verifyngo

verifyngo is a reverse-proxy bot filter written in Go. It runs as an HTTP server in front of your upstream service, intercepts every incoming request, and decides whether to pass it through immediately or stop it and serve a CAPTCHA challenge page. When a visitor solves the challenge, verifyngo sets a verified cookie and proxies them through to your app. None of this requires any changes to your application code — verifyngo works entirely at the network layer.

​

How it works

When a request arrives at verifyngo, it goes through a short decision pipeline before it ever reaches your upstream:

1. Whitelist and cookie check. If the request comes from a whitelisted IP or carries a valid verified cookie from a previous solve, verifyngo proxies it straight through — no challenge shown.
2. Rules check. verifyngo evaluates your configured traffic rules against the request. Rules can match on IP address, path, user-agent, and other attributes, and each rule maps to an action such as allow, block, or challenge.
3. Challenge page. If the matched action is challenge, verifyngo stops the request and serves a CAPTCHA page in the browser. The page asks the visitor to complete a puzzle from your configured provider.
4. Solve and verify. Once the visitor submits their response, verifyngo validates it with the CAPTCHA provider’s API. On success, it sets a signed, time-limited verified cookie in the browser.
5. Proxy to upstream. With the verified cookie in place, verifyngo replays the original request to your upstream service and streams the response back to the visitor.

​

CAPTCHA providers

verifyngo supports three CAPTCHA providers. You can configure more than one, which lets visitors switch to an alternative provider if a particular one fails or is blocked for them.

• Cap is a self-hosted, open-source CAPTCHA — the most privacy-preserving option because no data leaves your own infrastructure.
• Cloudflare Turnstile is a managed, low-friction challenge that is invisible to most real users while still blocking automated traffic.
• hCaptcha is a managed CAPTCHA service with a strong privacy focus and a broad range of puzzle styles.

​

Rules and policy

You have three ways to tell verifyngo which traffic to challenge, allow, or block:

• Inline JSON rules live directly inside config.json — convenient for small rule sets you want to keep in one place.
• A plain-text rules file lets you maintain a list of IP addresses or CIDR ranges in a separate file, which verifyngo reloads without a restart.
• A YAML policy file gives you the most expressive option: named rules with multi-field conditions, priority ordering, and comments, all in a readable format.

​

What happens to bots

Real bots typically do not interact with CAPTCHA pages — they hit your endpoints repeatedly without ever solving a challenge. verifyngo tracks this behaviour with a walk-away counter. Each time a visitor hits a challenge-protected path without a valid verified cookie, their counter increments. Once the counter crosses your configured threshold, verifyngo temporarily bans that IP address and refuses further requests from it until the ban window expires. If you have an AbuseIPDB API key configured, verifyngo can automatically report the banned IP to AbuseIPDB so the wider community benefits from the signal too.

​

Next steps