A contact form with no protection always ends up receiving spam. For years, the reflex has been Google reCAPTCHA. Since 2023, Cloudflare has offered a free alternative, Turnstile. Both block bots. They differ in what they ask of your visitors, in what they send to their publisher and in what they load on your site. For a Quebec site, we clearly prefer Turnstile.
Why protect a form
Spam isn’t just a nuisance. Fake requests drown the real ones in your inbox, clutter your CRM if the form is connected to it, and skew your conversion statistics. Worse, every fake request can trigger a confirmation email to a made-up address. The messages that bounce back slowly damage your domain’s reputation, and your real emails land in spam more often.
Google reCAPTCHA: effective, but not free of trade-offs
reCAPTCHA comes in two main forms. Version 2 shows an “I’m not a robot” checkbox, and sometimes a grid of images where you have to spot traffic lights. Version 3 shows nothing: it gives each visitor a score based on their behaviour.
That discretion has a price. To score visitors well, Google recommends loading reCAPTCHA on forms, but also in the background of other pages. Google’s script then ends up across the whole site, with its weight and what it observes. reCAPTCHA also sets a cookie, _GRECAPTCHA, and Google requires its branding to be shown, either with its badge or with a note that the site is protected by reCAPTCHA. In Quebec, what the tool collects about your visitors therefore deserves a clear line in your privacy policy.
The model has changed too. reCAPTCHA now belongs to Google Cloud: the basic tier stays free up to 10,000 assessments a month, for the whole organization, then becomes paid if billing is enabled. Without billing, assessments are refused once the cap is reached, until the next month. For a small business site, 10,000 is often enough. You still have to know it, and have a Google Cloud project in your name.
Then there is accessibility. A grid of images is an obstacle for a blind or visually impaired person, and the audio alternative is hardly easier. The W3C, the body that publishes the web’s accessibility guidelines, devotes an entire document to the inaccessibility of CAPTCHAs.
Cloudflare Turnstile: the same protection, without the traffic lights
Turnstile never asks anyone to identify images. In its recommended mode, it checks the browser in the background and only shows a checkbox if the visitor looks suspicious. Most people only see a small box that validates itself.
It is free, with unlimited assessments, up to 20 widgets per account. Cloudflare states that it processes only the data needed for verification, that it doesn’t read form content, and that it meets the WCAG 2.2 level AA accessibility criteria. It only loads on pages that have a form.
Contrary to a common belief, it doesn’t require your site to run through Cloudflare’s network. A free Cloudflare account is enough to create the keys. If your site is already behind Cloudflare, as we explain in our article on Cloudflare, the account exists and adding it takes a few minutes.
Turnstile or reCAPTCHA: the comparison
| Cloudflare Turnstile | Google reCAPTCHA | |
|---|---|---|
| Cost | Free, unlimited assessments | Free up to 10,000 assessments a month, then paid |
| What the visitor sees | A box that validates itself, sometimes a checkbox | A checkbox and sometimes images (v2), or nothing (v3) |
| Where the script loads | On pages with a form | On forms, and in the background of pages per Google’s recommendation for v3 |
| Cookie set | No tracking cookie announced | _GRECAPTCHA |
| Accessibility | WCAG 2.2 AA according to Cloudflare | Hard image challenges, limited audio alternative |
| Account needed | Cloudflare, free | Google Cloud |
Data taken from both publishers’ documentation. It changes: check before choosing.
And no CAPTCHA at all?
Often, that’s possible. A honeypot is a field invisible to humans that bots fill in automatically. Gravity Forms has one built in, turned on with one click in the form settings. It loads no external script, sends nothing to anyone and asks nothing of the visitor. Against the simplest bots, it’s enough.
Against more persistent bots, it no longer is, and that’s where Turnstile takes over.
Switching from reCAPTCHA to Turnstile in Gravity Forms
The switch takes half an hour, testing included. In the Cloudflare dashboard, create a Turnstile widget for your domain, in managed mode, and copy its two keys. In WordPress, install Gravity Forms’ Cloudflare Turnstile add-on, paste the keys into its settings, then add the Turnstile field to every form you want to protect. Then remove the reCAPTCHA field from those forms, and the reCAPTCHA add-on if nothing uses it anymore.
Finally, check that Google’s script is really gone. Open a page without a form, view its source code and search for “recaptcha”: nothing should remain. Send yourself a message through every form, from a private browsing window. And update your privacy policy, which should no longer mention reCAPTCHA, but Turnstile.
If your site runs through Cloudflare, two settings prevent unpleasant surprises: Rocket Loader turned off, and form pages excluded from any rule that would cache pages. Those are two of the pitfalls described in our article on Cloudflare.
Our recommendation
For a Quebec site, Turnstile almost always beats reCAPTCHA: nothing for the visitor to do, nothing following them from page to page, and a form everyone can use. On the WordPress sites we build, we add it to Gravity Forms forms when the client already uses Cloudflare. Gravity Forms’ official add-on supports it with every licence.
reCAPTCHA keeps its place in two cases. A plugin the site can’t do without only offers reCAPTCHA. Or the business already uses Google Cloud’s fraud prevention tools for a store and wants everything in one place. Outside those cases, we don’t recommend it.
