Replace reCAPTCHA: the checks before you switch

Switching bot checks is mostly an inventory job: where the service is placed, where your server checks its answer, and what happens when one of the two is missing. This article asks first whether you need to switch at all, then gives five steps to follow if you do.

Do you really need to replace reCAPTCHA?

Switching costs time and can turn away real visitors during the changeover. The reasons that justify it are specific:

• visitors complain, or you notice that legitimate submissions are refused;
• what the service stores in the browser or reads about your visitors no longer suits you, or you can no longer describe it to whoever asks;
• its terms of use or billing have changed for you;
• you want a check that asks nothing of the visitor.

If none of these reasons applies to you, keep what you have. “An article advises switching” is not one.

Step 1: list every form

Before touching anything, note every place where the check is installed. For each: the page or template that loads the service, the key it uses, and the place where its answer is checked.

• The obvious forms: contact, sign-up, login, comments, newsletter.
• The forgotten ones: old pages, campaign pages, subdomains, forms of another tool built into your site.
• Forms whose check is done by a plugin or by a form tool: they sometimes have their own key, which your code does not see.

This list serves twice: so that you forget nothing at the switch, and to remove the old service everywhere at the end.

Step 2: understand the two halves

A check of this kind has two halves. In the page, a script adds to the form a hidden field that carries a token. On the server, a call sends that token to the service and reads its answer. The two are replaced together:

• if you remove the script but leave the check, the server no longer receives a token and may refuse every submission;
• if you remove the check but leave the script, the form looks protected and no longer is, with nothing to show you.

So look, in your code or in the settings of your form tool, for where the answer is read.

Step 3: compare on what matters to you

A table of features is not enough. Ask the same five questions of each service, and look for the answer in its documentation rather than on its sales page:

• What does the visitor see: a checkbox, images, or nothing?
• What does it store in the browser, what data of the request does it read, for how long, and who is responsible for it?
• What happens when the service does not answer: does the submission go through or is it refused, and is it you who chooses?
• What does it cost beyond the free offer, and what becomes of your form when the quota is exceeded?
• What does it answer: a verdict alone, or also a rating and reasons?

The reasons help to tune the check; they also inform whoever is trying to get around it. Neither choice is the right one in the absolute.

What each service says about itself, with its source and the date it was read, is in Antisy’s comparisons. For the data, the answer to the second question is to be read with the person who advises you on the law: this article does not cover it.

See: reCAPTCHA alternative: comparison with Antisy · Antisy documentation: an example of what a service writes about its data

Step 4: try before cutting off the old one

Set up the new check on a copy of the site, or on a form where a mistake costs little, before touching production. Then play six cases:

• a normal submission goes through;
• a submission without a token is refused, and the visitor sees a message that offers another way to reach you;
• the same token sent twice is not accepted twice (check what the service’s documentation says);
• the script is blocked by an ad blocker or by a security policy of the page: what does your server receive?
• the service does not answer: cut your server’s access to it, in a test environment, and observe;
• a slow phone, and a run with the keyboard alone and a screen reader.

Note the result of each case: you will replay the list after the switch.

See: CAPTCHA accessibility: what the WCAG and the W3C say · Contact form spam: what to do, measure by measure

Step 5: switch, monitor, remove the old one

Switch one form at a time, starting with one where a mistake costs little, with a way back within the hour. In the days that follow, look for wrongful refusals: messages from visitors who say they could not write, a sudden drop in submissions, submissions that arrived by another channel.

Remove the old service only after that period: the script of each page, the server’s check, then the key at the provider. A script and a key that nobody looks at any more remain a dependency and a risk. If your information pages describe the old service, correct them.

Where Antisy fits in

Antisy is an invisible bot check (sometimes called an “invisible CAPTCHA”), for forms. A tag in the page loads the script; at submission, it puts a short token in the hidden field antisy-token; your server sends this token to Antisy with its secret and reads the answer, allow or deny. There are only these two results, and the answer never gives the reason.

If you have to switch now, do not wait for Antisy: access is by waiting list. The comparisons say what each service that is open today shows, and what it offers that Antisy does not. Antisy has no plugin, does not tell apart solicitations typed by hand, announces no detection rate, and refuses a very slow device that does not finish its computation in time.

See: Comparisons: Antisy and the other services · Glossary: invisible CAPTCHA · Frequently asked questions: what is the difference between Antisy and a CAPTCHA? · The integration guides

Where does Antisy stand?

Access is by waiting list. The API and the dashboard have been in service since 27 October 2026, hosted at Infomaniak, in Geneva; no customer is in production yet. The pilot started on 9 November 2026 on our own forms. Our terms of service and privacy policy have been in force since 9 November 2026. The same day, we ran our guide to protecting a WordPress form in a real WordPress (WordPress 7.1.4, with Contact Form 7 and WPForms).

See: The pilot · Join the waiting list

Frequently asked questions

Can you keep reCAPTCHA and add a second one?

It depends on the two services and on your page: try it in step 4. Even when it is possible, two checks on one form double the failure cases, and you no longer know which one refused a submission. Choose a single check that decides, and keep the old one for observation only: note its answer without following it.

What should you do with the old service’s keys after the switch?

Delete them at the provider once the observation period has passed, and remove them from your code and your configuration files. A secret key you no longer use has no reason to stay in a repository or on a server.

Do you need to tell visitors about the change?

This article does not cover the law. If your texts describe the old service, update them, and ask the person who advises you on the law what you must say.

See also: Contact form spam: what to do, measure by measure · CAPTCHA accessibility: what the WCAG and the W3C say · Comparisons: Antisy and the other services · Bot detection: telling a bot from a human

This article first appeared on antisy.com: Replacing reCAPTCHA: what to check before you switch.