Cloudflare Turnstile vs reCAPTCHA on a real contact form

On a business contact form in 2026, Cloudflare Turnstile vs reCAPTCHA has a short answer, and I would pick Turnstile. It costs nothing on its free plan, it works without showing visitors a puzzle, and your site does not have to run on Cloudflare to use it. reCAPTCHA is still a capable product. It now lives inside Google Cloud, though, and it is free only up to 10,000 checks a month per organization. Most pages comparing the two are written by companies selling a third option.

I run Turnstile on my own contact form, and it taught me the part those pages leave out. On 12 September 2026 it cost me a real enquiry, one with a budget in it. The check did not load in time in the sender's browser, and my form treated the missing pass as spam. Whichever one you choose, the widget will fail on some real customer's phone, and what your form does next decides whether you keep the lead.

The short version Choose Turnstile for a contact form, a quote form or a login unless you already depend on Google Cloud. It is free up to 20 widgets and asks nobody to solve a puzzle. reCAPTCHA is free to 10,000 checks a month across your whole Google organization, then 8 dollars a month up to 100,000. With either one, check every pass on your server, because the widget alone protects nothing. Then decide what happens when the check never loads: keep the message, mark it and judge it with other checks, instead of throwing it away.

Cloudflare Turnstile vs reCAPTCHA, side by side#

The rest of this guide is the detail behind each row, then the failures, because the failures are where businesses lose enquiries.

What Cloudflare Turnstile costs#

Nothing, and the free plan is not a trial. Cloudflare's plans page, updated on 14 August 2026, lists unlimited challenges, up to 20 widgets per account, 10 hostnames per widget and seven days of analytics. Enterprise is priced by quote. It raises the limit to 200 hostnames per widget and 30 days of analytics, and adds features a business site rarely needs, such as removing Cloudflare's branding.

A widget is one pair of keys, a site key for the page and a secret key for your server. The free plan's real limit is the hostname list. Every domain the widget runs on has to be on it, a staging copy included, or the widget shows error 110200 and nobody can send.

What reCAPTCHA costs now that it runs on Google Cloud#

Google finished moving every classic reCAPTCHA key into Google Cloud in the first quarter of 2026. Its migration timeline says keys without a Google Cloud project lost API access at that point. Prices now follow Google Cloud's tiers, updated on 9 September 2026. Essentials is free up to 10,000 assessments a calendar month. Premium adds an 8 dollar flat fee for 10,001 to 100,000, and past 100,000 the price is 1 dollar per 1,000.

The free 10,000 is per organization, and Google counts it across every account and every site. A business with several sites, or an agency that set up reCAPTCHA for its clients under one organization, shares one allowance.

The part to check today is what happens past the allowance without billing set up. Google's migration page says the classic verify call then fails open: it answers success, with a score of 0.9. The response carries an error message, and Google emails the key's owners before it enforces the limit. A form that reads only the score lets every sender through for the rest of the month, bots included.

I would expect a contact form to stay well under 10,000. The usual ways past it are v3 running on every page view, a login under attack, and many sites sharing one organization.

What visitors see with each one#

Turnstile has three modes, set on the widget in the Cloudflare dashboard. Managed, which Cloudflare recommends, decides for each visitor between running quietly and showing a checkbox. Non-interactive shows a small spinner and never asks for a click. Invisible shows nothing at all. None of them asks anyone to find traffic lights in a grid of photos.

reCAPTCHA v2 is the checkbox that sometimes turns into image puzzles, and v3 shows no puzzle and gives your server a score to act on instead. The puzzles cost people time. In a USENIX Security 2023 study of 1,000 paid participants, reCAPTCHA's image challenges took 15 to 26 seconds and were solved correctly 81 percent of the time. In the same paper's abandonment test, 174 of the 574 people who started gave up, or 30 percent. Those were paid crowd workers, and Turnstile was not tested, so the figures show what a puzzle costs without predicting your own numbers.

