an (better!) alternative to anubis

so the main problem with anubis is that on slower devices, a challenge level high enough to be effective at stopping bots can take upwards of 30-40s to solve. which is quite bad.

and anubis still isn't able to defeat all bots, for a server will generally have a lot of compute available.

my solution to this is pretty simple. instead of a PoW challenge, just have the user type submit a HTML form. these crawlers don't interact with forms, so they will never be able to bypass it. and pressing a button is something anyone can do. as a bonus, this doesn't even need JS.

demo for caddy:

@is_verified header_regexp Cookie "(^|;\s*)__verified=true"
@is_googlebot {
    header User-Agent *Googlebot*
    client_ip 66.249.64.0/19 # etc...
}
@verification {
    path /__verify
    query a=on
    not query b=on
}
handle @verification {
    header Set-Cookie "__verified=true;Path=/;Max-Age=2592000;HttpOnly;SameSite=Lax"
    @has_redir {
        query r=/*
        not query r=//*
        not query r=/\*
    }
    redir @has_redir {http.request.uri.query.r} 302
    redir / 302
}
handle /__verify { respond "Verification failed. Wrong boxes were checked" 403 }
@unverified {
    not @is_verified
    not @is_googlebot
    not path /__verify*
}
handle @unverified {
    header Content-Type "text/html;charset=utf-8"
    respond `<h1>Human verification</h1>
<form method=GET action=/__verify>
    <input type=hidden name=r value="{uri}">
    <label><b>DO</b> check this box <input type=checkbox name=a></label>
    <label><b>DON'T</b> check this box <input type=checkbox name=b checked></label>
    <button type=submit>Verify</button>
</form>` 200
}