Get the next one in your inbox.
One email when we publish something worth reading. No spam — appropriately enough, we'd know.
reCAPTCHA, hCaptcha, and Cloudflare Turnstile all stop bots, but they differ in privacy posture, user friction, and what form backends actually support today.
Get an instant summary, key takeaways, action items, and answers to your questions about this article.
reCAPTCHA (Google) is the most widely recognized and battle-tested option but raises some privacy concerns since it's tied to Google. hCaptcha offers similar bot detection with a more privacy-friendly stance. Cloudflare Turnstile is a newer, non-CAPTCHA challenge that's frictionless for most users but has narrower third-party support. As of this writing, FormBridge supports reCAPTCHA and hCaptcha as configurable spam protection options.
All three products exist to answer one question before a form submission is accepted: is this a human? They get there differently.
reCAPTCHA, from Google, is the option most visitors have already seen somewhere else — the checkbox, or the invisible version that only shows a puzzle if it's suspicious. Its scale is its biggest asset: it's trained on a huge amount of traffic across the web, so it's generally effective at catching bots. Its biggest criticism is also its scale — it's another Google script on your page, and some visitors and site owners are wary of what data that implies is being collected.
hCaptcha does roughly the same job with a different pitch: privacy first. It was built explicitly as an alternative for sites that didn't want to route visitor data through Google, and it pays some site owners for traffic (originally by having users label images that feed other computer vision work). For a form that needs solid bot filtering without a Google dependency, it's a direct swap.
Cloudflare Turnstile is the newest of the three and takes a different approach entirely — instead of a puzzle, it runs passive browser and behavior checks and only escalates to something visible when it's unsure. For most visitors, that means no interaction at all. It's frictionless when it works, but it's a newer product with narrower adoption across third-party tools than the other two.
If your top priority is proven, wide bot coverage and you're not worried about the Google association, reCAPTCHA is the safe default. If privacy positioning matters to your audience or your own policies, hCaptcha gives you nearly the same protection without that tie. If you're already deep in the Cloudflare ecosystem and your tools support it, Turnstile is worth considering for the lower friction — just confirm your form backend actually supports it first.
That last point matters more than it sounds: not every form backend supports every CAPTCHA provider. As of this writing, FormBridge's spam protection settings let you choose no CAPTCHA, reCAPTCHA, or hCaptcha for a form — each configured with a site key and secret key from your Google or hCaptcha account. Turnstile isn't currently one of the options, so if that's a hard requirement, factor it into your choice of backend.
Not currently. FormBridge's spam protection settings let you choose no CAPTCHA, reCAPTCHA, or hCaptcha, each configured with a site key and secret key from your Google or hCaptcha account. Turnstile support isn't part of the current feature set.
hCaptcha was built and marketed as a privacy-friendlier alternative to reCAPTCHA, positioning itself against concerns about Google's data collection through its widely embedded challenge widget. Whether that distinction matters to you depends on your own privacy requirements and audience.
One email when we publish something worth reading. No spam — appropriately enough, we'd know.