Cloudflare Turnstile vs reCAPTCHA vs hCaptcha in 2026
Cloudflare Turnstile is free at any volume with no puzzles; reCAPTCHA gives a tunable score but is free only up to 10,000 checks a month, after which its classic check can pass every bot; hCaptcha leads on privacy compliance, with its low-friction mode on the $99 Pro plan.
Key takeaways
- reCAPTCHA now runs through Google Cloud. The free Essentials tier covers 10,000 assessments a month; Standard is $8 a month up to 100,000.
- Over the free quota without billing, reCAPTCHA’s SiteVerify check fails open: it returns success with a score of 0.9, so bots can look human.
- Cloudflare Turnstile is free with unlimited challenges, shows no image puzzles and does not require Cloudflare DNS.
- hCaptcha’s Basic plan is free; Pro is $99 a month on yearly billing with 100,000 evaluations and a 99.9% passive mode.
- No CAPTCHA stops every bot. Pair it with server-side verification, rate limits and email verification before granting anything costly.
Why does a small SaaS need bot protection?
Bots find a public form within days of launch. On a contact form that means spam. On a signup form with a free tier it means fake accounts that burn your free credits, your transactional email quota and — if your product calls an LLM — real money per request.
Bot protection puts a check between the form and your server. A small script in the browser collects signals, the provider decides whether the visitor looks human, and your server verifies the resulting token before doing anything costly. The three tools here all work that way; they differ in what they ask of the user, what they learn about them, and what they charge.
Keep free tiers for real users
Scripted signups that claim free credits cost you compute, email sends and API calls. A check at signup stops most of them before they exist.
Protect your email reputation
Fake signups with real victims' addresses trigger confirmation emails those people never asked for. Enough complaints and your domain lands in spam folders.
Slow down credential stuffing
Login forms see lists of leaked passwords replayed at scale. A challenge on repeated failures makes that expensive for the attacker.
Stop card testing
Checkout forms get used to test stolen cards in small amounts. The disputes and processor fees land on you, and so can a payment-account review.
What it does not do: no CAPTCHA stops a determined attacker. Solver services and browser-automation agents get through some share of challenges. Bot protection raises the cost of abuse; it does not replace rate limits, email verification, or limits on what a brand-new account can do.
Do you need this yet? If your form only sends you an email, a hidden honeypot field and a rate limit may be enough for a while. Add real bot protection the day a signup triggers something that costs money — free credits, an LLM call, an SMS, a trial server — or the first time you see a spike of signups that never log in again.
Quick Verdict
Cloudflare TurnstileFree with unlimited challenges, no image puzzles, and no need to use any other Cloudflare service. Returns pass or fail rather than a score.
The most widely deployed, and the only one here that gives every plan a 0–1 risk score you can tune. Now a Google Cloud product with a 10,000-a-month free tier.
Privacy-first challenges with a free Basic plan, a 99.9% passive mode on Pro, and compliance claims covering GDPR, CCPA, LGPD and PIPL.
TL;DR
No single winner — pick on your constraint. Free at any volume with no puzzles → Turnstile. A risk score you tune per action, inside Google Cloud → reCAPTCHA (and turn billing on). Privacy compliance and an adjustable challenge → hCaptcha. Abuse that comes through your API rather than a form → look at Arcjet below.
What happens when reCAPTCHA goes over 10,000 checks?
Google moved every classic reCAPTCHA key into Google Cloud. Its migration guide sets the schedule as automated migration starting in Q4 2025 and completing in Q1 2026, so if you set up reCAPTCHA years ago and never touched it, your key is now a Google Cloud key with a free tier of 10,000 assessments a month.
That is roughly 330 checks a day. A modest SaaS with a protected signup, login and contact form can pass it. What happens next depends on which API your server calls.
SiteVerify — fails open
The classic verification endpoint most tutorials use. Google's docs: over-quota requests "return success:true with a score of 0.9, and the API response will include an error message indicating that you exceeded the quota." If your code only checks success and score, every bot now looks human.
CreateAssessment — fails closed
The newer Google Cloud API. Over-quota requests return a 429 Resource Exhausted error and no assessment. If your code treats an error as "block", real users get locked out until next month; if it treats it as "allow", you are back to failing open.
If you stay on reCAPTCHA: enable billing on the Google Cloud project (Standard is $8 a month up to 100,000), make sure the over-quota emails reach someone, and add a check for the quota error field in your verification code. A score of exactly 0.9 alongside an error is not a human.