My form runs Turnstile so that the check only shows itself when Cloudflare wants a click. It starts in the background when the visitor begins typing, so the pass is usually ready before they press send.

What each one collects, and what your privacy notice needs#

Cloudflare's Turnstile Privacy Addendum, last updated on 18 June 2025, lists what Turnstile receives: the visitor's IP address, TLS fingerprint and user agent, plus your site key. Cloudflare acts on your behalf when it protects your form, and on its own behalf when it uses that data to improve Turnstile. For invisible mode, Cloudflare's widget documentation makes it a condition that your own privacy policy references that addendum.

reCAPTCHA sets a cookie called _GRECAPTCHA, which Google's reCAPTCHA FAQ describes as necessary for its risk analysis. Google lets you hide the badge only if the page shows the line "This site is protected by reCAPTCHA" where people will see it.

In Europe that cookie has already been part of a fine. On 16 March 2023 France's data protection regulator, the CNIL, fined an electric scooter rental company 125,000 euros. One of its findings was that reCAPTCHA read and wrote cookies at account creation and login without informing users or asking for consent. The CNIL's cookie guidance says a CAPTCHA used only for security needs no consent, and one whose provider reuses the data for its own purposes does, with reCAPTCHA as its example.

No regulator has ruled on Turnstile that I could find, so "Turnstile needs no notice" is not a safe claim either. My own privacy page names it: the contact page loads Cloudflare Turnstile, which is a request to Cloudflare and to nobody else. If your customers are in Europe, show your privacy notice to whoever advises you before you switch either one on.

The enquiry Turnstile cost me, and the fix#

Every comparison page treats a failed check as a bot. On a business form, a failed check is often a person. It can be an ad blocker that stops challenges.cloudflare.com, a company network that filters scripts, an in-app browser, an old phone or a connection too slow to finish in time. Cloudflare's own supported browsers page warns that ad blockers, privacy tools, VPNs and in-app browsers can interfere.

That is how I lost the enquiry on 12 September. The form sent the message without a pass, and the server filed it with the spam. The next day I changed what the server does, so a send now has three outcomes instead of two.

• A valid pass is the strongest sign of a person, and the message goes straight into the pipeline.
• A pass that arrives but fails the server check is forged or replayed, so it is spam, and it is counted.
• No pass at all is treated as a person whose browser could not run the check. The message is kept and marked. It still has to pass the form's other checks, and a strict daily limit stops that lane from turning into a way in for bots.

The page changed too. The check now starts on the visitor's first keystroke, and the pass is refreshed on its own if it expires while they type. At send, the browser waits up to eight seconds for Cloudflare's script, then up to fifteen more for a fresh pass. If none comes, it sends the message without one rather than leaving the visitor staring at a frozen button. It never sends a pass that is more than four minutes old, because Cloudflare's passes last five.

If your form is a WordPress plugin rather than code you own, look for the same behaviour in its settings. The Simple CAPTCHA with Cloudflare Turnstile plugin, for example, has a failsafe for when Cloudflare itself is down: it lets submissions through or falls back to reCAPTCHA. Its page does not say whether that failsafe also covers a widget blocked in a single visitor's browser, so test it before you rely on it.

Why Cloudflare Turnstile says verification failed#

"Verification failed" is almost always your own server refusing the pass, and Cloudflare's server check names the reason. These are the three a business form runs into:

• timeout-or-duplicate means the pass was already used. Each pass works once, so a visitor who fixes a field after an error and presses send again is refused unless the form fetches a new pass. The Bricks page builder fixed exactly this in its 2.3.2 release in April 2026.
• invalid-input-response means the pass is malformed or expired. Passes last 300 seconds, so a long quote form left open while someone finds their measurements expires under them.
• missing-input-response means no pass arrived at all, which is the case in the section above.

One failure never shows as an error: a form that never calls the server check at all. Cloudflare's validation page says the widget alone does not protect your forms. If a plugin puts the widget on the page and nothing on the server checks the pass, bots post straight past it while the page looks protected.

