Turnstile

Turnstile is what CAPTCHAs should have been all along: free, privacy-preserving, and invisible for the overwhelming majority of users. Integration is a script tag and a server-side siteverify call, and it drops straight into existing forms as a reCAPTCHA replacement in an afternoon.

The free tier is absurdly generous (effectively unlimited for most use), and not feeding user behavior into an ad company’s dataset is worth a lot on its own.

It loses points for the failure mode: a small population of users on privacy-hardened browsers, odd VPNs, or old devices get stuck in challenge loops, and when that happens you have very little visibility into why. Support tickets that boil down to “Turnstile won’t pass for this one customer” are painful to resolve. Plan an escape hatch for those users.