Bot protection glossary
The words that come up as soon as you protect a form or a login against bots, each defined in one or two sentences.
Automated abuse
The use of a site by programs, in series, for purposes the site does not accept: sending spam through its forms, creating fake accounts, trying passwords on its login page.
Antisy targets its forms, sign-ups and logins. It is neither a firewall nor an e-mail filter.
Anti-spam
What stops spam from getting through. For a form, a check that refuses automated submissions before they are recorded; for a mailbox, a filter that sorts the mail received.
Antisy is spam protection for forms, not an e-mail filter.
Malicious bot
A bot that uses a site against the interest of its publisher or its users: it sends spam through the forms, creates fake accounts or tries passwords on the login page.
See: Glossary: bot · Bot detection: telling a bot from a human
Credential stuffing
An attack that tries, in bulk, on the login page of a site, pairs of usernames and passwords stolen elsewhere. It exploits the habit of reusing the same credentials from one service to another.
Background computation
A short computation that the browser runs without showing anything while the visitor fills in the form. A device too slow to finish it in time is refused; a new attempt draws a new computation.
CAPTCHA
A test that asks the visitor to prove they are human: ticking a box, recognising images, solving a puzzle.
Antisy shows none.
Invisible CAPTCHA
A bot check that shows the visitor nothing: it decides from measurements of the browser rather than from a test to solve.
Antisy is of this family: no box to tick, no puzzle. The browser only does a short computation in the background.
Site key and secret
The two keys of an integration. The site key (32 characters) is public: it goes in the page. The verification secret (64 characters) stays on your server and is shown only once, when it is created.
CSP (Content Security Policy)
An HTTP header by which a site tells the browser where it may load scripts from and where it may send requests to.
A strict policy must allow https://api.antisy.com in script-src and connect-src, and 'wasm-unsafe-eval' in script-src.
Fake account
An account created by a program, often in series, on the sign-up form of a site.
See: Fake accounts and sign-up abuse · Use case: protecting a sign-up
False positive
A real visitor wrongly refused by a bot check.
The Strict mode accepts more of them: it refuses earlier, at the risk of inconveniencing a few real visitors. The Permissive mode makes the opposite choice.
Brute force (attack)
An attack that tries, on the same account, a large number of passwords until it finds the right one. It goes through a program, at a pace no person could keep up.
Honeypot
A trap for programs: a form field that the layout hides from the visitor, which a person therefore leaves empty and which a program that fills in every field completes. A submission where this field is filled in is recognised as automated. In IT security, the word more broadly means a decoy system, with no legitimate use.
Token
A short, opaque string that the script produces at the moment of submission. With Antisy, the script puts it in the hidden field antisy-token of the form; it is valid for 60 seconds and can be verified only once.
Verification mode
How readily Antisy refuses a doubtful visitor, set site by site on the dashboard (in French): Strict, Balanced (the default) or Permissive.
FADP (Federal Act on Data Protection)
The Swiss Federal Act of 25 September 2020 on Data Protection, abbreviated FADP in the Classified Compilation of Federal Legislation (SR 235.1) and commonly called the « revised FADP », in force since 1 September 2023. It has the purpose of protecting the personality and fundamental rights of natural persons whose personal data is processed (art. 1). English is not an official language of the Confederation: the English text of the act on Fedlex is a translation without legal force.
Antisy sets out on one page the sharing of roles that this act provides for between your site and Antisy.
See: The FADP and Antisy: who is the controller, who is the processor
Source, read on : Fedlex, « Federal Act on Data Protection (Data Protection Act, FADP) of 25 September 2020 », SR 235.1, English translation without legal force
Account takeover
The taking over of a user’s account by a third party, most often with stolen or guessed credentials. Credential stuffing, brute force and password spraying are its automated routes.
Password spraying
An attack that tries a few very common passwords on a large number of accounts, rather than many passwords on a single one: each account receives only a few attempts.
Controller
A private person who or federal body which, alone or jointly with others, determines the purpose and the means of processing personal data (FADP art. 5, letter j).
For the visitors of your forms, it is your site, not Antisy.
See: The FADP and Antisy: who is the controller, who is the processor
Source, read on : Fedlex, « Federal Act on Data Protection (Data Protection Act, FADP) of 25 September 2020 », SR 235.1, English translation without legal force
Bot
A program that sends requests to a site in place of a person. Some are useful, such as the crawlers of search engines; others fill in forms, try passwords or create accounts in series.
Processor
A private person or federal body that processes personal data on behalf of the controller (FADP art. 5, letter k). Processing by a processor requires that a contract or the legislation provide for it (art. 9, para. 1).
For your visitors, your site remains the controller; Antisy acts as processor, under contract.
See: The FADP and Antisy: who is the controller, who is the processor
Source, read on : Fedlex, « Federal Act on Data Protection (Data Protection Act, FADP) of 25 September 2020 », SR 235.1, English translation without legal force
Form spam
Unwanted messages sent by a program through a contact, comment or newsletter sign-up form. The word « spam » also means unwanted e-mail, which the mailbox sorts, not a form check.
Verdict
Antisy’s answer to the verification of a token: allow, the visitor passes, or deny, they do not. There are only these two outcomes, and the answer never gives the reason.
To see how these notions appear in the other services, read the comparison of Antisy with reCAPTCHA, Cloudflare Turnstile, hCaptcha and Friendly Captcha.