How I built a spam-proof contact form for my static site with Cloudflare Workers and reCAPTCHA v3
Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form
Nooshu explains how he set up a secure contact form for his 11ty static site using Cloudflare Pages Functions, Google reCAPTCHA v3, and Resend for email delivery. He walks through the workflow, from user submission to email send, and details how reCAPTCHA v3 works under the hood—analyzing behavioral signals, device fingerprints, and network reputation to score users. He also reviews five previous form solutions he tried, from Netlify Forms to Botpoison, and shares code snippets for verifying tokens and setting score thresholds.
There’s no need for a really frustrating visual CAPTCHA’s that don’t prove you are human, “they prove that you are American!”
- devy
Google has reduced the free tier limit for reCAPTCHA v3 from 1 million down to 10,000 assessments per month as part of its mandatory migration to Google Cloud. [1] So basically it's NOT a viable anti-spam mechanism for many use cases any more because that 10k asessment is easily breached. Let alone the fact that you can't use recaptcha v3 unless you signs up for Google Cloud as well.
Cloudflare Turnstile is a valid alternative though. [2]
[1] https://docs.cloud.google.com/recaptcha/docs/migration-overv...
- goda90
Is reCAPTCHA v3 the one that has the chance of forcing you to use a Google or Apple phone to scan a QR code even if opening it on a PC?
- dom96
Workers are great for this sort of thing and these days with Turnstile and Email Sending beta[1] you can have Cloudflare handle it all