Defend your site: choosing and checking a CAPTCHA
For site owners: which CAPTCHA or bot defence fits your threat, what it costs, whether it is accessible and allowed, and how to tell it works.
Facts on this page checked 2026-11-01
This section is for people who run a website and have a bot problem, or expect one: a contact form full of spam, a sign-up page filling with fake accounts, a login page under attack, a shop being used to test stolen cards, or a server buckling under crawlers.
It is written by a party with nothing to sell. CAPTCHArena takes no vendor money, uses no affiliate links and runs no CAPTCHA product of its own. Every comparison page we found when we started this site was written by a CAPTCHA vendor or by a company selling something next to it; the most-cited ranking puts its own product first (Prosopo, "Best CAPTCHA", checked 2026-11-01). We wanted one that does not.
The five questions owners actually ask
The same five questions come up again and again in developer forums. We built this section around them.
| Question | Where it is answered |
|---|---|
| Which one should I use? "Which captcha provider do you use and why?" (r/webdev, checked 2026-11-01) | Which CAPTCHA fits my site gives a layered recipe per situation. Match the defence to the threat explains why. |
| Does it still work against AI? "I hear captchas have become increasingly ineffective… due to ai being able to defeat it. Is that true?" (r/webdev, checked 2026-11-01) | Match the defence to the threat for what the research shows today; the Scoreboard for our own measured numbers once the first runs are published. |
| What does it cost at my traffic? A not-for-profit site with 700,000 bot requests a day: "reCAPTCHA and hCaptcha look very expensive" (r/webdev, checked 2026-11-01) | CAPTCHA fact sheets for list prices and free tiers. What it costs an attacker for the other side of the ledger. |
| Is it accessible, private, and allowed in my market? Forced moves to Google Cloud, EU consent handling, and "Google products are also blocked… in mainland China" (r/webdev, checked 2026-11-01) | CAPTCHA accessibility for WCAG 2.2. The fact sheets for privacy and hosting. The chooser has rows for GDPR and for visitors in mainland China. |
| How do I know it is working? "How do you know it's working?… the response codes are so vague" (r/webdev, checked 2026-11-01) | Read your own logs first: the threats page lists what to look at. Later, the self-test will run real agents against your own site, with your consent. |
What this section will not do
- Name a winner. No product is "best". Each one trades friction, privacy, cost and resistance differently, and the right mix depends on the threat.
- Recommend one product as the whole answer. The research points the other way. Visible puzzles are now a speed bump for a motivated attacker (see what lasts), so the useful answer is a set of layers.
- Quote vendor claims as measurements. Where a number is a vendor's own claim, we say so. Where sources disagree, we mark the cell as conflicting.
Measured numbers come later
The resistance figures on these pages come from published papers and vendor documents, each with its date and link. Our own measurements of how each defence holds up against current AI agents and paid solving services will go on the Scoreboard, and these pages will link to them once the first runs are published. The method is on the Scoreboard method page.
Related reading
- How CAPTCHAs work: the invisible score, the puzzle, and proof of work in plain terms.
- The economics of CAPTCHAs: why the price of a solve matters more than its difficulty.
- Vendors and open-source CAPTCHAs: who makes what.
- Browser score: what the invisible check looks at, from the visitor's side.
Pages in Defend your site: choosing and checking a CAPTCHA
- Which CAPTCHA fits my site: a neutral decision table
A layered bot-defence recipe for each threat and constraint, with the reason and the trade-off, from a party with nothing to sell. - Match the defence to the threat
What attackers do in each kind of bot abuse, which defensive layers help, which do not, and how to tell whether yours is working. - CAPTCHA fact sheets: price, free tier, privacy, hosting
Dated, sourced facts for each CAPTCHA product: what it costs, what the free tier covers, where data goes, and whether you can host it yourself. - CAPTCHA accessibility: what WCAG 2.2 requires and how widgets compare
Which CAPTCHA types WCAG 2.2 allows at AA and AAA, the timing and flashing rules, how common widgets were graded, and a checklist you can run by hand. - What it costs an attacker to get past your CAPTCHA
The published prices of human solving farms, token services, AI models and proof of work, with a worked example of when a CAPTCHA is no barrier. - Self-test your own site against agents (coming) coming
How CAPTCHArena's planned self-test will run real AI agents against a site you prove you own, at low volume, signed, and reported only to you.