Why We Swapped Google's reCAPTCHA for hCaptcha

Cloudflare has migrated its CAPTCHA provider from Google's reCAPTCHA to hCaptcha, an independent service. The switch addresses long-standing privacy concerns about relying on a Google product and gives Cloudflare more control over how CAPTCHAs are presented. Since this rollout touches every Cloudflare customer, here is the reasoning behind the change and what it means in practice.

How Cloudflare Uses CAPTCHAs

Cloudflare blocks clearly malicious bot traffic outright and lets trusted human or bot traffic through. But when the nature of a request is ambiguous, Cloudflare issues a challenge. Some of these are fully automatic; others require human interaction. Those human challenges are CAPTCHAs — Completely Automated Public Turing Test to Tell Computers and Humans Apart.

Historically, Cloudflare has depended on Google's reCAPTCHA, which began as a Carnegie Mellon research project in 2007 and was acquired by Google in 2009. The initial appeal was clear: it worked effectively, scaled well, and was free, with the cost offset by using the data to train Google's image recognition systems. For a company offering a popular free tier, that economics mattered.

The Case for Moving On

The reasons to reassess that choice built up over time. Cloudflare has strict privacy commitments, and while its team became comfortable with reCAPTCHA's Privacy Policy, customers had legitimate concerns about sending more data to a company whose core business is advertising. Outside of privacy, there was a practical problem: Google's services are intermittently blocked in regions like China, which accounts for roughly a quarter of global Internet users. If a user there triggered a CAPTCHA, they might be cut off from the Cloudflare-protected site entirely.

Still, for years, those concerns were set aside in favor of building and shipping new features. The breaking point came earlier this year when Google announced it would begin charging for reCAPTCHA. Given Cloudflare's massive volume, absorbing that cost for its free users would have meant millions of dollars annually. So Cloudflare finally committed to finding an alternative.

Why hCaptcha Won

After evaluating other vendors and even considering building an in-house system, Cloudflare selected hCaptcha. The criteria were practical: the company doesn't sell personal data, collects only what's necessary, and agreed to restrict data usage to providing the service to Cloudflare. During A/B testing, hCaptcha's speed and solve rates were as good as — or better than — expected. It also came with notable features: support for visually impaired users, Privacy Pass integration to reduce how often users face CAPTCHAs, and reliable performance in regions where Google is blocked. The hCaptcha team also proved responsive, which Cloudflare valued.

Standard hCaptcha's business model resembles what reCAPTCHA was originally: charge companies that need image classification data and pay publishers to display their CAPTCHAs. That works for typical publishers, but not at Cloudflare's scale. Instead, Cloudflare operates the service in two ways. First, it leverages its Workers platform to handle much of the technical load, reducing hCaptcha's infrastructure costs. Second, instead of hCaptcha paying Cloudflare, Cloudflare pays hCaptcha. That guarantees the vendor has resources to scale. The additional costs are a fraction of what a paid reCAPTCHA would have been.

Who Actually Triggers Challenging

A common assumption is that Cloudflare's Bot Management and Firewall Rules consume most generated CAPTCHAs.

  • Firewall and Bot Rules were indeed the top source, but only accounted for slightly over half of all CAPTCHAs served. These are rules customers write to challenge traffic when, say, a Bot Management score falls below a certain threshold, or to CAPTCHA all traffic on a particular endpoint to slow credential stuffing or bot-driven form abuse.
  • IP Firewall rules ranked second, typically based on ASN or country. Many customers distrust traffic from certain cloud providers or block entire countries they consider hostile.
  • Security Levels cover two scenarios: using it as a coarse IP reputation tool, or "I'm Under Attack Mode," which frequently stays enabled permanently as a blunt rate-limiting measure.
  • Automated systems also contribute in targeted scenarios. Specifically, Cloudflare taught its DoS protection bot, Gatebot, to issue temporary CAPTCHAs to mitigate small floods.

Beyond those, some customers use CAPTCHA as an override action for Rate Limiting or Managed WAF rulesets.

The breakdown of who serves CAPTCHAs is also instructive. In a week of traffic (normalized to exclude attacks), free customers generated roughly 40-60% of all CAPTCHAs served by Cloudflare. Paying customers were split roughly evenly between pay-as-you-go and enterprise. Overall, when one or more customers come under attack, Cloudflare has measured itself showing multiple millions of CAPTCHAs per second.

Reporting Problems

Any system-wide change like this will improve experience for some users while causing temporary issues for others. Cloudflare and hCaptcha both state that they will address issues promptly. If a CAPTCHA appears malformed or misbehaves, users should post on the Cloudflare forum or open a Support ticket with as much detail as possible, including the RayID that appears in the footer of the CAPTCHA page when present.

Cloudflare acknowledges that visual and audio CAPTCHAs are an imperfect solution to hard problems. The company says it's continuing to work toward minimizing and eventually eliminating CAPTCHA challenges entirely. The team's internal chat for this project wasn't named New CAPTCHA, but rather (No)CAPTCHA.