How do Turnstile, reCAPTCHA and hCaptcha compare?
Plans and limits as published by each vendor in October 2026. All three use the same integration shape — a browser widget that issues a token and a server call that verifies it — so switching is mostly a matter of keys and URLs.
Cloudflare Turnstile
Free, puzzle-free challenges
$0, unlimited challenges
Enterprise: contact sales
- Free: unlimited challenges, up to 20 widgets per account
- Up to 10 hostnames per widget on free, 200 on Enterprise
- Pre-clearance on free; ephemeral IDs on Enterprise
- Works without Cloudflare DNS or any other Cloudflare service
- WCAG 2.2 AAA conformance listed on both plans
- Remove Cloudflare branding on Enterprise only
- CaveatIt returns pass or fail, not a risk score, so you cannot tune a threshold per action. Analytics look back only 7 days on the free plan.
Best for: Most startups: signup, login and contact forms at any volume, with no bill and no puzzles.
reCAPTCHA
Google’s risk scoring, now in Google Cloud
$0 up to 10K/mo
Standard $8/mo up to 100K; Enterprise $1 per 1,000
- Essentials: 10,000 assessments a month free
- Standard: $8 a month for up to 100,000 assessments
- Enterprise: $1 per 1,000 on a fixed monthly commitment, 12-month minimum
- v3 returns a 0.0–1.0 score per action; v2 offers the checkbox
- Requires a Google Cloud project; billing needed above the free tier
- CaveatOver quota, SiteVerify fails open with a score of 0.9. Also loads Google scripts on your page, which matters for privacy reviews and cookie-consent banners in the EU.
Best for: Teams already on Google Cloud who want a score to tune per action — and who will switch billing on.
hCaptcha
Privacy-first, challenge-based
$0 Basic
Pro $99/mo yearly ($139 monthly), 100K evals included
- Basic: free bot protection, works in every country
- Pro: 99.9% passive mode, custom themes, analytics
- Pro overage: $0.99 per 1,000 evaluations past 100K
- Enterprise: risk scores, no-CAPTCHA passive mode, SSO, SLAs
- Lists GDPR, CCPA, LGPD and PIPL compliance
- 14-day free trial of Pro
- CaveatThe free Basic plan shows visual challenges more often than the other two; the low-friction passive mode is a paid feature. Risk scores are Enterprise-only.
Best for: Products with strict privacy requirements, or teams who want challenges they can tune harder or softer.
How much does each CAPTCHA cost?
A check is one verification: one signup, one login attempt, one form post. List prices, October 2026.
| Monthly volume | Cloudflare Turnstile | ||
|---|---|---|---|
| 5,000 checks/mo | $0 | $0 (Essentials) | $0 (Basic) |
| 50,000 checks/mo | $0 | $8 (Standard) | $0 Basic, or $99 for passive mode |
| 500,000 checks/mo | $0 | ~$500 (Enterprise, 12-mo commitment) | $0 Basic, or ~$495 on Pro |
How we got these: reCAPTCHA past 100,000 moves you to Enterprise pricing at $1 per 1,000 on a 12-month commitment, so 500,000 is about $500 a month. hCaptcha Pro at 500,000 is $99 plus 400,000 × $0.99 per 1,000, about $495 on yearly billing; the free Basic plan still works at that volume, with more visible challenges. Cutting checks to the actions that matter — signup and repeated failed logins, not every page — lowers all three.
Feature comparison
Cloudflare TurnstileChallengers worth knowing
Not all abuse comes through a form a person fills in.
A security SDK that runs in your server code instead of a widget in the browser: rate limiting, a Shield WAF, and protection for AI-agent endpoints. Free for 10,000 requests a month, then $25 a month plus $5 per million web requests. A layer behind a CAPTCHA, or instead of one for APIs.
Proof-of-work CAPTCHAs
Friendly Captcha and the open-source ALTCHA make the visitor's browser solve a small computation instead of a puzzle, with no tracking. Popular with EU teams that want to avoid a cookie-consent question entirely.
Which one should you pick?
You want it free, at any volume, with no puzzles
Cloudflare Turnstile. Unlimited challenges, no Cloudflare DNS needed, and users rarely see anything. Accept that you get pass or fail, not a score.
