How CAPTCHA works, and which one to use on your website

A CAPTCHA is a quick test that tries to tell a real person from a bot before a form is accepted. Early versions asked you to type warped letters. Newer ones mostly work in the background: they look at signals from the browser, hand your site a token or a risk score, and only show a puzzle when something looks off. For most business websites, the best setup is a hidden honeypot field plus a low-friction option like Cloudflare Turnstile or your platform's built-in protection, with the token always checked on your server.

Where CAPTCHA came from

CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. According to NPR's history of the test, Luis von Ahn created it around 2000 as a graduate student at Carnegie Mellon University, and Yahoo used it to stop bots from signing up for millions of free email accounts. Others were working on similar tests at the time, but the CMU version and its name stuck.

In the mid-2000s von Ahn built reCAPTCHA, which had people type words from scanned old texts that computers could not read. Google bought reCAPTCHA in 2009. Today Google describes reCAPTCHA as part of its Google Cloud Fraud Defense product.

How each generation works

Distorted text

The first CAPTCHAs showed letters that were stretched, crossed out or set on noisy backgrounds. People could read them and the software of the day could not. Over time, text recognition improved, the distortion got heavier, and the tests got harder for humans too. Google shut down reCAPTCHA v1 in March 2018.

reCAPTCHA v2: the checkbox and the image grid

With the v2 checkbox, the visitor clicks "I'm not a robot." Google's docs say that, depending on its risk check, the visitor either passes right away or gets a challenge, usually the familiar "select all squares with traffic lights" grid.

Invisible reCAPTCHA

The invisible v2 option has no checkbox. The check runs when someone clicks a button that already exists on your page, such as Submit. Google says that by default only the most suspicious traffic is asked to solve a puzzle.

reCAPTCHA v3 and risk scores

reCAPTCHA v3 never shows a challenge. It returns a score where 1.0 is very likely a good interaction and 0.0 is very likely a bot. Your site decides what to do with it. Google's guidance is to start with a threshold of 0.5, watch real traffic before you enforce anything, and act quietly instead of blocking. In practice that looks like:

• High score: accept the form normally.
• Middle score: accept it, but flag it for review or send it to a holding folder.
• Low score: ask for an extra step, such as email verification, or reject it.

You can also tag each spot with an "action" name (like contact or login), and your server should confirm the action matches what it expected.

Turnstile and proof-of-work challenges

Cloudflare Turnstile calls itself "Cloudflare's smart CAPTCHA alternative." It assesses visitors from various browser signals, and its docs list three widget modes: Managed (shows a checkbox only when risk is higher), Non-interactive and Invisible. You do not need to route your site through Cloudflare to use it.

Friendly Captcha describes itself as "a privacy-first, proof-of-work-based bot protection system." Proof of work means the visitor's device solves a small math task in the background. It costs a real browser a moment, but it makes sending thousands of fake forms slow and expensive.

ALTCHA calls itself a privacy-first CAPTCHA alternative with an open-source, MIT-licensed widget that you can host yourself. It also uses an invisible proof-of-work challenge.

hCaptcha describes itself as a "privacy-first bot and fraud management platform." Its pricing page says the free plan is a classic experience where most users will see a challenge, while passive "No-CAPTCHA" modes are part of Enterprise.

Alternatives: honeypots and timing checks

Not every form needs a CAPTCHA. Two simple tricks catch a lot of basic bots:

• Honeypot field. Add a field that is hidden from people with CSS. Real visitors leave it empty. Many bots fill in every field they find, so any submission with that field filled in gets dropped.
• Time-based check. Record when the form loaded and reject anything submitted in a second or two. People need time to type. Scripts often do not wait.

Neither one bothers real visitors, and neither sends data to a third party. The W3C lists honeypots, heuristics and spam filtering among the non-interactive options worth trying first. They will not stop a determined, targeted attack, so treat them as the first layer, not the only one. They fit into a broader bot protection plan.

Why the token must be checked on your server

This is the step most often skipped on DIY sites, and it is the step that makes the whole thing work.

