What is Proof-of-Work (PoW), and why does it make attacks and spam so costly?

The Best CAPTCHAs for WordPress in 2026: A Comparison

WordPress7 minassistouest.fr

Protect your WordPress site from spam and malicious bots with our selection of the best free, privacy-friendly and easy-to-integrate CAPTCHAs.

For a visitor who occasionally submits a form, the calculation goes unnoticed. For a bot seeking to repeat the same operation tens of thousands of times, each new attempt requires additional work, and the cumulative cost increases with the scale of the attack.

Proof-of-Work does not seek to determine whether the person in front of the screen is human. A programme is perfectly capable of solving the required calculation. Rather, the mechanism seeks to make large-scale automation less advantageous by ensuring that every action incurs an energy cost and, consequently, an economic cost.

A traditional CAPTCHA attempts to distinguish a human user from automated software. A Proof-of-Work system allows software to solve the challenge but imposes the same computational cost on it with every new attempt.

This approach works without requiring any additional interaction from the visitor. The calculation can be carried out in the background in the browser whilst the user is viewing or filling in a page. Some anti-spam systems and certain WordPress anti-bot plugins already use this principle to protect comments, logins and forms.

PoW makes it possible to verify a proof without knowing the identity of its author

One of the most interesting features of Proof of Work is that it allows us to verify that work has been carried out without needing to know the identity of the person who produced it. The system does not need to know who is behind a computer, a request or a miner in order to decide whether the proof is valid. It simply needs to verify that the result complies with the rules laid down and that it would indeed have required the expected effort to produce.

This way of operating is particularly useful in open systems where participants do not know one another and where it would be difficult to build security around their identities. A server can receive proof from a completely unknown visitor and verify it immediately, whilst a Bitcoin node can verify the work carried out by a miner without knowing who they are. Trust does not rely on a user account, an IP address or an authority responsible for identifying each participant, but on proof that any other participant can verify in the same way.

Proof of Work does not, however, prove that a person is honest, human or authorised to carry out any particular action. It proves that a certain amount of work has indeed been carried out. A bot can therefore perfectly well produce a valid proof without revealing its identity, but it cannot simply circumvent the cost involved in obtaining it. This is what makes this mechanism effective against large-scale automation, as it is not necessary to identify the attacker in order to impose a cost on them.

Proof-of-Work existed long before Bitcoin

Proof of work was not invented for Bitcoin. Its history dates back to the early 1990s, when Cynthia Dwork and Moni Naor explored the idea of requiring computational work to solve the problem of spam. Sending a single message had to be inexpensive enough for a user, but sending hundreds of thousands or millions of messages had to require a much greater amount of computing resources.

Adam Back went on to develop Hashcash in the 1990s. The system required the sender to perform a calculation before generating a token that could be quickly verified by the recipient. Hashcash was designed to limit spam and the misuse of internet resources.

Bitcoin would subsequently draw on this family of mechanisms to build its own Proof-of-Work system. The history of PoW is quite different from the picture painted by cryptocurrencies today. Systems that impose a computational cost to limit abuse existed before Bitcoin, and mining is a specific application of this that has become widely known.

PoW increases the cost whilst maintaining fast verification

Proof of Work is particularly useful when an attack costs very little to launch but forces the server to perform a great deal more work in return. A request can consume far more resources than the request to send it. As long as this difference works in the attacker’s favour, they can carry out a large number of attempts at relatively low cost.

Proof of Work helps to redress this imbalance by requiring the client to also perform a certain amount of computation before the server accepts their request. The server then receives the proof and can verify it very quickly before continuing with the processing. The main cost is therefore borne by the party sending the request, whilst verification remains a minor task for the server.

The difficulty may also vary depending on the situation. When the volume of requests increases significantly or automated behaviour is detected, the computational load required increases. The cost rises for those making repeated attempts, whilst the server continues to process requests just as quickly.

Limiting DDoS attacks by imposing a cost on each request

During a denial-of-service attack, the aim is to flood the system with requests until the available resources are exhausted. Proof of Work makes this type of attack more difficult by requiring each client to perform a calculation before the server agrees to allocate further resources to their request.

This protection is particularly useful when just a few bytes sent by an attacker are enough to trigger much more resource-intensive processing on the server side. By requiring preliminary work, each new request also places a burden on the sender’s resources. Increasing the number of connections or operations therefore becomes progressively more costly, rather than relying almost entirely on the resources of the targeted server.

The Tor network uses this principle to strengthen certain onion services against denial-of-service attacks. When the load increases significantly, clients may be required to perform more work before their request is processed. A user making just a few connections is hardly affected, whilst an infrastructure seeking to generate a large number of them must repeat the calculation for each one.

This protection is particularly suited to attacks that seek to exhaust a service’s application resources. On its own, it cannot prevent a volumetric attack that attempts to saturate the network connection, as the traffic may then block access to the server before it can even verify the proof. Proof of Work complements traditional DDoS defences rather than replacing them.

Proof of Work is not the only consensus model

Proof of Work is often compared to Proof of Stake because both mechanisms can be used to secure a blockchain and organise the validation of new blocks. However, this comparison relates only to a specific use of Proof of Work. Proof of Stake is not intended to replace the uses of PoW in combating spam, bots or certain denial-of-service attacks.

In Bitcoin, security relies in part on the physical resources expended by miners. Producing new blocks requires computing power and electricity. Attacking the network or attempting to reconstruct part of its history therefore requires the mobilisation of a significant amount of physical resources.

Proof of Stake is based on a different principle, as validators do not compete by continuously performing calculations. They lock up crypto-assets, which serve as economic collateral, and participate in the selection of participants authorised to propose or validate new blocks in accordance with the rules specific to each network.

This difference significantly reduces the amount of computation required to operate a blockchain and, consequently, its energy consumption. However, it shifts part of the security burden to other mechanisms relating to locked-up capital, penalties imposed on validators and the protocol’s governance rules.

Proof of Stake is an alternative to Proof of Work when used to build consensus on a blockchain. It does not replace the general principle of Proof of Work. A website that requires a few calculations before accepting a contact form, or a service that charges a fee for each request, needs neither tokens, nor validators, nor Proof of Stake.