Progressive challenges that escalate based on response — let humans prove themselves, trip up bots. The goal isn't to block everyone suspicious. It's to create asymmetric friction.
3
Challenge Levels
5-Level
Escalation Path
0
Backend Required
Async
Friction Model
Challenge Escalation FlowIncoming suspicious request · Risk 40–70 · Not block, not allow
L1
EASY
Cookie Challenge
Set-Cookie header · Check if client returns it
CATCHES: curl, wget, simple scripts — anything that ignores cookies
CATCHES: sophisticated automation — the last gate before enforcement
✓ PASS → Allow
✗ FAIL → Block + Tarpit
Risk −25 on pass (verified human)
BLK
BLOCK + TARPIT
All challenges failed. Connection held open with artificial delays (1–30s). Each failed challenge adds +20 risk. Retry window shrinks progressively. Attack becomes economically unviable.
Tarpit System
After all challenges fail: asymmetric resource drain
Resource Drain
Connection held open 1–30 seconds. Attackers must wait, consuming their resources — not ours.
Progressive Delay
Each subsequent attempt from the same actor gets a longer delay. Retry windows shrink exponentially.
Economic Impact
Attack becomes economically unviable. Their time and infrastructure are wasted. Attackers move on to easier targets.
Most users never see Level 2 or 3. Friction is minimal — cookie set/return is invisible to the user. Risk reduction: −10 to −25 points based on level passed.