reCAPTCHA alternatives for website forms

Cloudflare Turnstile is the closest swap for reCAPTCHA: it is mostly invisible, uses the same site key and secret key pattern, and its server check takes the same parameters. hCaptcha suits sites that want image challenges from someone other than Google, and proof-of-work tools such as ALTCHA run with no third party at all. For many contact forms, a honeypot, content scoring and a rate limit make a captcha unnecessary.

Why people move off reCAPTCHA

reCAPTCHA still works. The reasons to replace it are usually about cost to visitors and to you. Version 2 shows image puzzles to some visitors, which is slow on phones and hard for people using screen readers. Version 3 is invisible but returns a score you must threshold yourself, with no challenge to fall back on. And reCAPTCHA is now a Google Cloud product: Google's billing docs list a free allowance of 10,000 assessments a month, with paid tiers above it.

Some teams also want fewer third-party scripts on their pages. Whether that matters for your privacy obligations is a question for your own legal review; this page only compares how the tools work.

The alternatives compared

Every option except the last still depends on a server-side check. A widget on its own stops nothing, because a bot can post to your endpoint without loading the page.

What each option asks of people

Judge every option by the visitor who has the hardest time with it. Image puzzles are slow on a phone and hard or impossible for someone who can't see them well; audio fallbacks help some people and frustrate others. Invisible checks, like Turnstile's usual mode, reCAPTCHA v3 and proof-of-work widgets, ask nothing of most visitors, but they can still fail for people on privacy-focused browsers, strict networks or old devices. When that happens, the person needs a way forward: a visible checkbox, a clear message, or an email address to write to instead. A form that fails silently loses exactly the messages you never hear about.

Choose in two questions

Switch from reCAPTCHA to Turnstile

The two are close enough that the switch is a few lines on each side. Create a Turnstile widget in the Cloudflare dashboard for the same hostnames, then change the markup and the server check together.

<form action="/api/contact" method="POST">
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>
  <div class="g-recaptcha" data-sitekey="RECAPTCHA_SITE_KEY"></div>
  <button>Send</button>
</form>
<script src="https://www.google.com/recaptcha/api.js" async defer></script>

const form = await request.formData();
const body = new URLSearchParams({
  secret: process.env.RECAPTCHA_SECRET_KEY!,
  response: String(form.get("g-recaptcha-response") ?? ""),
});
const check = await fetch("https://www.google.com/recaptcha/api/siteverify", { method: "POST", body });
const { success } = (await check.json()) as { success: boolean };

• This covers classic reCAPTCHA keys, verified at siteverify. Keys created in Google Cloud are checked through the reCAPTCHA Enterprise assessments API instead; the Turnstile side is the same.
• If you used v3, remove your score threshold. Turnstile answers pass or fail; check action in its answer instead.
• Update your Content Security Policy: allow https://challenges.cloudflare.com in script-src and frame-src, and drop the Google entries once nothing uses them.
• Ship the markup and the server change in one deploy. A page with the new widget posting to a server that still expects g-recaptcha-response fails every submission.

Replacing reCAPTCHA with Ikiform

If your form posts to Ikiform, remove the reCAPTCHA widget entirely. Ikiform doesn't verify reCAPTCHA or hCaptcha tokens. The leftover g-recaptcha-response value would arrive as an extra field, or fail with 422 validation_failed as an unknown field if you defined the form's fields. Then pick what replaces it:

• Nothing extra. The honeypot, content scoring and rate limits run on every form. Many contact forms need no more.
• Spam check set to Ikiform. Cloudflare Turnstile, run by Ikiform, with no account or keys. A plain HTML post gets a short check page; fetch code calls challenge() from @ikiform/sdk.
• Your own Turnstile keys. Keep your own widget on the page, paste the keys into the form's settings, and Ikiform verifies the token.

<form action="https://ikiform.com/f/frm_xxxxxxxxxxxxxxxx" method="POST">
  <input name="email" type="email" required />
  <textarea name="message" required></textarea>
  <input name="_gotcha" type="text" tabindex="-1" autocomplete="off" hidden />
  <button>Send</button>
</form>

That form has no widget at all. With Spam check set to Ikiform, the human check happens on ikiform.com after the post, so your page loads no captcha script. The spam docs cover each mode.

Check it works

1. Submit the form after the switch. The post is accepted and you saw at most a checkbox.
2. Post to the endpoint with curl and no token. It is refused, which proves the server checks the new token.
3. Search your pages for g-recaptcha and recaptcha/api.js. Nothing is left.
4. Open Submissions in the dashboard. The new submission is there with every field you sent.
5. Nothing arrived? Switch the dashboard's status filter to Spam. Spam gets the same success answer as a real submission.

Gotchas

• Builder settings. Site builders with a built-in reCAPTCHA setting may require the element on every form while it is on. Turn the setting off before you remove the elements.
• Cached pages. Visitors with an old cached page still send g-recaptcha-response for a while after you deploy. Expect a few failures, or accept both tokens for a day.
• v3 scores in reports. If dashboards or alerts read the reCAPTCHA score, they go quiet after the switch. Update them.

Questions