# HumanProof levels of proof

> Prove, Prove+ and Attested. What each level shows about a visitor, how each raises the cost of faking a crowd, and how to set one for your site.

Source: https://docs.trustaige.com/humanproof/levels

Every HumanProof token says a person was present. Levels say how hard that
person would be to fake many times over. You choose a level for each site you
register; a token below it is refused with `below_site_policy`.

| Level | `tier` | What it shows | What it costs a bot farm |
|---|---|---|---|
| **Prove** | `prove` | A person with a passkey: someone completed a passkey ceremony on their own device. | A real device and a person to tap, for every proof. |
| **Prove+** | `prove_plus` | Plus a verified recovery contact. | Every identity costs a real inbox or phone, which makes farms expensive. |
| **Attested** | `attested` | Plus certified hardware: the passkey lives on a security key whose attestation was verified. | The hardest proof to fake at scale. |

## Choosing a level

- **Prove** for most forms and actions: sign-ups, contact forms, comments,
  downloads, text-message codes, costly actions. It stops scripts without
  asking anything more of real people.
- **Prove+** where one person pretending to be many is the threat: votes,
  likes and reviews, free trials, coupons and credits.
- **Attested** where bots compete with people for something scarce, such as
  ticket queues and limited drops, and you can expect people to hold security
  keys.

The higher the level, the fewer people can meet it. Start at **Prove** and raise
it only for the actions where fakes really cost you. [Use cases](/humanproof/use-cases)
suggests a level for each.

## Setting it

In the hub, **HumanProof → Sites**: choose the level when you register a site,
or change it on the site later. The page shows which levels are available to
your organization.