Cloudflare Turnstile not working, for visitors and for owners#

If you are a visitor stuck on someone else's form, Cloudflare's error codes page suggests turning off ad blockers and VPNs for the page, checking that JavaScript is on, and trying a private window or another network. A wrong clock on your device can also break the check. Past that, only the site's owner can fix it. If the whole site blocks you and not just one form, that is Cloudflare's firewall, which is the guide on why Cloudflare is blocking you.

If it is your own site, the widget's error code says where to look:

• 110200: the domain is not on the widget's hostname list, which is common after moving to a new domain or on a staging copy.
• 200500: the widget's frame could not load, because of an ad blocker or because your own Content Security Policy blocks challenges.cloudflare.com.
• 200100: the visitor's clock is wrong, or a cached page served an old challenge.
• 110600 and 110620: the check or the click took too long. Cloudflare retries both.
• Codes starting with 300 or 600: the check decided the visitor behaved like a bot.

The Content Security Policy is the one developers miss when they tighten a site's headers. Mine allows challenges.cloudflare.com for scripts and frames, and it is the only outside address the site loads anything from, on the contact page alone. You can see it in the response headers of any page on norvahl.com.

Cloudflare Turnstile not loading on a contact form#

When the widget never appears on a WordPress contact form, look at the page around it first. These are the causes owners report on WordPress.org and in Cloudflare's community:

• A page cache, or a page builder's element cache, serves an old copy of the form. On Elementor Pro, the plugin author's fix was to set the form widget's element caching to inactive and clear every cache.
• A speed plugin delays or defers JavaScript, so the widget's script runs late or not at all.
• On a multi-step form, the widget sits on a step the visitor never loads, and the pass is empty at send. Moving it to the last step, beside the send button, fixed it for one Gravity Forms site.
• The form lives in a popup, and the widget does not render inside it.
• The site's domain is missing from the widget's hostname list, which shows as error 110200.

If you run a speed plugin, send yourself a test message after every change to its JavaScript settings. Nothing errors on your side when the widget stops loading, so it is an easy way to lose enquiries for weeks without noticing.

Cloudflare Turnstile on WordPress#

Most WordPress sites add Turnstile through the plugin people search for as Simple Cloudflare Turnstile. On WordPress.org it is now called Simple CAPTCHA with Cloudflare Turnstile, by Elliot Sowersby of RelyWP. It shows more than 200,000 active installations and a 4.7 rating from 256 reviews, and version 1.43.1 came out on 11 September 2026. It covers WordPress's own login, registration and comment forms, WooCommerce's checkout and account forms, and the major form plugins.

Several form plugins now include Turnstile themselves, by their own documentation: Contact Form 7, WPForms, Gravity Forms through an official add-on, and Fluent Forms. If yours does, use its built-in setting and skip the extra plugin. Elementor Pro's forms did not have it built in as of October 2025, going by Elementor's own GitHub discussions, so Elementor sites still add it with a plugin.

The setup is the same wherever it goes. Create a widget in the Cloudflare dashboard with every domain the form runs on, paste the site key and secret key into the plugin, and send a test message from a private window.

"Google catches more bots, so reCAPTCHA must be safer"#

I hear this often, and no public test settles it. Neither company publishes a catch rate you could compare with the other's, and paid solving services advertise ways around both. On my own form the widget is one check among several. It sits next to a hidden field, a timing check and a daily limit per sender, and I would not trust any one of them alone.

What decides whether you lose business is rarely the logo on the checkbox. It is whether the server checks every pass, and what happens to a real person whose browser could not run the check.

Test your form this week#

Open your contact form in a private window with an ad blocker switched on, and send yourself a real message. Then do the same from your phone on mobile data. If either one does not arrive, you have found the leak before a customer did. Last, read your privacy page and check that it names the check you use. A lost enquiry costs more than most owners guess, which is the guide on how fast to reply to a lead.