How the challenge works
When a browser asks for a protected page, Anubis does not answer right away. Instead it hands back a puzzle: a random number plus a difficulty setting. The browser then has to keep trying different values (a nonce - a throwaway number) until it finds one where SHA-256(challenge || nonce) produces a hash that starts with a set number of zeros - five by default. There is no shortcut; you just try numbers until one works. This is the same Hashcash trick Bitcoin mining uses, shrunk down so a real browser solves it in about a second on a laptop.
Once the browser solves it, the answer is saved as a cookie (techaro.lol-anubis-auth) that lasts roughly a week, after which it must solve a fresh puzzle. The economics are the point: a real person who visits once a week pays a one-second tax and never notices. An AI scraper hitting 10,000 pages a day has to solve thousands of puzzles, and that CPU cost piles up until scraping becomes too expensive to be worth it.
Why FOSS projects deployed it
Anubis was built after Amazon's AI crawler hammered Xe's Git server while ignoring robots.txt. Within months, projects that had been losing bandwidth (and money) to ChatGPT, Claude, and Perplexity-style crawlers turned it on. The Linux kernel mailing list archive, sourcehut, FFmpeg, Wine, GNOME's GitLab, FreeCAD, and Duke's digital archives all run it. UNESCO digital repositories run it. They share the same problem: small hosting budgets up against industrial-scale crawling that ignores every opt-out signal.
How effective is it in practice?
Its effectiveness has limits. Codeberg reported in August 2025 that "many AI scraper bots had learned how to solve the Anubis challenges." Codeberg still found it useful - it had blocked most scraping for several months - but noted the bots had adapted.
Security researcher Tavis Ormandy documented that a proof-of-work solver written in fast native code (Go, Rust, C) computes Anubis challenges far quicker than the JavaScript version that runs in a normal visitor's browser, so the per-challenge cost is lower for native solvers than for ordinary browsers.
The practical takeaway: Anubis slows high-volume crawling down, raises the operating cost, and stops the cheapest scrapers entirely. It does not stop an operator willing to build a native solver, and a headless Chromium (a real browser engine running without a visible window, with JavaScript on) completes the challenge the same way any browser does - just slower than a purpose-built binary.