Use an invisible bot check such as Cloudflare Turnstile. This is additional hardening rather than a baseline - if you already have rate limiting plus authentication and you are not facing targeted attacks, you can reasonably skip it. It earns its place on admin dashboards, access-code forms and high-value endpoints.
The gap it closes. Your login form can be hit directly by a script: someone writes Python or uses curl to POST thousands of attempts, never opening a browser, never seeing your UI. Rate limiting helps, but a patient attacker can slow down to stay under your limit and still brute-force their way in over time. And browser-based protections like a Browser Integrity Check do not help at all here, because the attacker is not using a browser.
How it works, and why users never notice. When your page loads, the provider's script silently checks whether the visitor is a real browser - JavaScript execution, browser APIs, mouse behaviour, dozens of signals - and issues a one-time cryptographic token. Your frontend sends that token with the form data, and your server calls the verification API to confirm it before processing anything. Real users just fill in the form and click submit, exactly as before. No puzzle, no "I am not a robot".
The key property: a script running curl or Python cannot generate a valid token, because it is not a real browser. So the server rejects the request before it ever looks at the password or access code - your actual auth logic and IP blocking are never even reached. The attacker just gets a verification failure.
Full item with the widget setup and server-side verification: https://www.tigzig.com/security/frontend.
← All Agents FAQ