Joseph SimpsonGoogle’s reCAPTCHA is a widely used anti-bot solution – but it is not the only product on the market.
Other solutions exist that provide more control, a better browsing experience and that accommodate for users with accessibility challenges.
In this article I’ll walk you through the best reCAPTCHA alternatives so that you can keep your sites secure and spam-free – and your customers happy.
Why Consider Alternatives to reCAPTCHA?
reCAPTCHA is easy to integrate and takes care of a lot of bot-based nonsense – but it can be intrusive, and very frustrating for users with accessibility challenges.
Bots have gotten far more sophisticated since 2007 when reCAPTCHA was first used, and Google isn’t always ahead in this arms race:
Google pitted one of its machine learning algorithms against humans in solving the most distorted text CAPTCHAs: the computer got the test right 99.8 percent of the time, while the humans got a mere 33 percent.
– Josh Dzieza, The Verge
Alternative approaches to reCaptcha
These are different methods of anti-bot protection that you can use as standalone solutions, together and alongside CAPTCHAs for maximum effectiveness.
Web Application Firewall (WAF)
A WAF is a powerful tool that filters and monitors HTTP traffic between a web application and the Internet. WAFs protect your website from SQL injection, cross-site scripting (XSS) and other OWASP threats.
In the context of contact forms, WAFs can be configured to analyse typical bot behaviour. Unusual traffic spikes and repeated form submissions from the same IP address are detected, and spam submissions are stopped.
If your websites are hosted with us then you are already covered by our custom tuned WAF that protects contact forms and websites on a platform level.
If not, then I recommend AIOS for its free tier that includes a firewall, login security and content protection features: https://aiosplugin.com
Multi-factor authentication (MFA)
This approach adds an extra layer of security by requiring users to provide extra forms of verification before being given access to a resource; such as the ability to login to your platform and submit a support ticket.
With MFA a user will typically begin the process by entering a username and password. They will then have to submit a code that is given to them by email or text message. If the username, password and code are not entered correctly then the access attempt is stopped.
I recommend WP 2FA: https://melapress.com/wordpress-2fa
Honeypot
This security mechanism detects and deflects attempts at unauthorised use of contact forms through the use of a ‘decoy’ field in the contact form that human users can’t see. The decoy is, however, visible to bots.
When a bot fills out the decoy field, the contact form submission flagged as malicious and prevented from getting through to your client’s inbox.
This functionality is usually added at the contact form level, so my recommendations will partly depend on what you need from your contact forms. This article will help you to find the best contact form solution.
Alternatives to reCAPTCHA
There are several alternatives to Google’s reCAPTCHA that have strong feature sets and compelling USPs.
Here are the best of the best along with a brief description so you can decide which will work best for you:
ALTCHA
ALTCHA uses a proof-of-work mechanism to protect your website. A small computational task is given to a user’s device before any forms can be submitted.
These tasks are easy for legitimate users, but very difficult for bots – which effectively prevents automated spam submissions.
ALTCHA doesn’t use cookies or fingerprinting and does not track users, making it fully GDPR compliant. It’s also free to use, open-source and can be self-hosted.
Best for: Businesses that need a self-hosted, open-source reCAPTCHA alternative that is privacy-focused.
hCaptcha
Fighting fire with fire, hCaptcha is a machine learning based reCAPTCHA alternative that uses complex algorithms to sort humans from bots.
Privacy is a key consideration and, unlike reCAPTCHA, hCaptcha doesn’t track users and is GDPR compliant.
It has a free tier that handles up to a million requests a month, and you can upgrade to the paid tiers if you need the more sophisticated features on offer.
You can also earn money when hCaptchas are solved on your website. This involves machine learning and is bankrolled by data vendors and bot/fraud management services. Read more here: https://www.hcaptcha.com/post/how-hcaptcha-calculates-rewards
Best for: Businesses that need a reCAPTCHA alternative that can generate income and handle large numbers of requests.
AuthKong
AuthKong is a novel alternative to traditional CAPTCHAs that uses a unique slider and icon system that is quick and frictionless to use.
AuthKong adapts its CAPTCHA challenges based on perceived threats, thanks to its data-driven approach. It’s also fast, which not only improves page ranking but also enhances conversion rates.
Best for: Businesses looking for a user-friendly CAPTCHA alternative that adapts its challenges based on perceived threats.
MTCaptcha
MTCaptcha offers a robust CAPTCHA service that we find both user-friendly and highly secure. It’s designed with the user in mind, ensuring a smooth experience while maintaining high security standards.
MTCaptcha places a strong emphasis on privacy and security, making it an excellent choice for businesses that prioritize these aspects.
Best for: Businesses that need a cost-effective anti-bot solution that prioritises accessibility and privacy.
Final thoughts
Choosing the right anti-bot solution is crucial for balancing security and a positive user experience.
By combining appropriate approaches and CAPTCHAs you will ensure your client’s websites are as spam-free as possible which will help to maintain a good working relationship and keep you first in mind for future referrals.
Matthew Telfer
Olivia Oldham
Add comment