reCAPTCHA vs Turnstile vs spam protection
CAPTCHA services test the visitor. Spam protection tests the submission. Knowing the difference tells you which to use, and when to use both.
The short answer
CAPTCHAs (including reCAPTCHA and Cloudflare Turnstile) judge whether the visitor looks human, using a third-party service. Server-side spam protection judges the submission itself: how fast it was sent, whether it started on your page, hidden fields and links. Server-side protection alone stops most bots with no visitor effort; Turnstile is the lightest CAPTCHA to add on top if needed.
How each one works
Traditional CAPTCHA
The visitor types distorted letters or picks images. Effective against simple bots, costly for people, and increasingly solved by software and solving services.
Google reCAPTCHA
Version 2 shows the "I'm not a robot" tick box and sometimes image puzzles. Version 3 is invisible and gives each visit a score that your server must check. Both load Google's script and send visitor data to Google.
Cloudflare Turnstile
A free CAPTCHA alternative that usually runs without any puzzle, checking the browser in the background. It loads Cloudflare's script and must also be verified by your server.
Server-side spam protection
Your own server checks the submission: hidden trap field, time taken, a signed one-time token, links and rate. Nothing is loaded from third parties and visitors do nothing.
Side by side
| reCAPTCHA v2 | reCAPTCHA v3 | Turnstile | Server-side protection | |
|---|---|---|---|---|
| Visitor effort | Tick box, sometimes puzzles | None | Usually none | None (or slide to send) |
| Third-party script | Cloudflare | None | ||
| Stops direct posting | Only if verified on server | Only if verified on server | Only if verified on server | Yes (token) |
| Privacy notice needed | Yes | Yes | Yes | Only your own processing |
| Cost | Free tier, paid above limits | Free tier, paid above limits | Free | Setup once |
Check current terms: providers change their free limits and pricing, so confirm on their websites before relying on the figures above.
Turnstile vs CAPTCHA: which to choose
If you need a CAPTCHA-type check, Turnstile is usually the better choice over classic CAPTCHAs and reCAPTCHA v2: it rarely shows a puzzle and is free. But first make sure your form has server-side checks, because without them, bots that skip your page get through whatever widget the page shows.
Our recommendation
- Start with server-side protection. It stops most spam with nothing extra for visitors or your privacy policy.
- Look at your spam log after a week.
- Only if browser bots still get through, add slide to send or Turnstile.
More options in the best alternatives to CAPTCHA.
Common questions
Is Turnstile better than reCAPTCHA?
For most contact forms, yes: it rarely shows puzzles and is free. Both share data with a third party and both need checking on your server to be effective.
Do I need a CAPTCHA if I have spam protection?
Usually not. Add one only if your spam log shows browser bots still getting through.
Does reCAPTCHA slow down my website?
It adds scripts that load on the page. The effect is small but measurable, which is one more reason to load it only where needed, or not at all.