When a visitor passes the widget, the browser gets a token, a long string of characters. The widget alone proves nothing, because anyone can send a form straight to your server without loading your page at all. Your server has to send the token, plus your secret key, to the provider and only accept the form if the answer is a success.

• Google's reCAPTCHA tokens are valid for two minutes and can only be checked once, to stop replays.
• Cloudflare says Turnstile tokens expire after 300 seconds, can only be validated once, and that server-side validation is mandatory.
• hCaptcha's docs say to allow the action only when the response is successful, and that "a frontend callback alone does not authorize the request."

Keep the secret key on the server, never in browser code. Our website security checklist covers where keys and other secrets belong.

Privacy and GDPR

Any CAPTCHA that runs a third-party script collects some data about the visitor. Here is what each vendor says on its own pages:

• Google reCAPTCHA: Google's FAQ says customers are the data controller, Google acts as a processor under its Cloud Data Processing Addendum, and Google commits to comply with GDPR. It also says reCAPTCHA sets a necessary cookie for risk analysis. If you hide the badge, you must say "This site is protected by reCAPTCHA" elsewhere on the page.
• Cloudflare Turnstile: Cloudflare says it collects signals such as IP address, TLS fingerprint and user agent only to detect bots, not to identify, profile or target people, and that it does not read what visitors type into your forms.
• hCaptcha: says it complies with GDPR, CCPA, LGPD and PIPL.
• Friendly Captcha and ALTCHA: both say they use no cookies. ALTCHA offers EU hosting or self-hosting.

These are vendor claims, not legal advice. Whatever you pick, name it in your privacy policy and check with your own counsel if you serve EU visitors.

Accessibility problems with visual CAPTCHAs

The W3C's working group note Inaccessibility of CAPTCHA: Alternatives to Visual Turing Tests on the Web lays out the problems plainly. Image tests cannot be read by screen readers, which blocks blind users. Warped text is hard for people with low vision, dyslexia or cognitive disabilities. Audio versions are hard for deaf-blind users and anyone in a noisy room. The note's key advice: "Whenever an interactive CAPTCHA is implemented, a variety of alternative challenges must be made available."

That is a strong reason to prefer options that run without a puzzle. See our guide to website accessibility, ADA and WCAG for the bigger picture.

Effect on conversions

We have not found a solid, independent study we would quote with a number. The pattern is still easy to see: every puzzle is one more step between a visitor and your inbox, some people give up, and people using assistive tech may not be able to finish at all. Background options that rarely show a challenge cost far less. Watch your form's completion rate before and after you add any CAPTCHA.

Pricing as of November 2026

Prices change. Check each vendor's pricing page before you commit.

How to add CAPTCHA on common platforms

• WordPress: most form plugins (Contact Form 7, WPForms, Gravity Forms) support reCAPTCHA, hCaptcha or Turnstile. The free Simple Cloudflare Turnstile plugin adds Turnstile to many of them plus login, registration and WooCommerce checkout. Protect the login page too; see WordPress security hardening.
• Shopify: Shopify's docs say it uses hCaptcha on customer account, contact and blog comment forms. You can turn it off under Online Store > Preferences, so leave it on unless you have a reason.
• Wix: the new Wix Forms have built-in spam filters with invisible reCAPTCHA. In the form's settings you can pick the spam filter level.
• Squarespace: rely on the spam protection built into its forms, and check Squarespace's help center for the current settings.
• Netlify Forms: every submission is filtered through Akismet. You can add a honeypot with the netlify-honeypot attribute, a Netlify-provided reCAPTCHA 2 with data-netlify-recaptcha="true", or your own reCAPTCHA keys.
• Custom forms (Next.js and similar): add the widget on the page, send the token with the form, and verify it in a server function before saving or emailing anything. Our guide to connecting forms to email or your CRM shows where that check fits.

Which one should you use?

The short version

CAPTCHAs moved from warped text to quiet background checks. Start with a honeypot and a timing check, add a low-friction service like Turnstile where spam still gets through, always verify the token on your server, and avoid visual puzzles that lock people out. Bot traffic is part of a bigger story we covered in the dead internet theory. If your forms are drowning in spam, tell us what you are seeing.