Migrating from Googles reCAPTCHA to Cloudflare Turnstile?
Google reCAPTCHA new pricing will be rolled out on August 1st, meaning that you have a few days left to migrate to a cheaper alternative or ensure your bank account is well-funded.
Starting at $1 for 1,000 verifications, it is going to cost a lot. At Mailmeteor, we use reCAPTCHA extensively to protect our services from bots. With Google's pricing change, we calculated that we're about to pay thousands of dollar per month to keep using their reCAPTCHA service.
What's a CAPTCHA?
CAPTCHAs are an essential part of the web. It aims to separate good citizens from bad actors. Essentially, it's a service that will operate on the frontend and generate a token that is transmitted to the backend. The backend then verifies that the token is legit, and, if so, performs the action.
Google did a great job at promoting their own service, but thankfully, there are some alternatives:
- hCaptcha. We considered it at first, but their pricing is quite similar to new Google's pricing.
- Cloudflare Turnstile. We are huge fans of Cloudflare, and definitely looked into it. As for now, it's a free service.
Let's dig in.
Moving away from Google reCAPTCHA...
One of our free tools is an AI Email Writer. It's basically an HTML page that send request to our backend, which then makes to a third-party AI solution.
To protect it from abuse, Google reCAPTCHA was enabled from day one. Here's how the verification was done so far (backend-side):
// index.js app.post('/api/email-ai-writer', recaptcha.middleware.verify, aiEmailWriter) // ai_email_writer.js async function aiEmailWriter(request, response) { try { // Recaptcha if (!request.recaptcha || request.recaptcha.error || !request.recaptcha.data) { console.warn('Recaptcha: verification failed.') return response.status(403).send({ error: true, message: 'Recaptcha: verification failed' }) } else if (request.recaptcha.data.action !== 'aiemailwriter') { console.warn('Recaptcha: bad action name') return response.status(403).send({ error: true, message: 'Recaptcha: bad action name' }) } else if (request.recaptcha.data.score < 0.3) { const score = request.recaptcha.data.score console.warn(`Recaptcha: score is below 0.3 (${score})`) return response.status(403).send({ error: true, message: 'Recaptcha: score too low' }) } ...
That's quite simple and it's an essential part of why Google reCAPTCHA was so popular. The footprint is very limited and it's really easy to implement. For the most curious ones, we leveraged the express-recaptcha package to make it really easy to implement.
... to Cloudflare Turnstile
When migrating to Turnstile, we couldn't found an NPM package, so we had to write a middleware to process the token. Here's how it looks like:
// middlewares/turnstile.js const turnstile = async (request, response, next) => { try { // Turnstile injects a token in "cf-turnstile-response". const token = request.query['cf-turnstile-response'] const ip = request.header('CF-Connecting-IP') if (!token) { throw new Error('Missing CloudFlare Turnstile Token') } // Validate the token by calling the // "/siteverify" API endpoint. const formData = new FormData() formData.append('secret', process.env.CLOUDFLARE_TURNSTILE_SECRET_KEY) formData.append('response', token) if (ip) formData.append('remoteip', ip) const url = 'https://challenges.cloudflare.com/turnstile/v0/siteverify' const result = await fetch(url, { body: formData, method: 'POST', }) // Process the verification outcome const outcome = await result.json() if (!outcome.success) { throw new Error('CloudFlare Turnstile declined the token') } request.turnstile = outcome // If authentified, go to next middleware next() } catch (err) { console.error(err) return response.status(403).send('Forbidden') } } export { turnstile }
Once the middleware is in place, we can apply it to any requests:
// index.js app.post('/api/ai-email-writer', aiRateLimiter, turnstile, aiEmailWriter)
And inside the function that treats the request, it's quite similar to what we had previously:
// ai_email_writer.js async function aiEmailWriter(request, response) { try { // CloudFlare Turnstile protection if (!request.turnstile || request.turnstile.error) { console.warn('Recaptcha: verification failed.') return response.status(403).json({ error: true, message: 'Recaptcha: verification failed' }) } else if (request.turnstile.action !== 'aiemailwriter') { console.warn('Recaptcha: bad action name') return response.status(403).json({ error: true, message: 'Recaptcha: bad action name' }) } ...
Conclusion
Migrating from reCAPTCHA to Turnstile is straightforward and shouldn't take more than a few hours. It works quite similar and will definitely save you a lot of money at the same time.
I didn't cover the frontend in this article, because we use an invisible widget that our users don't see. But Turnstile's documentation covers extensively how to use their interactive widgets.
Call it a day!
The above is the detailed content of Migrating from Googles reCAPTCHA to Cloudflare Turnstile?. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics











JavaScript is the cornerstone of modern web development, and its main functions include event-driven programming, dynamic content generation and asynchronous programming. 1) Event-driven programming allows web pages to change dynamically according to user operations. 2) Dynamic content generation allows page content to be adjusted according to conditions. 3) Asynchronous programming ensures that the user interface is not blocked. JavaScript is widely used in web interaction, single-page application and server-side development, greatly improving the flexibility of user experience and cross-platform development.

The latest trends in JavaScript include the rise of TypeScript, the popularity of modern frameworks and libraries, and the application of WebAssembly. Future prospects cover more powerful type systems, the development of server-side JavaScript, the expansion of artificial intelligence and machine learning, and the potential of IoT and edge computing.

Different JavaScript engines have different effects when parsing and executing JavaScript code, because the implementation principles and optimization strategies of each engine differ. 1. Lexical analysis: convert source code into lexical unit. 2. Grammar analysis: Generate an abstract syntax tree. 3. Optimization and compilation: Generate machine code through the JIT compiler. 4. Execute: Run the machine code. V8 engine optimizes through instant compilation and hidden class, SpiderMonkey uses a type inference system, resulting in different performance performance on the same code.

JavaScript is the core language of modern web development and is widely used for its diversity and flexibility. 1) Front-end development: build dynamic web pages and single-page applications through DOM operations and modern frameworks (such as React, Vue.js, Angular). 2) Server-side development: Node.js uses a non-blocking I/O model to handle high concurrency and real-time applications. 3) Mobile and desktop application development: cross-platform development is realized through ReactNative and Electron to improve development efficiency.

Python is more suitable for beginners, with a smooth learning curve and concise syntax; JavaScript is suitable for front-end development, with a steep learning curve and flexible syntax. 1. Python syntax is intuitive and suitable for data science and back-end development. 2. JavaScript is flexible and widely used in front-end and server-side programming.

This article demonstrates frontend integration with a backend secured by Permit, building a functional EdTech SaaS application using Next.js. The frontend fetches user permissions to control UI visibility and ensures API requests adhere to role-base

The shift from C/C to JavaScript requires adapting to dynamic typing, garbage collection and asynchronous programming. 1) C/C is a statically typed language that requires manual memory management, while JavaScript is dynamically typed and garbage collection is automatically processed. 2) C/C needs to be compiled into machine code, while JavaScript is an interpreted language. 3) JavaScript introduces concepts such as closures, prototype chains and Promise, which enhances flexibility and asynchronous programming capabilities.

I built a functional multi-tenant SaaS application (an EdTech app) with your everyday tech tool and you can do the same. First, what’s a multi-tenant SaaS application? Multi-tenant SaaS applications let you serve multiple customers from a sing
