The direct replacement for reCAPTCHA and the easiest recommendation in this article: free, invisible to most visitors, and designed from the outset to avoid the privacy and accessibility problems of image puzzles.

Instead of asking the visitor to prove anything, it runs non-interactive browser challenges and confirms in the background, so the typical experience is a brief tick rather than a grid of bicycles. That removes the accessibility barrier almost entirely and removes the cognitive tax on every legitimate user. It is still a third-party script, so it belongs in your consent thinking, but it is explicitly built not to profile users for advertising, which is a materially different position from the alternative it replaces. If you currently run reCAPTCHA and want out today, this is the swap.

• Price: Free
• Method: Non-interactive browser challenges, usually invisible
• Best for: Anyone replacing reCAPTCHA today
• Watch out for: Still a third-party script for consent purposes

The best value in the category and the strongest answer for a site drowning in spam. $12 a year for one site, $24 for three, $36 for five, $69 for ten, and $27 a month for unlimited sites, with a per-site cost dropping to $6.90 a year in the ten-site package.

Crucially, every package includes unlimited API calls, which is the term to compare against metered alternatives. It filters comments, registrations and form submissions invisibly, assessing the submission and its origin rather than testing the visitor, so there is nothing for a user to solve and no accessibility barrier at all. For twelve dollars a year, a site with a contact form and open comments gets a level of protection that no free client-side method reaches, and the visitor never knows it is there.

• Price: $12/yr for 1 site; $69 for 10; $27/mo unlimited
• Method: Invisible reputational and behavioural filtering
• Best for: Almost any site with real spam volume
• Watch out for: Submissions are assessed by a third-party service

The default WordPress answer, bundled with most installations, and invisible to visitors. The Personal plan is pay-what-you-want, including nothing, for personal sites and blogs, which makes it free for a large share of the people reading this.

Read the commercial tiers carefully, because they are metered in a way most people do not notice. Pro covers one site with 500 monthly spam checks; Business covers unlimited sites with 5,000 monthly checks. A spam check is any comment or form submission evaluated, so a site receiving a few hundred spam comments a week passes 500 in days. The service keeps working past the allowance and support will adjust your plan, but if you are comparing on price, note that CleanTalk’s $12 a year carries no API limit at all. Akismet’s advantage is the breadth of data behind it and that it is already installed.

• Price: Personal is pay-what-you-want; Pro and Business metered
• Method: Invisible filtering against a large shared dataset
• Best for: Personal sites, and anyone wanting zero setup
• Watch out for: 500 monthly spam checks on Pro is low

Free, and the choice when the privacy argument is the point rather than a side benefit. It is built to European data protection expectations and does its filtering without sending submissions to an external service.

That property is genuinely rare here. Every other paid option in this comparison works by sending the submission somewhere to be assessed, which is effective and is a processing activity you have to account for. Antispam Bee keeps the analysis local, which means no third-party processor, no consent question, and nothing to disclose. Its filtering is consequently less sophisticated than a service drawing on millions of sites, so it is strongest on comment spam and weakest against determined form abuse. For a European site with comments and a modest contact form, it is an excellent free fit.

• Price: Free
• Method: Local filtering, no external service
• Best for: Privacy-first sites and comment spam
• Watch out for: Less effective against targeted form abuse

Free, already installed, and switched off on most sites. Every major form plugin now ships honeypot and timing protection, and turning both on takes about a minute per form.

This is the step to take before evaluating anything else, because it removes the bulk of automated submissions at zero cost, zero performance impact and zero accessibility barrier. Look for the honeypot toggle, the minimum submission time setting, and any keyword or country filtering the plugin offers. On many sites the combination of those three settings reduces spam by enough that the remaining volume no longer justifies a subscription. Where it falls short is human-written spam and bots configured for your specific form, which is exactly where a reputational service earns its twelve dollars.

• Price: Free, in the plugin you already run
• Method: Honeypot and timing checks
• Best for: Everyone, as the first thing to switch on
• Watch out for: Nothing against human-written spam

The closest structural equivalent to reCAPTCHA, with a free tier and a stronger privacy position, and included here mainly to mark a boundary.

It solves the privacy objection reasonably well and it does not solve the accessibility one, because it is still fundamentally a visual challenge that some visitors will struggle with and some will fail. An accessibility mode exists and requires the user to register for it, which is friction placed exactly where it should not be. Choose it when you specifically need a visible, deterrent challenge, a login page under active attack, say, where the interruption is the point. For an ordinary contact form, Turnstile does the same job invisibly and free, which is why the recommendation above is what it is.

• Price: Free tier available
• Method: Visual challenge, with an opt-in accessibility mode
• Best for: Pages where a visible deterrent is wanted
• Watch out for: Retains the accessibility problem you are leaving