Best CAPTCHA for Contact Forms (2026): 5 Options Compared

Copy-paste: HTML contact form with Turnstile

This is a complete contact form with a hidden honeypot and a Cloudflare Turnstile widget. Replace the two placeholder keys and it works on any static site, WordPress Custom HTML block, or site builder that accepts HTML.

<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY">
  <!-- Honeypot: hidden from people, filled in by simple bots -->
  <input type="text" name="botcheck" style="display:none" tabindex="-1" autocomplete="off">

  <label>Name <input type="text" name="name" required></label>
  <label>Email <input type="email" name="email" required></label>
  <label>Message <textarea name="message" required></textarea></label>

  <div class="cf-turnstile" data-sitekey="YOUR_TURNSTILE_SITE_KEY"></div>

  <button type="submit">Send</button>
</form>

Paste your Turnstile secret key into the form's security settings in the splitforms dashboard so the token is verified server-side. The widget adds a cf-turnstile-response field to each submission; once it renders reliably, you can also turn on "Require a valid Turnstile token" so direct POSTs without one are dropped.

Want a styled starting point instead? Grab the free HTML contact form template and add the two Turnstile lines above, or follow the step-by-step Turnstile HTML form setup.

Which CAPTCHA is best for a contact form?

Prices checked September 27, 2026. Plans change, so confirm on the provider pages listed in the sources section before you commit.

How was this comparison evaluated?

This is a decision guide, not a controlled head-to-head test. We reviewed the providers' official documentation on July 20, 2026, rechecked prices on September 27, 2026, and compared the factors a contact-form owner can verify:

• User interaction: whether a visitor may have to solve a challenge.
• Server verification: how the backend validates the browser token.
• Accessibility: the provider's documented approach and the burden placed on visitors.
• Privacy: the third party receiving request data and the policies you must review.
• Operational fit: pricing model, setup work, and native support in your form backend.

There is no honest universal "bot block rate." Results depend on your audience, attack type, challenge settings, and fallback rules. Test with your own traffic and track accepted spam, rejected humans, page performance, and completed forms.

Why is Cloudflare Turnstile the best default?

Cloudflare describes Turnstile as a CAPTCHA alternative that adapts its challenge to the visitor. Its managed, non-interactive, and invisible widget modes all produce a token that must be checked with Cloudflare's Siteverify API. Cloudflare's current free plan includes unlimited challenges, subject to its documented account limits.

In splitforms, add the public widget to the form (as in the copy-paste form above) and save the matching private secret in the form's security settings. Never place the secret in browser HTML. splitforms verifies the token only when that secret is configured.

When does another CAPTCHA fit better?

hCaptcha

hCaptcha supports a browser widget and a server-side Siteverify flow. Its Basic plan is free and its pricing page lists no evaluation cap; Pro costs $99/month billed annually ($139 billed monthly) for 100,000 evaluations a month and adds its passive mode. It is a reasonable choice when you want a familiar widget without Google, but splitforms does not currently verify its tokens for you. Privacy, GDPR and friction are covered in the full hCaptcha vs reCAPTCHA vs Turnstile comparison.

Google reCAPTCHA

reCAPTCHA offers score-based (v3) and challenge-based (v2) products within Google Cloud. Free use covers 10,000 assessments a month per organization, counted across every site and key; past that you need billing enabled. splitforms verifies reCAPTCHA tokens when you save the secret key, but it checks only that the token is valid. A v3 score policy needs your own threshold on your own backend.

Friendly Captcha

Friendly Captcha uses background proof-of-work instead of an image puzzle, which makes it a common pick for strict EU privacy rules. Review its current regional endpoint, browser support, pricing, and server-verification documentation. It is not a native splitforms integration today.

Is a honeypot enough on its own?

A honeypot is an extra field that humans should never see or complete. It catches simple form fillers without adding a visible task. Modern bots can detect or ignore it, so combine it with timing checks, rate limits, content analysis, and a managed challenge when the risk calls for one.

<form action="https://splitforms.com/api/submit" method="POST">
  <input type="hidden" name="access_key" value="YOUR_ACCESS_KEY" />

  <input
    type="text"
    name="botcheck"
    aria-hidden="true"
    tabindex="-1"
    autocomplete="off"
    style="position:absolute;left:-10000px;width:1px;height:1px"
  />

  <input name="email" type="email" required />
  <textarea name="message" required></textarea>
  <button type="submit">Send</button>
</form>

Keep the field out of the keyboard and accessibility trees. Do not use a normal business field name that a password manager may populate.

What should you check for accessibility and privacy?

• Test the complete form with a keyboard and a screen reader.
• Provide a usable error message and a retry path when verification fails.
• Do not silently discard a real lead because a challenge timed out.
• Load third-party scripts only on pages that need them.
• Review the provider's current privacy terms, data location, DPA, and consent requirements for your jurisdiction.
• Measure false rejections on your own traffic instead of copying a vendor or publisher benchmark.

In what order should you add spam protection?

1. Enable the backend's honeypot, timing, rate-limit, and content controls.
2. Measure unwanted submissions and investigate which controls caught them.
3. If abuse remains, add Turnstile and configure its private secret in splitforms.
4. Test valid, missing, expired, and deliberately invalid tokens before launch.
5. Recheck completion rate, accessibility, and provider terms after major changes.

Moving off Google specifically? The reCAPTCHA alternatives guide covers the migration options in more depth.

Primary sources

Product details were checked on July 20, 2026; prices were rechecked on September 27, 2026:

• Cloudflare Turnstile overview and current plans
• hCaptcha developer guide and Siteverify flow and hCaptcha pricing
• Google reCAPTCHA tier comparison and reCAPTCHA billing information
• Friendly Captcha developer guide and Friendly Captcha pricing
• Contact Form 7 6.1.0 release notes (Turnstile integration)
• W3C: Inaccessibility of CAPTCHA

Next steps

• See the focused Turnstile HTML form setup.
• Compare a honeypot with reCAPTCHA without treating either as a complete spam strategy.
• Review the splitforms spam-protection layers.
• Use the splitforms documentation for current configuration steps.

FAQ