Cloudflare TurnstileYou want a score per action and already run on Google Cloud
reCAPTCHA. Use different thresholds for signup, login and checkout, and step up to a second factor on low scores. Turn billing on and handle the over-quota error before you rely on it.
Privacy review or regulation is your hardest constraint
hCaptcha, or a proof-of-work option. hCaptcha documents compliance across GDPR, CCPA, LGPD and PIPL; Pro removes most visible challenges. Run it past your privacy reviewer before you commit either way.
The abuse is hitting your API, not your forms
A widget cannot protect an endpoint a script calls directly. Put rate limits and bot rules in the server with Arcjet or your platform's WAF, and keep a CAPTCHA only where a human fills in a form.
How do you add a CAPTCHA safely?
- 1.
Verify on the server, every time
A widget in the browser proves nothing until your server checks the token with the provider. Bots skip the widget and post straight to your endpoint.
- 2.
Check the hostname and action
Confirm the token was issued for your domain and for this form, so a token solved on one page cannot be replayed on another.
- 3.
Decide what an error means
Write down whether a provider error blocks or allows. For reCAPTCHA, read the quota error field rather than trusting success and score alone.
- 4.
Rate limit the endpoint too
Limit signups per IP and per email domain. A CAPTCHA raises the cost per attempt; a rate limit caps the number of attempts.
- 5.
Gate the expensive part
Grant free credits or start trials only after email verification, so a bot that gets through still gets nothing of value.
Frequently Asked Questions
Which is best in 2026: Cloudflare Turnstile, reCAPTCHA or hCaptcha?
There is no single best one — they differ on price, on what data they collect and on how they decide. Turnstile is free with unlimited challenges, never shows image puzzles and returns a simple pass or fail. reCAPTCHA gives you a risk score to tune, but now needs a Google Cloud project and is free only up to 10,000 assessments a month. hCaptcha is built around privacy compliance and challenges, with a near-passive mode on its paid Pro plan. Pick on whichever of those three constraints matters most to you.
Is reCAPTCHA still free?
Up to 10,000 assessments a month. Google moved all reCAPTCHA keys into Google Cloud, finishing the automatic migration in early 2026. The free Essentials tier covers 10,000 assessments a month; the Standard tier is $8 a month for up to 100,000; Enterprise is priced at $1 per 1,000 assessments on a fixed monthly commitment with a 12-month minimum. Usage above the free tier requires billing enabled on the Google Cloud project.
What happens when reCAPTCHA goes over the free quota?
It depends on the API you call. Google’s documentation says SiteVerify requests over quota "fail open": they return success:true with a score of 0.9 and an error message in the response. CreateAssessment requests "fail closed" with a 429 error and no assessment. So a site using the classic SiteVerify check, without billing enabled, can keep accepting every submission as human after it passes 10,000 checks in a month unless its code reads the error field.
Is Cloudflare Turnstile really free?
Yes. Cloudflare’s plan page lists unlimited challenges on the free plan, with a limit of 20 widgets per account and 10 hostnames per widget. Enterprise adds unlimited widgets, ephemeral IDs, any-hostname widgets and removal of Cloudflare branding. Turnstile does not require your DNS or any other Cloudflare service.
How much does hCaptcha cost?
The Basic plan is free. Pro is $99 a month billed yearly or $139 billed monthly, with 100,000 evaluations included and $0.99 per 1,000 after that, and adds the 99.9% passive mode, custom themes and analytics. Enterprise is quoted by sales and adds risk scores, a fully passive no-CAPTCHA mode, SSO and SLAs. Pro has a 14-day free trial.
Do CAPTCHAs stop AI agents and bots in 2026?
Not on their own. They raise the cost of abuse, which is usually enough for signup and contact forms, but solver services and browser-automation agents can get through. Treat a CAPTCHA as one layer: add server-side rate limiting, email verification before granting anything costly such as free credits, and limits on what a new account can do in its first hours.
Can I switch from reCAPTCHA to Turnstile easily?
Usually in under an hour. Both use the same shape: a client-side widget that produces a token, and a server-side call that verifies it. Swap the script tag and site key on the client and the verification URL and secret on the server. The one design change is that Turnstile returns pass or fail, not a 0–1 score, so any threshold logic you built on reCAPTCHA v3 scores goes away.
Sources
Plans and quota behaviour were read from the vendor pages below on October 24, 2026.