Best Self-Hosted CAPTCHA Alternatives to reCAPTCHA in 2026

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

version: "3.8"

services:
  mcaptcha:
    image: mcaptcha/mcaptcha:latest
    container_name: mcaptcha
    restart: unless-stopped
    ports:
      - "7860:7860"
    environment:
      MCAPTCHA_db_URL: "postgres://mcaptcha:mcaptcha@mcaptcha_db:5432/mcaptcha"
      MCAPTCHA_secret: "your-super-secret-key-change-this"
      MCAPTCHA_siteURL: "https://mcaptcha.example.com"
    depends_on:
      mcaptcha_db:
        condition: service_healthy
    networks:
      - mcaptcha_net

  mcaptcha_db:
    image: postgres:16-alpine
    container_name: mcaptcha_db
    restart: unless-stopped
    environment:
      POSTGRES_USER: mcaptcha
      POSTGRES_PASSWORD: mcaptcha
      POSTGRES_DB: mcaptcha
    volumes:
      - mcaptcha_data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U mcaptcha"]
      interval: 5s
      timeout: 5s
      retries: 5
    networks:
      - mcaptcha_net

  mcaptcha_cache:
    image: redis:7-alpine
    container_name: mcaptcha_cache
    restart: unless-stopped
    networks:
      - mcaptcha_net

volumes:
  mcaptcha_data:

networks:
  mcaptcha_net:
    driver: bridge

1

docker compose up -d

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

<!-- Add the mCaptcha widget -->
<script src="https://mcaptcha.example.com/widget.js" data-sitekey="YOUR_SITE_KEY"></script>

<!-- On form submit, verify the token server-side -->
<!-- Example with Node.js / Express -->
const verify = await fetch("https://mcaptcha.example.com/api/v1/verify", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    sitekey: "YOUR_SITE_KEY",
    secret: "YOUR_SECRET_KEY",
    response: token,
  }),
});
const result = await verify.json();

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

<!-- Add the Turnstile script -->
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

<!-- Widget in your form -->
<form action="/submit" method="POST">
  <div class="cf-turnstile" data-sitekey="your_site_key"></div>
  <button type="submit">Submit</button>
</form>

<!-- Server-side verification (PHP example) -->
<?php
$secret = "your_secret_key";
$response = $_POST["cf-turnstile-response"];
$remoteip = $_SERVER["REMOTE_ADDR"];

$verify = file_get_contents(
  "https://challenges.cloudflare.com/turnstile/v0/siteverify",
  false,
  stream_context_create([
    "http" => [
      "method" => "POST",
      "header" => "Content-Type: application/x-www-form-urlencoded",
      "content" => http_build_query([
        "secret" => $secret,
        "response" => $response,
        "remoteip" => $remoteip,
      ]),
    ],
  ])
);
$result = json_decode($verify);

if ($result->success) {
  // Human verified — process the form
} else {
  // Verification failed
}
?>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

ver[nginx](https://nginx.org/) "3.8"

services:
  captcha-proxy:
    image: nginx:alpine
    container_name: captcha-proxy
    restart: unless-stopped
    ports:
      - "8443:443"
    volumes:
      - ./proxy.conf:/etc/nginx/conf.d/default.conf
      - ./certs:/etc/nginx/certs:ro
    networks:
      - proxy_net

networks:
  proxy_net:
    driver: bridge

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

server {
  listen 443 ssl;
  server_name captcha.yourdomain.com;

  ssl_certificate /etc/nginx/certs/cert.pem;
  ssl_certificate_key /etc/nginx/certs/key.pem;

  location /turnstile/ {
    proxy_pass https://challenges.cloudflare.com/turnstile/;
    proxy_set_header Host challenges.cloudflare.com;
    proxy_set_header X-Real-IP $remote_addr;
  }

  location /api/verify {
    proxy_pass https://challenges.cloudflare.com/turnstile/v0/siteverify;
    proxy_set_header Host challenges.cloudflare.com;
    proxy_method POST;
    proxy_set_body $request_body;
  }
}

1
2
3
4
5
6

<script src="https://js.hcaptcha.com/1/api.js" async defer></script>

<form action="/submit" method="POST">
  <div class="h-captcha" data-sitekey="your_site_key"></div>
  <button type="submit">Submit</button>
</form>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

version: "3.8"

services:
  hcaptcha-onprem:
    image: hcaptcha/onpremise:latest
    container_name: hcaptcha-onprem
    restart: unless-stopped
    ports:
      - "9090:8080"
    environment:
      HC_LICENSE_KEY: "your-enterprise-license-key"
      HC_DATABASE_URL: "postgres://hcaptcha:password@hcaptcha_db:5432/hcaptcha"
      HC_SECRET_KEY: "your-hmac-secret-key"
    volumes:
      - hcaptcha_models:/models
    depends_on:
      - hcaptcha_db
    networks:
      - hcaptcha_net

