reCAPTCHA vs Cloudflare Turnstile for Stopping Form Spam

reCAPTCHA vs Turnstile at a glance

Both services run checks in the visitor's browser and give your form a token, which your server sends back to the provider to confirm. The main differences are below.

Sources: Cloudflare's Turnstile plans page and Google's tier comparison, checked 20 October 2026. reCAPTCHA is now part of Google Cloud Fraud Defense.

Free limits and costs as of October 2026

A small business contact form rarely gets near 10,000 submissions a month, but heavy bot traffic counts too. Google's billing information page explains what happens at the limit; our contact form spam guide notes that without billing set up, requests over the limit return an error, which can block real enquiries if the form is not built to handle it.

Friction for real visitors: v2, v3 and Turnstile modes

Every check that shows a puzzle costs some genuine enquiries, especially on phones. The options differ a lot:

• reCAPTCHA v2 checkbox: the visitor ticks "I'm not a robot" and may get an image challenge.
• reCAPTCHA v3: never interrupts the visitor. Google's v3 documentation says it returns a score where 1.0 is very likely a good interaction and 0.0 very likely a bot, and suggests starting with a threshold of 0.5 and adjusting from real traffic. Your code decides what to do with low scores.
• Turnstile Managed (recommended by Cloudflare): runs background checks and only shows a checkbox when risk is higher; there are no images or text to decipher.
• Turnstile Non-interactive and Invisible: a spinner only, or nothing visible at all.

For a small business, v3 needs more care because the score is advice, not a decision. Send low-score submissions to a review folder rather than discarding them, at least for the first few weeks.

Privacy and PDPA notes

Both services process technical data about the visitor's browser and device to tell people from bots. Cloudflare's Turnstile overview says it processes only the data strictly necessary for this security function and points to its Turnstile Privacy Addendum. Google's reCAPTCHA FAQ says you may hide the reCAPTCHA badge only if you show the reCAPTCHA branding text in the user flow.

Switching from reCAPTCHA to Turnstile

Cloudflare's migration guide says migration is compatible up to reCAPTCHA v2. On WordPress or a site builder, check your form plugin's or builder's settings first; many offer both options, so switching is a matter of new keys. For a custom-coded form:

1. 1

   Create a Turnstile widget

   In the Cloudflare dashboard, add a widget for your hostname and choose Managed mode. You get a site key and a secret key.

2. 2

   Swap the script on the page

   Load Turnstile's script with ?compat=recaptcha to run in compatibility mode, which keeps the g-recaptcha-response field name, then replace the site key.

3. 3

   Change the server-side check

   Point verification to Turnstile's Siteverify endpoint. Unlike reCAPTCHA, it only accepts POST requests with form data or JSON, not GET query parameters.

4. 4

   Handle expired and reused tokens

   Cloudflare says tokens are valid for 300 seconds and can be validated only once. If a visitor takes longer, refresh the widget instead of rejecting the form.

5. 5

   Test, then remove reCAPTCHA

   Submit test enquiries from a phone on mobile data and a desktop, confirm they arrive, then delete the old reCAPTCHA keys and scripts.

Is a honeypot enough on its own?

A honeypot is a hidden field that people never see but simple bots fill in. It costs visitors nothing and stops a lot of basic spam. If your form gets a handful of junk messages a week, a honeypot plus server-side checks may be all you need. Add Turnstile or reCAPTCHA when spam keeps coming through or arrives in bursts. Our guide to fixing contact form spam covers honeypots, rate limits and validation, and if real enquiries go missing, see contact form emails not arriving.

Do it yourself or get help?

On WordPress or a site builder, adding Turnstile or reCAPTCHA through your form settings is usually under an hour. Custom-coded forms need a developer to add the server-side token check and handle errors without blocking real visitors.

IT Sorted is a Singapore-based team of developers with over 10 years of experience. Website Security Hardening (S$290) covers updates, login protection with 2FA, a web application firewall and security headers for WordPress or your CMS. For a custom-coded form that needs a server-verified Turnstile check, ask us for a quote through the contact form.