Websites

Which spam filter should sit on your contact form?

A contact form with no protection usually fills your inbox with junk soon after it goes live. The fix is a small check that tells bots from people. The checks differ in what they ask of your visitor, what they collect about them, and whether the free plan covers a business site.

Checked against each vendor's own pages on October 14, 2026. Every cell links to its source. Prices and plans change often, so click through before you buy.

Turnstile

Cloudflare

Free plan
Yes: $0 plan, unlimited challenges, up to 20 widgets per account.The plans page shows no non-commercial-only condition and no monthly request cap. Free also has 10 hostnames per widget and 7-day analytics. Page shows 'Last updated Aug 14, 2026'.Cloudflare Turnstile plans
First paid plan
No paid plan with a price is listed. Enterprise is 'Contact Sales'.The plans page lists only Free and Enterprise (unlimited widgets, 200 hostnames per widget, 30-day analytics, offlabel option). Pro/Business not mentioned. cloudflare.com/plans/ does not mention Turnstile.Cloudflare Turnstile plans
What the visitor has to do
Varies by mode: a checkbox only for some visitors (managed, recommended), or fully hidden (invisible).Managed is labeled recommended; the docs name no default mode. Non-interactive: visitors never need to interact. Invisible: widget completely hidden.Cloudflare Turnstile developer docs
Data collected
Client IP, TLS fingerprint, User-Agent header and sitekey (with associated origin). Cookies: the privacy page calls the signals strictly necessary and points to the Cookie Policy; it does not list Turnstile cookies.Privacy page last updated June 18, 2025. Developer docs mention a Pre-Clearance cookie for single-page apps (optional feature).Cloudflare Turnstile privacy addendum Cloudflare Turnstile developer docs
How you check the result
Yes: your server POSTs the visitor token and secret key to siteverify.Endpoint is POST https://challenges.cloudflare.com/turnstile/v0/siteverify. Required parameters are secret and response (the visitor token).Cloudflare Turnstile server-side validation
Our pick
Free, mostly invisible, and your form handler verifies the token server-side. This is what runs on spearworksai.com.

reCAPTCHA

Google

Free plan
Yes, free up to 10,000 assessments per calendar monthRequires a valid billing instrument in Google Cloud. Non-commercial-only condition: not published on the pages checked.reCAPTCHA compare tiers reCAPTCHA FAQ
First paid plan
Premium: $8.00 flat fee per month for 10,001 to 100,000 assessmentsAbove 100,000 it is $1.00 per 1,000 assessments. Enterprise is a fixed monthly volume commitment at $1 per 1,000 assessments.reCAPTCHA compare tiers
What the visitor has to do
Not publishedThe compare page lists visual bot challenges in all tiers but not the default mode. The v2 display page is deprecated and does not describe checkbox, puzzle or invisible behavior.reCAPTCHA compare tiers
Data collected
Sets a necessary cookie, _GRECAPTCHA, for risk analysisThe full list of visitor data collected is not published on the pages checked.reCAPTCHA FAQ
How you check the result
Yes. Classic reCAPTCHA: POST to siteverify with a secret keyEnterprise uses POST https://recaptchaenterprise.googleapis.com/v1/projects/PROJECT_ID/assessments with an API key or gcloud access token, not a secret key.reCAPTCHA verify docs reCAPTCHA create assessment docs
Our pick
Free to 10,000 checks a month and everyone knows it, but it sets a cookie and shows puzzles to some visitors.

hCaptcha

Intuition Machines

Free plan
Basic (Free) at $0; no request cap, time limit or non-commercial condition publishedPricing page lists Basic (Free) at $0 with no cap, time limit or non-commercial condition stated. No prices-effective date on the page (footer shows 2025).hCaptcha pricing hCaptcha FAQ
First paid plan
Pro: $99/mo billed yearly, $139/mo billed monthly; 100K evals included, then $0.99/1KYearly billing is the lower rate. Pro has a 14-day trial with no payment required; the account moves to Free after 14 days if Pro is not kept. No prices-effective date shown.hCaptcha pricing
What the visitor has to do
Shown a challenge on Auto; Pro adds a 99.9% passive modeFAQ says Auto always presents a challenge of varying difficulty. The default setting is not stated, and puzzle or checkbox formats are not named. Passive modes are listed for Pro and Enterprise.hCaptcha FAQ
Data collected
IP, browser, ISP, platform, device, OS data; mouse movements, scroll, keypress and touch events; sets cookiesPolicy says it uses cookies, including functional and third-party cookies for analysis and marketing, and that the anti-bot service uses only 'consent-exempt' cookies. Privacy Policy last updated October 7, 2025; Cookie Policy September 24, 2025.hCaptcha privacy policy
How you check the result
Server-side POST to https://api.hcaptcha.com/siteverify with your account secret and the response tokenParameters go in the form body, not the URL. A backend is required.hCaptcha docs
Our pick
Free with no cap, but the default mode shows a challenge. Passive mode is on the $99 plan.

