Protect a login page from credential stuffing and automated account takeover
Credential stuffing tries, in bulk, on your login page, passwords stolen elsewhere; brute force tries a great many on a single account. Antisy checks that each attempt comes from a browser and not from a program, without showing anything to the person signing in.
What is credential stuffing?
An attack that exploits the habit of reusing the same usernames and passwords from one service to the next: a program tries, in bulk, on your login page, pairs stolen elsewhere.
And brute force, password spraying?
Brute force tries a great many passwords on a single account; password spraying tries a few very common passwords on many accounts. Like credential stuffing, they aim at account takeover and go through programs: each attempt must come from a browser, and that is what Antisy checks.
See: Glossary: brute force · Glossary: password spraying · Glossary: account takeover
How does Antisy protect a login from account takeover?
The login page carries Antisy’s tag, and a token goes with each attempt. Your server then makes a call, assess, which ties the token to the account targeted. The answer has two outcomes: allow or deny.
The siteverify call of simple forms does not tie the token to an account: it does not suit a login.
Which data is processed?
What the script measures for any form, and what the table of retention periods names for a login: a login identifier, encrypted and hashed, and the outcome of the attempt, deleted after 90 days.
Is it available today?
Not yet. The Node server kit (Express, Fastify, Next.js) that makes this call will be published on npm; it is not yet.
Access is by waiting list. The API and the dashboard (in French) have been in service since 27 October 2026, hosted at Infomaniak in Geneva; no customer is in production yet. A pilot is planned; it has not started.
See: The pilot · Join the waiting list
What a bot check does not replace
No bot check is perfect, and Antisy announces no detection rate. It adds to the other defences of an account, such as limiting attempts or a second factor; it does not replace them.