  hcaptcha_db:
    image: postgres:16-alpine
    container_name: hcaptcha_db
    restart: unless-stopped
    environment:
      POSTGRES_USER: hcaptcha
      POSTGRES_PASSWORD: password
      POSTGRES_DB: hcaptcha
    volumes:
      - hcaptcha_data:/var/lib/postgresql/data
    networks:
      - hcaptcha_net

volumes:
  hcaptcha_models:
  hcaptcha_data:

networks:
  hcaptcha_net:
    driver: bridge

1
2
3
4
5

# Verify hCaptcha response with curl
curl https://hcaptcha.com/siteverify \
  -d "secret=YOUR_SECRET" \
  -d "response=USER_TOKEN" \
  -d "remoteip=USER_IP"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

<script
  src="https://cdn.jsdelivr.net/npm/friendly-challenge@0.9.16/widget.min.js"
  async
  defer
></script>

<form action="/submit" method="POST">
  <div
    class="frc-captcha"
    data-sitekey="your_site_key"
    data-start="auto"
  ></div>
  <button type="submit">Submit</button>
</form>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# Download and serve the widget locally
mkdir -p /var/www/captcha-widget
cd /var/www/captcha-widget

curl -O https://cdn.jsdelivr.net/npm/friendly-challenge@0.9.16/widget.min.js
curl -O https://cdn.jsdelivr.net/npm/friendly-challenge@0.9.16/widget.min.js.map

# Serve with Caddy
cat > Caddyfile << 'EOF'
captcha-assets.yourdomain.com {
  root * /var/www/captcha-widget
  file_server
  encode gzip
}
EOF

caddy run --config Caddyfile

1

<script src="https://captcha-assets.yourdomain.com/widget.min.js" async defer></script>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36

# Python / Flask example
import random
from flask import Flask, render_template_string, request, session

app = Flask(__name__)
app.secret_key = "change-this-to-a-real-secret"

@app.route("/contact", methods=["GET", "POST"])
def contact():
    if request.method == "POST":
        a = int(session.get("captcha_a", 0))
        b = int(session.get("captcha_b", 0))
        answer = request.form.get("captcha_answer", "")

        if str(a + b) != answer:
            return "CAPTCHA failed. Please try again.", 400

        # Process the form
        return "Form submitted successfully!"

    # Generate new CAPTCHA
    a = random.randint(1, 20)
    b = random.randint(1, 20)
    session["captcha_a"] = a
    session["captcha_b"] = b

    return render_template_string("""
    <form method="POST">
      <label>What is {{ a }} + {{ b }}?</label>
      <input type="text" name="captcha_answer" required>
      <button type="submit">Submit</button>
    </form>
    """, a=a, b=b)

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=5000)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Nginx rate limiting configuration
limit_req_zone $binary_remote_addr zone=contact_form:10m rate=5r/m;

server {
  location /api/contact {
    limit_req zone=contact_form burst=10 nodelay;

    # Proxy to your backend
    proxy_pass http://127.0.0.1:3000;
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

<!-- Honeypot field in your form -->
<form action="/api/contact" method="POST">
  <!-- Hidden honeypot — bots will fill it, humans won't see it -->
  <input
    type="text"
    name="website"
    style="display:none"
    tabindex="-1"
    autocomplete="off"
  >

  <label for="message">Message:</label>
  <textarea name="message" required></textarea>

  <button type="submit">Send</button>
</form>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# Backend validation
@app.route("/api/contact", methods=["POST"])
def contact():
    # Check honeypot
    if request.form.get("website"):
        return "Bot detected", 403

    # Check timestamp (form should not be submitted instantly)
    submit_time = time.time()
    form_loaded = float(request.form.get("_loaded_at", 0))

    if submit_time - form_loaded < 2:
        return "Too fast — possible bot", 403

    # Process the legitimate form
    return "OK", 200

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

import hmac
import hashlib
import time
import os

SECRET = os.environ.get("CAPTCHA_SECRET", "change-me")

def generate_token():
    timestamp = int(time.time())
    message = f"{timestamp}:{SECRET}"
    token = hmac.new(
        SECRET.encode(), message.encode(), hashlib.sha256
    ).hexdigest()
    return f"{timestamp}:{token}"

def verify_token(token, max_age=300):
    try:
        timestamp_str, received_hash = token.split(":", 1)
        timestamp = int(timestamp_str)

        if time.time() - timestamp > max_age:
            return False

        message = f"{timestamp_str}:{SECRET}"
        expected = hmac.new(
            SECRET.encode(), message.encode(), hashlib.sha256
        ).hexdigest()

        return hmac.compare_digest(received_hash, expected)
    except (ValueError, TypeError):
        return False