	`unknown_type`	That task type doesn't exist.
`429`	`rate_limited`	Too many requests. Use the webhook instead of polling.

Read the full KIT documentation →