Turnstile

Turnstile is what a CAPTCHA should be: free, privacy-preserving, and invisible to most users. Integration needs a script tag and a server-side siteverify call. It can replace reCAPTCHA in an existing form within an afternoon.

The free tier is absurdly generous (effectively unlimited for most use), and not feeding user behavior into an ad company’s dataset is worth a lot on its own.

The failure mode costs it points. Some privacy-hardened browsers, unusual VPNs, and old devices get stuck in challenge loops, with little information about why. A support ticket saying Turnstile will not pass for one customer is painful to resolve. Give those users another way through.