Free tiers give you a toggle. Enterprise gives you a score and an annual contract. If you need the score and not the contract, this is the gap.
Most small sites do not need to pay for bot protection. If you have a brochure site with a contact form, a free challenge plus a rate limit handles it. You start needing per-request scoring when something specific is at stake — a checkout, a login, content worth scraping, or a form that keeps filling up with junk. Below that line, spend the money elsewhere.
Full vendor-by-vendor figures are on what bot protection costs.
| What you need | What it costs | What you get |
|---|---|---|
| Stop form spam | $0 | A CAPTCHA or proof-of-work challenge. Solved — do not pay for this. |
| Whole-site bot filtering | $20–$250/mo | Bundled with a CDN or WAF plan, per zone. A category toggle, no per-request score. |
| Per-request scoring you can act on | $3,000–$5,000/mo | Enterprise vendors, annual contract, sales process. This is the jump that has no middle. |
| Per-request scoring, self-serve | $50/mo flat | ZeroBot. One API call from your code, free tier, no contract, no DNS change. |
That third row is not an exaggeration or a straw man — it is the published entry price of the specialist vendors, and the two bands above it are where nearly the whole market sits. A site doing real business online but nowhere near enterprise scale falls straight through the middle.
The most expensive one, and it scales with your payment gateway rather than your traffic. Every failed authorisation is a fee, and a burst of them can also put your merchant account under review. If you take payments, this is the reason to care.
If you publish anything someone else wants — prices, listings, articles — it will be copied. The cost is bandwidth plus the compounding loss of being outranked on your own work.
Free to solve, so solve it free. The reason it still costs small businesses money is that the solution usually chosen is a CAPTCHA that taxes every real customer instead.
Matters if you run a free tier, a referral scheme or anything with a per-account limit. The cost is support load and inflated numbers that make every other decision worse.
A published price. If you cannot find out what a tool costs before talking to a salesperson, you are not the customer it was designed for.
No annual commitment. At small scale the risk of choosing wrong is higher than the saving from committing. A month-to-month product lets you be wrong cheaply.
Fail-open by default. A detection service that is down should not become an outage. Ask what happens when it is unreachable, and prefer the vendor whose default is to let traffic through and log it.
Visible reasons. You need to see why a specific visitor was blocked, because that is the only way you can find the real customer you accidentally turned away.
ZeroBot is $50/month flat with a free tier: one API call from your own code, or a WordPress plugin, with the verdict and the signals behind it returned to you. No DNS change and no contract, so the cost of trying it is an afternoon.
Often not. If your site is a brochure with a contact form, a free CAPTCHA or a honeypot plus a rate limit is usually enough, and both are free. Worth paying attention when you have something specific: a checkout, a login, content worth scraping, or a form that keeps getting spammed.
It depends what you are stopping. Contact form spam is largely solved free by a CAPTCHA or proof-of-work challenge. Scraping and account abuse need per-request scoring, and that is where the market jumps: free tiers give you a toggle, and the next tier that gives you a real decision starts in the thousands per month.
Because the vendors selling per-request scoring sell annual contracts to large customers, and the vendors who self-serve bundle bot protection into a CDN or WAF plan as a feature. A small site needing a score it can act on falls between the two, which is the gap ZeroBot was built for.
That is the risk that matters, and the honest answer is that any detection product can. Two things reduce it: treating signals like VPN or residential origin as points on a score rather than a verdict, and being able to read why a specific visitor was blocked so you can review and whitelist. If a vendor cannot show you the reasons behind a verdict, you cannot audit their false positives — or your own.
ZeroBot is one API call from your own code, or a plugin on WordPress. No DNS change, no proxy in front of your traffic, and no annual commitment — which also means leaving costs you one snippet rather than a contract.
$50/mo flat when you do, no card to begin.
Get started free →