Bot Detection, Fraud Scoring and CAPTCHA Platform Engineering
AppWT builds and tests software that tells real people from automated traffic. The work covers weighted bot and fraud scoring, CAPTCHA and human-verification features, widget origin checks, and the tests that prove a real visitor still gets through.
Engineering inside a verification product team
AppWT has active engineering work in bot mitigation and CAPTCHA replacement software under a mutual non-disclosure agreement, so the client is not named. AppWT engineers work inside the client's product team, on the client's own infrastructure. The product belongs to the client.
The work covers these areas:
- Product and AI features for privacy-first human verification and bot detection
- Test suites wired into CI/CD, so each change is tested before it ships
- Accessibility (WCAG) for challenge widgets
- Handling of legitimate AI browser agents, with multi-factor step-up
- Usage-tier pricing logic, dashboards and analytics
- SPF, DKIM and DMARC email deliverability
Weighted bot and fraud scoring
AppWT builds scoring systems that separate real visitors from automated ones with weighted rules instead of flat counts. A rule that fires on everyone cannot tell a person from a bot, so it is removed rather than reweighted.
- Server-side crawler checks. Headless browsers and fake crawlers are checked on the server against a maintained crawler-detection library, so a bot cannot simply declare itself human.
- Browser signals. A browser-side check adds signals such as the headless flag, plugin count, browser time zone against IP time zone, and hour of day.
- CAPTCHA solve behavior. The engine reads solve time and whether the challenge was solved before it was fully in view.
- Clear bands. Scores normalize to a 1 to 10 scale in low, medium and high bands, and the step-up threshold is guarded against missing or negative values.
- Proof on the deployed code. A known-good visitor is measured before and after each change, and a real browser re-runs every rule against the deployed code.
The Weighted Bot and Fraud Scoring Engine starts at $4,997.
Embedded widget origin enforcement
An embedded widget runs only on domains you approve and refuses everywhere else. Refusal is the default, so a misconfiguration blocks rather than exposes. AppWT tests one approved and one unapproved domain with the same key.
Embedded Widget Origin Enforcement starts at $997.
Bot defense on the sites AppWT hosts
Every 2 minutes, an automated check reads each hosted site's recent HTTPS access log and blocks, at the server firewall for one hour, any single address that floods a site. It does not stop a flood spread across many addresses.
Every minute, a second check counts checkout submissions from each address on the hosted online stores it is set up for, one Magento store and three WooCommerce stores today. An address over its store's limit is blocked at the firewall after AppWT's rules confirm it is not a real buyer.
Questions buyers ask
Does AppWT work on bot detection or CAPTCHA software?
Yes. AppWT has active engineering work in bot mitigation and CAPTCHA replacement software under a mutual non-disclosure agreement, so the client cannot be named. AppWT engineers work inside the client's product team on human verification, bot detection, CI/CD test suites, WCAG accessibility for challenge widgets and handling of legitimate AI browser agents.
Why does AppWT not name its bot detection client?
The work is covered by a mutual non-disclosure agreement. The missing name is a contract term, not a missing project, and the product belongs to the client.
Can AppWT add bot and fraud scoring to our site or app?
Yes. AppWT builds weighted bot and fraud scoring with server-side crawler checks, browser signals and CAPTCHA solve timing, scored from 1 to 10 in low, medium and high bands. The Weighted Bot and Fraud Scoring Engine starts at $4,997.
Will bot blocking stop real customers?
AppWT measures a known-good visitor before and after each change, so a change that blocks real people shows up in the test. Rules that fire on everyone are removed, because they cannot tell a person from a bot.
Does AppWT block bots on the sites it hosts?
Yes. Every 2 minutes a check blocks any single address that floods a hosted site for one hour, and a per-minute checkout check runs on the hosted stores it is set up for. The flood check does not stop a flood spread across many addresses, and the AppWT Trust Center says so.
Start with the traffic you see today
Bring your current bot rules, the false blocks you know about and where checkouts or sign-ups are abused. The scoping call covers scope, pricing, timeline and a written quote, with no commitment.
AppWT Web & AI Solutions (AppWT LLC). 29+ years of practice. Operating as AppWT since 2005, and formed in Michigan as AppWT LLC in 2020. BBB A+ accredited since 2022. Calls, texts and email are answered 24 hours a day, every day of the year.
