CaptchaBox / Docs / Switching

Switch from reCAPTCHA, hCaptcha or Turnstile

Last updated 6 November 2026 · By Mohammad AlSaraf

Usually three small changes: the script, the widget and the verify URL.

CaptchaBox's server check answers in the same format as reCAPTCHA, hCaptcha and Turnstile, so your server code mostly stays as it is. And with data-compat, the widget can even fill the old form field name.

Why people switch

• No puzzles. Visitors never pick traffic lights or bicycles. The check runs in the background, usually in about a second.
• No cookies, no tracking. Nothing is stored in the browser and visitor IP addresses are never stored, so it fits a site without a cookie banner.
• No Google. Nothing loads from google.com or gstatic.com.
• Free for 10,000 checks a month; a month for 100,000.

Be aware of the trade-off: CaptchaBox is proof of work. It makes spam costly and stops the cheap, high-volume bots most sites get, but it does not score visitors by behaviour like reCAPTCHA v3 or Turnstile do. Keep your usual rate limits and moderation.

From Google reCAPTCHA v2

- <script src="https://www.google.com/recaptcha/api.js" async defer></script>
+ <script src="https://captcha.natbox.io/v1/widget.js" async defer></script>

- <div class="g-recaptcha" data-sitekey="OLD_KEY"></div>
+ <div class="captchabox" data-sitekey="NEW_KEY" data-compat="recaptcha"></div>

  // server: only the URL and the secret change
- https://www.google.com/recaptcha/api/siteverify
+ https://captcha.natbox.io/v1/siteverify

reCAPTCHA v3 has no widget and returns a score. Use data-size="invisible" for a similar, quiet look, and treat success as the result: there is no score to compare.

From hCaptcha

Same steps as reCAPTCHA: replace https://js.hcaptcha.com/1/api.js with our script, class="h-captcha" with class="captchabox", and https://api.hcaptcha.com/siteverify with our verify URL. hCaptcha sends both h-captcha-response and g-recaptcha-response; with data-compat="recaptcha" code that reads g-recaptcha-response keeps working. Code that reads h-captcha-response should read captchabox-response instead.

From Cloudflare Turnstile

- <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
+ <script src="https://captcha.natbox.io/v1/widget.js" async defer></script>

- <div class="cf-turnstile" data-sitekey="OLD_KEY"></div>
+ <div class="captchabox" data-sitekey="NEW_KEY" data-compat="turnstile"></div>

- https://challenges.cloudflare.com/turnstile/v0/siteverify
+ https://captcha.natbox.io/v1/siteverify

With data-compat="turnstile" the widget fills cf-turnstile-response, so your server code reads the same field. Turnstile's extra answer fields (action, cdata) do not exist in CaptchaBox.

Plugins and frameworks

• WordPress: turn off your reCAPTCHA plugin and install the CaptchaBox plugin.
• Laravel, Django, Flask, Express, Next.js, PHP: see the guides; each is a few lines.
• A plugin that only knows reCAPTCHA and lets you set the script and verify URLs (some form builders do): enter our two URLs and turn on data-compat="recaptcha" if you can add attributes.

Checklist

1. Add your site in the client area and copy the new site key and secret. Old keys from Google or Cloudflare do not work here.
2. Change the script, the widget and the verify URL.
3. Remove reCAPTCHA or Turnstile from your Content-Security-Policy and add https://captcha.natbox.io to script-src and connect-src, and blob: to worker-src (the check then runs in background threads; without it, it still works, just on the page).
4. Update your privacy policy: CaptchaBox instead of Google or Cloudflare. Ours is here.
5. Send a test form, and one with the test keys cb_test_fail / cbs_test_fail to see a refusal.

Questions? Open a ticket, we reply within 24 hours.