Hosted captcha pricing: what each one costs for ten client sites

The comparison

We held one scenario constant: an agency running 10 client sites with roughly 10,000 form submissions a month. We picked it because for anyone looking after more than a handful of sites, the domain limit — not the request limit — is what forces the upgrade.

Two of them are free. Start there.

If nobody is going to ask you what your forms do with visitor data, use Turnstile. It is free, the challenge volume is unlimited, it covers 20 widgets with 10 hostnames each, and it meets WCAG 2.2 AAA. We are not going to pretend otherwise, and a page that hid it would not be worth reading.

The reason to pay anything at all is narrow: you have to be able to describe, in writing, what happens to a visitor who fills in your form — and you would rather that description be short. If that sentence describes your week, keep reading. If it does not, you have your answer and it is free.

Why the paid options cost what they cost

ALTCHA Cloud — €47/mo, or €137 for ten sites. The closest product to ours on the market: the same proof-of-work mechanism, run by the vendor. The €47 entry plan covers 3 sites and 1,000 API requests a day, with bursts capped at 100 an hour. Ten sites moves you to Cloud Plus at €137. ALTCHA is a serious, well-built product and it is the comparison we would make if we were you. It is also open source, which we are not — page 2 is the honest version of that argument.

Friendly Captcha — €9, €39, or €200. A German company, "Made in Europe", GDPR compliant on every tier by their own description. The €9 Starter plan caps at 1 domain and 1,000 requests a month; Growth at €39 caps at 5 domains; ten client sites needs Advanced at €200.

To be straight about it: at one domain and 1,000 requests a month, Friendly Captcha's €9 Starter plan is cheaper than our €19. If you have one site and low volume, they are the better buy on price. Our pricing is built around people with more than one site.

hCaptcha — $139/mo for Pro, or $99 a month billed annually, covering 100,000 monthly evaluations. If you need that volume on one site, it is competitive. If you need ten domains and 10,000 submissions, you are paying for headroom you will not use.

BotShield — €19/mo. 10,000 solves, 3 projects, 10 protected domains. Proof-of-work with adaptive difficulty: the browser does a small piece of computation to prove it is worth serving, instead of asking the person to identify a crosswalk. On the published prices above, that is the cheapest vendor-run captcha we could find covering ten domains, as of 8 October 2026. If you find a cheaper one, we would genuinely like to know.

Where the data goes — ours included

This is the section most comparison pages get wrong, including ours in an earlier draft. So: here is what each vendor publishes about data handling, in their own words, and here is what we measured about ourselves.

Every line in that table is the vendor's published wording, not an audit. We have not inspected ALTCHA's or Friendly Captcha's infrastructure, and you should not take our word about their systems. Read it as what each company has committed to in public — which is useful, and is not the same as verified.

Including ours. So here is ours, with the awkward part first.

Our origin server is a bare-metal machine in Helsinki. But botshield.dev is served through Cloudflare, which means Cloudflare terminates TLS for every verification request and sees the visitor's IP address — the same as it does for a large share of the web, including some of the vendors above. The edge is anycast, so we will not tell you which country handled any given request. For that reason we do not claim an EU-only data path, and you should not accept that claim from anyone who has not shown you their headers.

What we will claim is narrower and checkable:

# No cookie is set, by either URL:
curl -sD - -o /dev/null https://botshield.dev/sdk.js        | grep -i set-cookie
curl -sD - -o /dev/null -X POST https://botshield.dev/api/v1/solve | grep -i set-cookie

# No client-side storage or fingerprinting in the widget:
curl -s https://botshield.dev/sdk.js > sdk.js
grep -c -E 'document\.cookie|localStorage|sessionStorage|indexedDB|canvas|navigator\.userAgent|navigator\.plugins|AudioContext|WebGL' sdk.js

# Every host the widget talks to:
grep -o -E 'https?://[a-zA-Z0-9./_-]+' sdk.js | sort -u

Measured again on 9 October 2026, those return: no Set-Cookie header on either URL, zero matches for every storage and fingerprinting API in the list, and exactly one host — botshield.dev, on two paths, /api/v1/challenge and /api/v1/solve. The widget your visitors load, sdk.min.js, is 22,235 bytes; the readable build, sdk.js, is 40,453 bytes, and you can read all of it.

One more path exists and we would rather tell you than have you find it: /api/v1/verify, the server-side check. Your server calls that one, with your secret key, after the form is submitted. The visitor's browser never touches it — which is also why the two commands above only need to cover the two the widget uses.

Our server code is public too, at github.com/spaghettisi/scaptcha, including the part that truncates IPv4 addresses to /24 and IPv6 to /56 before anything is written down.

Run the commands. That is the point of printing them. A privacy claim you verified in forty seconds is worth more than one we put in a badge — and it is the one thing on this page no competitor here offers you.

Our privacy policy names every processor, and what we have not verified yet →

That last part is deliberate. The policy has a section headed "What we have not yet verified, we are not claiming" — which Cloudflare locations handle the traffic, what Cloudflare retains, how our database is backed up, and the fact that we do not yet have a data processing agreement covering any of it. If you need a signed DPA this quarter, that is a reason to buy from someone else, and you should know it from us rather than from a procurement form in six weeks.

Which one to pick

• No one is going to ask you about form data? Turnstile, free. Done.
• One site, low volume? Friendly Captcha Starter at €9.
• Want to own the whole stack and have somewhere to run it? ALTCHA's open-source widget is free under the MIT licence. Page 2 is an honest account of what running it yourself costs you.
• Need the source code open for contractual reasons? ALTCHA Cloud. We cannot offer that.
• Several client sites, and you would rather the privacy answer be a short paragraph you can prove? That is what we built BotShield for, at €19 a month.

Start on the free plan

1,000 solves a month, 1 project, 2 domains, no card required — and invisible mode is included on the free plan, not held back for a paid one. Two lines of code. If it does not survive your own contact form, you will know within the hour.

Start free