We make FindIP Shield, so read this with that in mind. Everything said about reCAPTCHA here comes from Google's own documentation, linked in the sources.
reCAPTCHA tiers, prices and behaviour were read on Google's documentation on October 21, 2026, where reCAPTCHA is now documented as part of Google Cloud Fraud Defense. Plans change; check Google's page before deciding. If something here is out of date, write to [email protected] and we will correct it.
The short version
- reCAPTCHA runs Google's script on the pages you protect. v3 returns a score from 0.0 to 1.0 for each action, which your server must verify; v2 shows a checkbox or a challenge. The free Essentials tier covers 10,000 assessments a month, and the reasons behind a score come only on the paid tiers.
- FindIP Shield scores every visit and form on your site by the network behind it, with the reasons on every event. You choose per form what a risky submit gets: nothing, a slow-down, a Turnstile check, a stop or a redirect. Ordinary visitors never see a challenge, and Turnstile loads only when one is needed.
Side by side
| FindIP Shield | reCAPTCHA | |
|---|---|---|
| What it judges | The network and the session: VPN, proxy, Tor, relay, hosting, malicious IP, and address or network changes within the session | The interaction, as assessed by Google's script and models |
| What you get back | A 0 to 100 score, a recommendation (allow, monitor, challenge, block) and the reasons, on every event | v3: a score from 0.0 to 1.0 and the action name, verified by your server. v2: a passed or failed challenge |
| Why a score is low | Reason codes such as hosting_network or proxy_detected, each with a sentence, on every plan | Not on Essentials; basic reasons on Premium, advanced on Enterprise |
| Who sees a challenge | Only the submits you chose to challenge, for example the challenge recommendations on your signup form | v2: the visitors shown the widget. v3: no challenge; your code decides what a low score means |
| Acting on the result | Configured in the dashboard per form, plus rules by user, visitor, IP, country, network or submit velocity. A server verify endpoint when you want it | Your server reads the score and decides; Premium adds a policy engine limited to three rules |
| How it is installed | Script tag, npm package, Google Tag Manager, WordPress plugin, Shopify app, or a no-code Cloudflare integration | Google's script on the page plus a server-side verification call; keys now live in a Google Cloud project |
| Free | Free Preview: no per-call charge, up to 10,000 recorded events per site per day. Turnstile, used for challenges, has a free Cloudflare plan | Essentials: free up to 10,000 assessments per calendar month, with a billing instrument on file |
| Paid | No paid plan during the Free Preview | Premium: free to 10,000, a flat $8 from 10,001 to 100,000, then $1 per 1,000. Enterprise: a monthly volume commitment at $1 per 1,000 |
Why teams look for a reCAPTCHA alternative
A score without a reason is hard to act on
A v3 score of 0.3 tells you to worry, not why. On the free tier there are no reasons at all, so a threshold is set by trial and error and a real customer caught by it is hard to explain. Shield shows the reason on every event, so you can see that a signup scored high because it came from a hosting network with a changing address, and decide what that deserves on your site.
Challenging everyone costs conversions
A checkbox or puzzle on every signup is paid for by every real customer. Shield inverts that: everyone is scored, nobody is challenged by default, and you add a Turnstile check only for the recommendations you choose. A pass lasts for the rest of the session, so the same visitor is not asked twice.
The bill and the Google Cloud move
reCAPTCHA keys now live in Google Cloud projects; Google stopped issuing classic keys in 2024 and scheduled the remaining keys to move into projects through early 2026. Above 10,000 assessments a month the free tier ends. Shield records up to 10,000 events per site per day without a per-call charge.
How Shield replaces the challenge on a form
- Install and watch. Add Shield with a plugin, an app, a tag or one script tag. Every form submit is scored; nothing is blocked.
- Add your Turnstile keys. Create a free Turnstile widget in Cloudflare and paste the site key and secret into Shield's settings. The secret never leaves Shield.
- Pick the response. Give the signup form a Turnstile check for challenge recommendations, and a stop for blocks. Shield loads Turnstile only when a challenge is actually needed, and records every outcome.
- Verify on your server. Before creating the account, call Shield's verify endpoint. It returns the recommendation and whether the challenge was passed. Then remove reCAPTCHA from the form.
Without Turnstile keys, the challenge response falls back to a slow-down, and if Cloudflare cannot be reached the challenge fails open and the outcome is recorded as such.
When to keep reCAPTCHA
- You rely on Google's assessment of the interaction itself. Shield judges the network and the session; it does not analyse mouse movement or typing.
- You protect Android or iOS apps with reCAPTCHA's mobile SDKs. Shield is a website product.
- You use reCAPTCHA's account protection or payment-transaction features on its paid tiers.
They can also run side by side during a switch: install Shield in monitor mode next to reCAPTCHA, compare what each flags for a week, then decide.
Questions
Is Shield a CAPTCHA?
No. Shield is visitor risk scoring. When a challenge is the right response, Shield shows a Cloudflare Turnstile check, which needs no puzzle from most visitors, and only to the submits you chose to challenge.
Do I still need a privacy notice?
Yes, as with any tool of this kind: the visitor notices and consents your jurisdiction requires stay with you, and the WordPress plugin offers suggested text for the privacy policy. Shield never collects form values, passwords, raw emails, phone numbers or payment fields, and three privacy modes control what it does collect.
What does it cost to replace reCAPTCHA with Shield and Turnstile?
Shield is free in the Free Preview, up to 10,000 recorded events per site per day. Cloudflare's Turnstile plan page lists a free plan with unlimited challenges.
Sources
- reCAPTCHA tiers and prices: Google Cloud documentation
- Classic key migration: Google Cloud documentation
- reCAPTCHA v3 scores and verification: Google developers; reason codes: Google Cloud documentation
- Cloudflare Turnstile plans: Cloudflare documentation
- FindIP Shield: enforcement and Turnstile setup, server verification, privacy modes, Free Preview terms
reCAPTCHA and Google Cloud are trademarks of Google LLC; Cloudflare and Turnstile are trademarks of Cloudflare, Inc. FindIP is not affiliated with either company.
Score first, challenge only the risky
Install Shield in monitor mode next to your current CAPTCHA and see who it would have challenged.