CAPTCHA vs reCAPTCHA vs Cloudflare Turnstile

A CAPTCHA is a test meant to tell humans and bots apart. The name stands for "Completely Automated Public Turing test to tell Computers and Humans Apart". Over the years these tests have moved from wobbly letters to invisible risk scores — and choosing the right one makes a real difference to how many genuine people complete your form.

How every modern CAPTCHA works

Whatever the brand, the flow is the same:

1. A widget or script runs on your page and gathers signals (or shows a challenge).
2. It produces a token and puts it in a hidden field in your form.
3. Your form submits the token with the rest of the data.
4. Your server verifies the token with the provider using a secret key.
5. If verification fails, the submission is rejected.

Step 4 is the one people skip — and without it, a CAPTCHA does nothing, because bots can just post to your endpoint without loading the widget.

The options

Classic image and text CAPTCHAs

Distorted letters or "type what you see" puzzles you host yourself.

• User experience: poor; many people fail on the first try.
• Accessibility: difficult for visually impaired users unless you add an audio alternative.
• Protection: weak against modern bots, which solve text CAPTCHAs easily.

Mostly obsolete for public websites.

Google reCAPTCHA v2 ("I'm not a robot")

The familiar checkbox. Low-risk visitors pass with a click; suspicious ones get image puzzles ("select all traffic lights"). There's also an invisible variant triggered by the submit button.

• User experience: usually one click; sometimes frustrating puzzles.
• Privacy: loads Google scripts; you'll want to mention it in your privacy policy.
• Protection: solid.

Google reCAPTCHA v3 (invisible score)

No widget at all. It watches interactions on the page and returns a score from 0.0 (likely bot) to 1.0 (likely human). Your server decides the threshold — 0.5 is a common default.

• User experience: invisible.
• Trade-off: there's no fallback challenge, so a real person with a low score is simply rejected. Choose your threshold carefully and monitor it.

hCaptcha

A privacy-focused alternative to reCAPTCHA with a similar checkbox-and-puzzle model and an "enterprise" invisible mode.

• User experience: similar to reCAPTCHA v2.
• Privacy: positioned as more privacy-friendly.

Cloudflare Turnstile

Cloudflare's CAPTCHA replacement. It runs small, non-interactive browser challenges and usually shows nothing more than a brief "Verifying…" or a single click. It's free and doesn't require your site to use Cloudflare.

• User experience: usually invisible or one click, no image puzzles.
• Privacy: designed not to rely on tracking cookies for ads.
• Protection: strong for typical form spam.

Comparison

	Classic	reCAPTCHA v2	reCAPTCHA v3	hCaptcha	Turnstile
Visible to users	Always	Checkbox, sometimes puzzles	No	Checkbox, sometimes puzzles	Rarely
Image puzzles	Text puzzles	Sometimes	Never	Sometimes	Never
Result	Pass/fail	Pass/fail	Score 0.0–1.0	Pass/fail	Pass/fail
Cost	Free (self-hosted)	Free tier	Free tier	Free tier	Free
Accessibility	Weak	Audio option	Good (invisible)	Audio option	Good

Do you even need one?

Often, no — at least not at first. Invisible defences stop most form spam without any friction:

• A honeypot field bots fill in but people never see.
• Server-side spam filtering and duplicate detection.
• Rate limiting per visitor.
• Domain restrictions so only your site can submit.

Start there, watch your spam for a couple of weeks, and add a CAPTCHA only if spam still gets through. More in How to Protect HTML Forms From Spam.

Our recommendation

1. Most sites: honeypot + server filtering. No CAPTCHA.
2. If spam persists: Cloudflare Turnstile — lowest friction, free, no puzzles.
3. If you already use Google services and want invisible protection: reCAPTCHA v3, with a sensible threshold.
4. If you want a familiar visible check: reCAPTCHA v2 or hCaptcha.

Using them with Formclick

On paid plans, Formclick supports Google reCAPTCHA v2, reCAPTCHA v3 and Cloudflare Turnstile. You add the provider's widget (or the v3 site key) to your form, choose the provider in your form's Settings → Security and paste your secret key — Formclick then verifies every token on the server. For reCAPTCHA v3 you can set the minimum score.

Every plan already includes spam filtering, a honeypot field, duplicate detection and rate limiting. Step-by-step setup: How to Add Cloudflare Turnstile to HTML Forms.