What Is reCAPTCHA?

reCAPTCHA is a free Google tool that blocks bots from submitting your forms, creating fake accounts, or spamming your site. Its version 2 shows the familiar "I'm not a robot" checkbox, while version 3 scores every visit silently from 0.0 to 1.0 with no clicking at all. Google now runs it as part of Google Cloud Fraud Defense.

What does reCAPTCHA do?

reCAPTCHA tells human visitors and automated bots apart, then blocks the bots. Google describes it as providing "core bot defense capabilities" within Google Cloud Fraud Defense (Google Cloud, accessed September 2026).

It sits on the parts of your site that bots abuse: contact forms, sign-up pages, comment boxes, and login pages that face a brute-force attack.

When a visitor acts, reCAPTCHA weighs signals about how they behave. It then decides whether to let them through, challenge them, or block them.

The goal is to stop the flood of automated submissions without turning away real customers.

reCAPTCHA v2 vs v3

The two common versions ask very different things of your visitor. One interrupts; one stays invisible.

Version 2 is the checkbox. The visitor ticks "I'm not a robot", and reCAPTCHA either passes them or shows an image challenge to confirm. An invisible v2 variant runs on a button click instead of a visible box.

Version 3 asks nothing. It returns a score for each request without user friction (Google, accessed August 2026), where 1.0 is very likely human and 0.0 is very likely a bot.

You then decide what to do with low scores. Google suggests a default threshold of 0.5, and says version 3 will never interrupt your users, so you can run it without hurting conversions.

	reCAPTCHA v2	reCAPTCHA v3
Visitor action	Tick a checkbox, sometimes solve an image	None
Output	Pass or challenge	A score from 0.0 to 1.0
You decide	Nothing, it passes or blocks	What to do below your chosen score
Friction for the visitor	Some	None

Source: Google reCAPTCHA documentation, accessed August 2026.

Does reCAPTCHA slow your site or hurt SEO?

reCAPTCHA adds a small script, so there is a minor speed cost, but it does not directly hurt your search rankings. The trade is usually worth it.

The script loads from Google and runs in the background, which adds a little page weight. On a well-built site the effect is small.

Google does not penalize you for using its own bot protection. What can hurt rankings is the spam reCAPTCHA prevents, since junk pages and injected links can even get a site flagged on a malware blacklist.

If speed matters, version 3 or the invisible version 2 avoids the extra click, and you can load reCAPTCHA only on the pages that need it.

reCAPTCHA and visitors in China

reCAPTCHA often fails silently for visitors in mainland China, because it loads from Google, which is blocked there. This catches many Malaysian businesses by surprise.

The form looks perfectly normal to you in Malaysia. Inside China, the reCAPTCHA script cannot load, so the form quietly refuses every real submission.

The first thing we check when auditing a Malaysian site for visitors in China is exactly this. A blocked bot check is a common reason a site fails in China while looking fine everywhere else.

If China traffic matters, an alternative bot check that is reachable there is the fix, not reCAPTCHA.

Frequently asked questions

Is reCAPTCHA free to use?

For most small business sites, yes. Google's free tier covers the contact forms and sign-up pages a typical SME needs. Busier sites pass a monthly free limit, and sites wanting advanced fraud tools move to Google Cloud Fraud Defense's paid tiers. For an ordinary Malaysian business website, the free version is enough.

What is the difference between reCAPTCHA and CAPTCHA?

CAPTCHA is the general idea of a test that tells humans and bots apart; reCAPTCHA is Google's specific product built on that idea. Old CAPTCHAs made you retype distorted letters. reCAPTCHA modernized this into a checkbox, and then into a silent background score, so real visitors do far less work while bots are still filtered out.

Does reCAPTCHA stop all spam?

No, but it stops most automated spam. reCAPTCHA is aimed at bots, so it sharply cuts the flood of machine-submitted forms and fake sign-ups. Determined humans and advanced bots can still get through occasionally. That is why it works best combined with other measures, which our guide to stopping form spam covers in full.

Will reCAPTCHA annoy my visitors?

Version 3 will not, because it runs silently with no checkbox or puzzle. Version 2's checkbox is a small, familiar step most people accept, though the image challenges can frustrate. For the smoothest experience, use version 3 or invisible version 2 on your forms, and reserve visible challenges for pages that face heavy abuse.

Do I still need reCAPTCHA if I have other spam filters?

Usually yes, because it works at a different point. reCAPTCHA blocks bots at the moment of submission, before junk reaches your inbox or database. Server-side filters catch what slips past, and login limits stop guessing that could otherwise get a site hacked. Layered together they beat any single filter, especially on public forms bots target.

Keeping bots off your forms

Storming Solutions builds and maintains websites for Malaysian businesses, and stopping form spam is part of how we deliver a site that stays usable. We fit bot protection that suits your audience, including a reachable alternative when your visitors include mainland China, so real inquiries get through and automated junk does not.

Drowning in form spam, or unsure your bot check works for every visitor? Ask on WhatsApp or read how to stop website form spam, then talk to us about web development.