Short answer: A CAPTCHA is a test that tries to tell people from bots, often with a puzzle. reCAPTCHA, now part of Google Cloud Fraud Defense, can score visitors without asking them anything. Start with checks people never see, add a challenge only when a request looks doubtful, and always keep another way to reach you.
What a CAPTCHA is, and who it leaves out
A CAPTCHA tries to tell human visitors from robots before they send a form or create an account. The W3C notes that the classic version, typing obscured text from an image, remains common, but other approaches have emerged.
Every type of CAPTCHA will be unsolvable by some people with disabilities, the W3C warns. WCAG allows one only with a text alternative that describes its purpose and other versions of it for different senses.
The W3C also recommends offering CAPTCHAs in more than two modes, a person who can help when someone gets stuck, and no CAPTCHA for authorized users. Our WCAG 2.2 guide covers the newer rules for sign-in puzzles.
How reCAPTCHA works
Google’s reCAPTCHA is now part of Google Cloud Fraud Defense. When a visitor triggers a protected action, such as sending a form, your site gets back a verdict with a risk score from 0.0 to 1.0.
You choose how it works: score-based, a checkbox or a policy-based challenge. The Essentials tier is free up to 10,000 assessments per calendar month, and it needs a valid payment method in Google Cloud.
| Option | What the visitor does | Worth knowing |
|---|---|---|
| reCAPTCHA score-based | Nothing | Your site decides what to do with a risk score from 0.0 to 1.0 |
| reCAPTCHA checkbox | Ticks “I’m not a robot” | The best-known version, and every visitor has to tick it |
| Cloudflare Turnstile | Usually nothing | Runs small non-interactive checks in the browser, without sending your traffic through Cloudflare |
| Honeypot field | Nothing | A field hidden from people that bots fill in |
| Heuristics | Nothing | Patterns such as how much a visitor requests or how data is entered |
From Google Cloud’s Fraud Defense pages, Cloudflare’s Turnstile overview and the W3C note on CAPTCHA, read November 4, 2026.
What changed for reCAPTCHA in 2026
Starting April 2, 2026, the reCAPTCHA badge no longer refers to Google’s Privacy Policy and Terms of Use. Google now acts as a data processor, and the website owner is the data controller.
Google recommends removing those references from your own website too. You can still hide the badge, as long as your page says you use reCAPTCHA, and Google gives the text: “This site is protected by reCAPTCHA.”
Fraud Defense also sets a necessary cookie, _GRECAPTCHA, for its risk analysis. List it with your other cookies, and our cookie consent banner guide covers the notice that goes with them.
Stopping spam without a puzzle
The W3C applauds approaches that ask nothing of people, because when they work they pose no accessibility challenge. It also warns that some of them expose a lot of data about each visitor to the service that analyzes it.
A honeypot is a field hidden from people that robots fill in, which gives them away. Heuristics look for patterns, such as how much a visitor requests or how data is entered. Limits on what new accounts can do make a site a less attractive target.
Cloudflare’s Turnstile runs small checks in the browser and works without showing visitors a CAPTCHA. Our contact form guide covers how to build a form people finish.
How to protect a form without blocking people
- Start with checks people never see, such as a hidden field and heuristics.
- If spam still gets through, add a score-based or non-interactive check.
- Show a challenge only when a request looks doubtful, never to everyone.
- Give every challenge a text alternative and another way through.
- If you hide the reCAPTCHA badge, say “This site is protected by reCAPTCHA.”
- Remove the old Google Privacy Policy and Terms links from that line.
- Keep another way to reach you, and test the form with a keyboard.
What our contact form asks of a person
On November 4, 2026, we opened our contact form as a new visitor, in English and Spanish, on a computer and on a phone. It asks for your name, phone, email and what you need.
Then come two consent boxes and the Send button. Nothing in the form asks people to prove they’re human: no puzzle, no “I’m not a robot” box and no badge. People who would rather not use the form can write to us on WhatsApp from the same page.
Before you publish
- Most people never see a challenge.
- Any challenge has a text alternative and another way through.
- People can reach you without the form.
- The page says it uses reCAPTCHA if the badge is hidden.
- That line no longer links Google’s Privacy Policy and Terms.
- The reCAPTCHA cookie appears in your cookie list.
RememberThe best spam check is the one your visitors never notice. Add friction only for the few requests that look suspicious, and never leave a person without a way in.
Forms that keep spam out without keeping people out are part of our web design service.
Quick answers about CAPTCHA
What is a CAPTCHA?
A test that tries to tell human visitors from robots, usually before someone sends a form or signs up. The classic version asks you to type obscured text from an image, but many sites now use a checkbox or checks you never see.
Is reCAPTCHA free?
The Essentials tier of Google Cloud Fraud Defense, which includes reCAPTCHA, is free up to 10,000 assessments per calendar month. It still needs a valid payment method in Google Cloud.
Can I hide the reCAPTCHA badge?
Yes, as long as your page says you use reCAPTCHA. Google gives the text “This site is protected by reCAPTCHA.” Since April 2, 2026, it also recommends leaving out the old links to its Privacy Policy and Terms of Use.
Are CAPTCHAs bad for accessibility?
They can be. The W3C says every type of CAPTCHA will be unsolvable by some people with disabilities. WCAG asks for a text alternative that describes the test and other versions of it for different senses.
What can I use instead of a CAPTCHA?
The W3C lists approaches that ask nothing of people, such as hidden honeypot fields, heuristics and limited-use accounts. Cloudflare’s Turnstile and reCAPTCHA’s score-based keys also work without showing a puzzle.
Sources
Read on November 4, 2026. Google Cloud: Google Cloud Fraud Defense overview, Compare features between Google Cloud Fraud Defense tiers, Setup overview for websites and Frequently Asked Questions. Cloudflare: Cloudflare Turnstile. W3C Web Accessibility Initiative: Understanding SC 1.1.1 Non-text Content (Level A) and Inaccessibility of CAPTCHA. Our case: our contact form, read in a browser on November 4, 2026.