If you were sent here, a site you tried to reach asked your browser to solve a small puzzle before letting you in. That was us. This page explains why we do that, what the check does, and — just as importantly — what it doesn't.
Most traffic on the web today is not people. An ever-growing share of it is bots: crawlers that ignore our rules, scrapers that copy entire sites wholesale to train commercial AI models on work they didn't make and didn't license, and crawlers that hammer small services day and night. For a big platform that is a rounding error. For small, independent, self-hosted sites like the ones behind this gate, it is a real cost — bandwidth, compute, and the time it takes to maintain something built by people, for people.
The usual answer — "prove you're human" boxes — mostly proves you are willing to be tracked by an advertising company. We didn't want to solve one problem by creating another. We also didn't want to block countries, punish people on shared connections, or lock content behind accounts you never asked for.
A proof of work: your browser does roughly a second of arithmetic — the same kind of math that secures passwords — and that's it. It's a check, not a toll: no accounts, no email addresses, no fingerprints, no third-party scripts, nothing that follows you around the web. The idea isn't ours; it descends from Anubis, and we thank them for showing the way.
Exactly one fact about you: this network address passed the check. It expires after about a month and renews quietly when you visit. Clearing the check on one 8by3 site clears it on all of them. To understand the automated traffic this check absorbs, we also keep short-lived aggregate counts of which browser identifiers and header shapes were asked to do the check — never linked to any address or person, and discarded after two weeks. If you use a feed reader or an API client, you never see the gate at all — our feeds and machine endpoints are exempt. Legitimate search crawlers (Google, Bing) are recognized by verifying their DNS and let through, so pages stay findable — and Mastodon servers fetching link previews are verified against their instance's own domain the same way. And if you are signed in to a site, it knows you already.
The check needs JavaScript, but only once — after it passes you can switch JavaScript straight back off. If it ever misbehaves, or you believe your network is being treated unfairly, tell us: security@8by3.net.
Sphinx illustration: Vecteezy.com