Three weeks ago we swapped reCAPTCHA v3 for Cloudflare Turnstile on the contact form. Here's what changed:
Before (reCAPTCHA)
- Added 38KB of JS, blocking
- Required cookie banner for GDPR
- Failed 12% of legitimate submissions
- Tracked users across sites
After (Turnstile)
- ~6KB, async, non-blocking
- No cookies, no tracking
- Failed 0.4% of legitimate submissions
- Free, no quota
Setup took 15 minutes. The widget is now invisible for 95% of users (managed mode) and only appears for high-risk traffic.