CAPTCHA on contact forms: is reCAPTCHA enough?

A CAPTCHA checks whether a visitor is human, not whether they wrote to you. What reCAPTCHA, hCaptcha and Turnstile do now, what they cost real visitors, and when they are worth it.

Most contact forms that get spam end up with a CAPTCHA on them. It is the default advice, it is free or nearly free, and for a while it works: the obvious junk stops. Then the mailbox fills again with messages that are fluent, polite and aimed at you, and it is not clear what the CAPTCHA is still doing.

The short answer is that it is still doing its job. Its job was never the one you needed done.

Two different questions

A CAPTCHA asks one thing: is the thing submitting this form a human, or at least something that behaves like one? The name says so. It is a test to tell computers and humans apart.

A business with a contact form cares about something else: did a person write this message to us, about something we do? Those questions overlap for crude spam, because crude spam is sent by scripts. They separate completely for the mail that is left once the scripts are gone. A salesperson pasting the same pitch into two hundred forms passes every CAPTCHA, because they are human. An outreach tool driving a real browser often passes too, because it behaves like one. Neither message was written to you.

So "is reCAPTCHA enough?" depends on what is getting through. If it is gibberish and link spam, a CAPTCHA helps. If it is well-written pitches, no CAPTCHA will touch it, and making the test harder only lands on your customers.

What the main options do now

The field has changed in the last two years, so it is worth checking what each product is today rather than what it was.

Google reCAPTCHA. Version 2 is the "I'm not a robot" checkbox, which either passes the user immediately or challenges them, plus an invisible variant tied to a button. Version 3 shows nothing and returns a score from 0.0 to 1.0, where 1.0 is very likely a good interaction. The site owner picks the threshold; Google suggests starting at 0.5 and adjusting after watching real traffic. reCAPTCHA is now part of Google Cloud Fraud Defense, and new classic keys can no longer be created. The free Essentials tier covers 10,000 assessments per calendar month, and that allowance is per organisation, aggregated across all sites. An agency running reCAPTCHA for many clients under one organisation shares one allowance.

hCaptcha. There is a free tier, but the mostly invisible modes are paid. Pro, from $99 a month on annual billing, includes a "99.9% Passive mode" in which, hCaptcha says, fewer than 0.1% of legitimate users are challenged. Bot scores are an Enterprise feature.

Cloudflare Turnstile. Free, with unlimited challenges on the Free plan, and usable without sending your traffic through Cloudflare. It runs small non-interactive JavaScript checks in the browser and only shows a checkbox in Managed mode when it thinks it needs to. Contact Form 7 now recommends it over reCAPTCHA; our post on Contact Form 7 spam covers that setup.

All three are, at heart, the same kind of test. They look at the browser and the behaviour, not at what the visitor typed.

What it costs the people you want to hear from

Every visible challenge is a small tax on your customers, and for some of them it is not small.

The W3C's note on the Inaccessibility of CAPTCHA (its latest version is a Group Draft Note from December 2021) puts it plainly: the very nature of an interactive task "inherently excludes many people with disabilities, resulting in a denial of service to these users". Distorted text asks people who are blind, visually impaired or dyslexic to do the one thing they find hardest. Audio does the same to people who are deaf, hard of hearing or have an auditory processing disorder. Puzzles and sums do it to people with learning or cognitive disabilities, including dyscalculia.

Research on ordinary users says the friction is real for everyone else too.

2010, text and audio CAPTCHAs. Bursztein and colleagues at Stanford had more than 318,000 CAPTCHAs solved from 21 popular schemes. When three people solved the same image CAPTCHA, all three agreed only 71% of the time, and only 31% for audio. Image CAPTCHAs took about 9.8 seconds, audio about 28.4. Non-native English speakers were slower, and less accurate on English-centric schemes. Those were 2010-era schemes, but note which one did worst: the audio alternative, the version meant for people who cannot use the image.
2023, modern CAPTCHAs. Searles and colleagues at UC Irvine had 1,400 participants solve 14,000 live CAPTCHAs and presented the results at USENIX Security. The reCAPTCHA checkbox was quick, at 3.1 to 4.9 seconds. Image challenges were not: 15 to 26 seconds for reCAPTCHA images and 18 to 32 seconds for hCaptcha. In a separate study of abandonment, 174 of 574 participants who started gave up before finishing, which the authors present as an initial investigation rather than a settled figure.

