reCAPTCHA Alternatives That Don’t Break the Bank (and Don’t Kill Signups)
Last updated: 2026-01-17
If your form defense strategy is “make humans solve puzzles,” you’re paying with conversion rate. And depending on your traffic, you can also end up paying with surprise billing.
The move I like: pick a low-friction verifier and back it up with cheap server-side guardrails. That combo blocks the bulk of bots without turning your signup flow into a mini-game.
TL;DR
- Default pick: Cloudflare Turnstile — $0 and typically low/no friction.
- Best “upgrade path” pick: hCaptcha — start free, go Pro when you want more passive modes + analytics.
- Privacy-first pick: Friendly Captcha — nice UX, paid starts low; also has a free option for non-commercial/open-source use.
- Don’t rely on any verifier alone. Add: rate limits + honeypot + minimum submit time.
Quick comparison
Cloudflare Turnstile — $0 — Best for most sites — Fast win, low friction hCaptcha Basic — $0 — Best for simple protection — Free baseline hCaptcha Pro — $99/mo (billed yearly) — Best for higher scale + insights — More knobs, more visibility Friendly Captcha Starter — €9/mo — Best for privacy-first, low traffic — Clean UX, accessible reCAPTCHA Standard/Enterprise — Cost scales with usage — Best if you’re already invested in Google — Pricing can creep up
Why people move off reCAPTCHA (the cost curve)
Google’s published tiers commonly look like:
- Free up to 10,000 assessments/month
- $8/month up to 100,000
- then $1 per 1,000 beyond that
If you’re running multiple sites, multiple forms, or you’re just growing, that adds up faster than you’d expect.
Option 1: Cloudflare Turnstile (my default)
Turnstile has a Free plan and Cloudflare positions it as suitable for most production applications.
Why I’d ship it
- $0 keeps spend predictable.
- Low friction keeps signups from bleeding.
- Simple integration: generate token on the client, verify on the server.
Trade-off
- You’re buying into Cloudflare for the verifier piece (usually fine, just be intentional).
Option 2: hCaptcha (best “start free, level up later”)
hCaptcha is a good option when you want a clean path from “free and decent” to “more passive + more visibility.”
Pricing snapshot
- Basic: $0
- Pro: includes 100,000 evaluations/month, then overages per 1,000 (see hCaptcha pricing page)
Why you’d pick it
- You can keep it cheap early.
- When you care about higher conversion + analytics, you can upgrade without rewriting everything.
Option 3: Friendly Captcha (privacy-first, simple UX)
Friendly Captcha is the one you pick when privacy/accessibility and “no weird puzzles” is part of your product values.
Pricing snapshot
- Starter: €9/month for 1 domain and up to 1,000 requests/month
- They also advertise free options for non-commercial/open-source use (with limits)
Why you’d pick it
- Strong privacy positioning
- Low-friction experience
- Fits smaller/cleaner deployments nicely
What actually works: verifier + guardrails (cheap and effective)
Most bots aren’t sophisticated. They’re just fast. So you win by combining a verifier with “boring” controls.
Layer 1 — Verifier token check
- Require a valid token for form submit.
- Fail closed. No token = no signup.
Layer 2 — Rate limits (server-side, huge ROI)
Add throttles on:
- IP address
- Email / username
- Session or device fingerprint (even lightweight signals help)
This alone will delete a lot of automated spam.
Layer 3 — Invisible traps (free, no UX cost)
- Honeypot field: hidden input; if it’s filled, block it.
- Minimum time-to-submit: humans don’t complete a signup form in 700ms.
- Basic sanity checks: missing headers, obvious automation signatures, etc.
Layer 4 — Business checks
- Email verification for new accounts
- Optional disposable email filtering (only if it won’t hurt your audience)
Implementation blueprint (works with Laravel/Inertia, but applies anywhere)
- Frontend: run verifier → get token → submit token with the form
- Backend: validate inputs → verify token server-side → then process the action
- Observability: log failures (IP, UA, route, reason) so you can tune limits without guessing
Request flow (simple)
POST /register- rate limit check
- honeypot check
- min submit-time check
- verifier token validation
- create user
- send verify email
My recommended “don’t break the bank” setup
If you want the lowest-effort, highest-impact combo:
- Turnstile + rate limiting + honeypot + min submit time
- Add email verification if signups matter
That’s the sweet spot: strong enough to stop most junk, cheap to operate, and it doesn’t punish real users.
Sources
- Cloudflare Turnstile plans: https://developers.cloudflare.com/turnstile/plans/
- Cloudflare Turnstile pricing page: https://www.cloudflare.com/application-services/products/turnstile/
- hCaptcha pricing: https://www.hcaptcha.com/pricing
- hCaptcha Pro details: https://www.hcaptcha.com/pro
- Friendly Captcha pricing: https://friendlycaptcha.com/
- Friendly Captcha free/open-source info: https://friendlycaptcha.com/free-captcha/
- Google reCAPTCHA tier comparison: https://docs.cloud.google.com/recaptcha/docs/compare-tiers
- Google reCAPTCHA product page: https://cloud.google.com/security/products/recaptcha