Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form | Hacker News Reader

Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form

nooshu.com

39 pointsspeckx10 comments

Google has reduced the free tier limit for reCAPTCHA v3 from 1 million down to 10,000 assessments per month as part of its mandatory migration to Google Cloud. [1] So basically it's NOT a viable anti-spam mechanism for many use cases any more because that 10k asessment is easily breached. Let alone the fact that you can't use recaptcha v3 unless you signs up for Google Cloud as well.

Cloudflare Turnstile is a valid alternative though. [2]

[1] https://docs.cloud.google.com/recaptcha/docs/migration-overv...

[2] https://www.cloudflare.com/products/turnstile/

If you're getting hundreds of thousands of spam submissions then you probably need to pay for bot protection.

Workers are great for this sort of thing and these days with Turnstile and Email Sending beta[1] you can have Cloudflare handle it all

1 - https://developers.cloudflare.com/email-service/

Cloudflare Workers and HTMX also pair up well.

That was my thought too .. why use anything but CloudFlare for this? Turnstile works great and it can send email itself.. why go external?

Exactly. You can do it entirely with Cloudflare. Even if you limit yourself to what's available on the free tier, there's a surprisingly wide range of things you can build.

Is reCAPTCHA v3 the one that has the chance of forcing you to use a Google or Apple phone to scan a QR code even if opening it on a PC?

If I hit something like that I am just gonna close the tab and move on with my day.

If it's something really important then I am going to very loudly complain to their support until I can bypass it.

I had my first "scan this code with your phone" last week. Nope. Close tab and never go there again.

Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all.

I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free tier moves under you, which is exactly what happened to reCAPTCHA v3 per the top comment.

The honest counter-argument is that a form converts better than a mailto link. For a business that is true and measurable. For a CV or portfolio site it mostly is not: the messages you actually want arrive by email or DM anyway, and the form collects SEO spam, which is why you then need a captcha, which is this entire thread.

If you do need the form, the Turnstile suggestion upthread is the right shape - one vendor, one failure mode, instead of three services stitched together.

Reply on news.ycombinator.com