Score-based checks avoid most of this, which is why the W3C note prefers non-interactive approaches, with one caveat: they "may expose the user to the collection of personal data". They also have a cost of their own. When a score-based check gets it wrong on a typical set-up, such as Contact Form 7's, the visitor sees an error message and nothing reaches you. We cover that in more detail in false positives on spam filters.

What it costs the other side

The uncomfortable part of the research is how cheap CAPTCHAs are to get past.

The 2023 USENIX paper compared its human results with automated solvers reported in earlier research, and found bots outperforming humans in both time and accuracy across every type it compared, including a reported 100% accuracy on the reCAPTCHA checkbox at 1.4 seconds.

Where software cannot solve a challenge, people are paid to. A 2010 study of the solving market at UC San Diego found an industry reselling both automated solving and real-time human labour, at retail prices as low as $1 per thousand.

A July 2026 preprint on arXiv, Broken Gates, repeated the exercise against today's products; it lists no peer-reviewed venue yet, so treat it as early. It tested seven commercial solving services, and success rates were 100% for most of the services tested against reCAPTCHA v2, hCaptcha on its easy setting, and Turnstile, at costs as low as $0.10 per 1,000 solves. reCAPTCHA v3 held up far better, with solvers averaging 23% success. But the authors also tested AI browser agents, and found that an agent running in a real browser profile, with its cookies and history, consistently got past reCAPTCHA v3, while an agent with near-identical behaviour in a clean browser failed. What decided it was the browser environment, not the behaviour.

In other words, score-based checks are only as good as the difference between a real person's browser and the attacker's. The authors conclude that this difference, not the challenge, is where the protection now lies.

Privacy, and what you tell visitors

Any third-party CAPTCHA sends data about your visitor to its provider, so it belongs in your privacy notice. The details changed in 2026.

reCAPTCHA. From 2 April 2026, Google says customers are the sole data controller and Google acts as data processor for reCAPTCHA data. Google now recommends removing references to its own Privacy Policy and Terms from your site, and encourages you to check that your own privacy disclosures cover the purpose: security, fraud and abuse prevention. You may hide the badge if you show the text "This site is protected by reCAPTCHA." visibly in the user flow. reCAPTCHA also sets a necessary cookie, _GRECAPTCHA.
hCaptcha. Its FAQ says that for EU users hCaptcha acts as a processor, and recommends describing what it processes in your privacy policy.
Turnstile. Cloudflare says Turnstile processes only the data strictly necessary for the check and does not access, store or transmit form entries.

None of this is legal advice. If your forms collect health, legal or financial details, confirm the wording with your own adviser. Our post on GDPR and contact form spam filtering sets out the general picture.

When a CAPTCHA is worth it

Situation	Worth a CAPTCHA?	What kind	Pair it with
Login or sign-up under credential stuffing	Yes	Score-based, stepping up on low scores	Two-factor or email verification, as Google suggests for logins
Contact form flooded with scripted junk	Yes, as a cheap layer	Non-interactive (Turnstile Managed, reCAPTCHA v3)	A honeypot field
Contact form getting fluent sales pitches	No, it will not help	None extra	Filtering on the message itself
Clinics, public services, or many disabled visitors	Only non-interactive	Invisible or score-based, never puzzles	A route that bypasses the form, such as a phone number
Many client sites under one agency	Check the limits first	Turnstile (the Free plan allows 20 widgets per account), or reCAPTCHA within its shared 10,000 free assessments	A way to see what was blocked on each site

The W3C note's own advice is a good rule for everything below the login row: if a honeypot suffices, use a honeypot, until evidence says otherwise.

Where it is hard

Real browsers with a history. The newest research suggests the thing that beats score-based checks is a genuine-looking browser environment. Raising the threshold to catch that also raises the chance of rejecting real customers whose browsers happen to look unusual.
Paid people. A person paid to submit your form is a person. No CAPTCHA, however clever, is designed to reject them.
Silent failures. A visible challenge at least tells the visitor what went wrong. A score below your threshold shows them an error and leaves you no record unless your form plugin keeps one.
The mail that is left. Once the scripted traffic is gone, what remains has to be judged by what it says. That means reading it, or having something read it, after the form. If you would rather not do that by hand, Humainbox reads each message and, once an inbox is switched to active, holds the ones nobody wrote to you, with a written reason, and never deletes them; how it works covers dry run and thresholds.