Friendly Captcha

Friendly Captcha

Free plan
Free for non-commercial use only: 1,000 requests/month, 1 protected domainFree plan is for non-commercial, low-traffic sites only. Free plan is separate from paid tiers.Friendly Captcha homepage
First paid plan
Starter: €9 per month, up to 1,000 requests/month, 1 protected domainBilled per month; no annual price seen on the page. Free 30-day trial offered (not a free tier).Friendly Captcha homepage
What the visitor has to do
Nothing to do. An invisible check runs in the background, with no puzzle or checkboxRests on homepage wording. Docs did not state a default mode.Friendly Captcha homepage
Data collected
Says it does not track users or store personal user data, and works without HTTP cookies and persistent browser storage. The page does not list the specific fields collected.The privacy page does not specify what data is collected from visitors; it only states 'Usage of data for security purposes only'. 'No cookies' is also listed as a feature on the homepage.Friendly Captcha privacy page Friendly Captcha homepage
How you check the result
Yes. Server POST to https://global.frcapi.com/api/v2/captcha/siteverify with an X-API-Key header; send the frc-captcha-response value as response (sitekey optional)Host global.frcapi.com is named by the vendor docs page on developer.friendlycaptcha.com. The docs call the credential an API key, not a secret key. Accepts JSON or form data.Friendly Captcha siteverify docs
Our pick
Invisible by the vendor's description, with a privacy-first pitch. The free tier is non-commercial only, so a business pays from €9.

Akismet

Automattic

Free plan
Not confirmed as $0. Personal plan is 'Name your price / Pay what you can', for personal sites and blogs only; no spam-check cap listed.The page never states a $0 amount or a cap. Commercial sites must use Pro or higher.Akismet pricing
First paid plan
Pro: $9.95 per month, billed yearly. 500 spam calls/mo, up to 1 site.Only annual-billing prices shown. Pro is for professional or commercial sites. Higher tiers: $19.90 (1000 calls, 2 sites). No effective date shown.Akismet pricing
What the visitor has to do
Not publishedNeither the pricing page, comment-check docs, nor the FAQ (404) say what a visitor sees. Docs describe a server-side check only. Not stated as invisible.Akismet comment-check docs
Data collected
Collects only the personal data needed to block spam, retained for between two weeks and ninety days for most spam-related data. Cookies: not mentioned.Privacy page lists no specific fields and does not mention cookies. Comment-check docs show the site sends api_key, blog and user_ip (submitter IP address) plus content.Akismet privacy policy Akismet comment-check docs
How you check the result
Server call: POST to https://rest.akismet.com/1.1/comment-check returns true (spam) or false (not spam).Required form fields: api_key, blog, user_ip. Anything other than true/false is an error; errors still return HTTP 200. Key checked with POST to /1.1/verify-key, returns valid or invalid.Akismet comment-check docs Akismet key verification docs
Our pick
A different tool: it filters the message, not the visitor. Built around WordPress, usable elsewhere through its API.

Protect the form without punishing the customer

The best spam filter is one your real customers never notice. Puzzles cost you leads; invisible checks cost you far less.

  1. 01Invisible by defaultIf the visitor has to pick out traffic lights, some of them leave. Prefer a check that runs in the background.
  2. 02Server side tooThe widget on the page is half the protection. The form handler has to verify the token, or bots skip the widget entirely.
  3. 03Two layersA hidden honeypot field costs nothing and catches the simple bots. Use it alongside the real check, not instead of it.

Cap the damage as well: a daily limit on how many messages one form can send you means a bad night is 20 emails, not 2,000.

Spearworks AI

Form getting hammered?

I put Turnstile, a honeypot and a daily cap on the five forms at spearworksai.com. The same setup takes about an hour on most sites, and the free site audit tells you whether your form is protected at all.

Book a free consult

Nathan Spear · spearworksai.com

Spearworks Labs · All comparisons · Checked October 14, 2026. Not affiliated with any vendor listed.