Anti-spam teardown · Challenge
reCAPTCHA v2
The checkbox everyone reaches for first. It is free, it is two lines of markup, and five separate people in our research described watching it fail while it was switched on.
Corey Haines · San Diego · Aug 2026
One of 12 anti-spam teardowns. Bypass techniques change; this page states its date so you can judge how stale it is.
The short answer
It still removes a meaningful share of unsophisticated automated volume, which is why it hasn’t disappeared. It does not stop anything aimed at you specifically, and it is the highest-friction thing you can put in front of a real buyer for that level of protection.
What it stops
- Scripted botsMass submitters that never render your page.
- Yes
- Targeted automationHeadless browsers, solver services, residential proxies — aimed at you.
- No
- Paid humansPeople doing it by hand, cheaply.
- No
- Real people, bad leadsGenuine humans who were never going to buy.
- No
- Cost to the real buyerWhat it asks of the person you actually wanted.
- High
How it works
reCAPTCHA v2 does most of its work before you ever see a puzzle. When the widget loads it scores the browsing session — cookie age, Google account state, IP reputation, pointer movement, timing between events — and if the score is comfortable the checkbox simply ticks. The image grid is the fallback, shown when the session looks unfamiliar.
Your server then posts the returned token to Google’s siteverify endpoint, which answers pass or fail. That round trip is the whole security model: you are trusting Google’s judgment about the session, delivered as a boolean.
Two consequences follow that people often miss. The check happens at the moment the form is submitted, so it can only ever be a door — it has no opinion about what happens to the submission afterwards. And the visitor’s browser talks to Google on every page carrying the widget, which is a data-protection conversation in the EU whether or not you wanted to have it.
What it actually stops
It genuinely stops the cheapest thing in the market: scripted POSTs straight at your form handler by clients that never execute JavaScript. That class of traffic is enormous, indiscriminate, and it is the reason turning reCAPTCHA on usually produces a visible drop in volume on day one.
That drop is real, and it is also the trap. It looks like the problem is solved, so the site owner stops looking — and the traffic that remains is the traffic that was aimed at them.
“The contact form calls a php script to send the emails using phpmailer. I tried recaptcha, honeypot with no luck. I finally figured out that they were targeting the php file directly so i changed the name of the form and the spam stopped. I checked my logs and see they are now targeting the renamed php file.”
Note what that describes: the widget was on the page and the attacker was never on the page. A challenge rendered in the browser protects the browser path. If your handler accepts a bare POST, the challenge is decoration.
How it’s defeated
Two ways, and they are not exotic. The first is a solver service — you send the challenge, a person or a model somewhere else solves it, you get a valid token back. The price is measured in fractions of a cent.
“Captcha can easily be bypassed. I had a small web scraping app and using a service such as 2captcha you could bypass captcha in like max 30 seconds using puppeteer and javascript.”
“A captcha won’t do much as they’re trivial to bypass. For example, the bot framework Puppeteer Extra has a captcha solver plugin which only requires one line of code. … The form submissions aren’t from people — bots are responsible for most of the internets leads. They use real people’s information, so at a casual glance everything appears legit.”
The second way needs no software at all. Pay people to click it.
“To be honest even with captcha my site was loaded with spam, I am assuming there are spam farms where human labor is so cheap that they just do captchas all day long and spam an insane number of websites.”
“It’s innane. And its with a captcha and a Javascript powered form. They have someone fill out the captcha and plaster in their stupid messages.”
“recaptcha v2 checkbox is pretty weak these days.”
And the case that closes the argument, because both defenses were running at once:
“We ended up taking down the page after 600 submissions. … the company names sometimes don’t match up to the email domain, the domains might be misspelled versions of actual companies (itterable.com). We have recaptcha enabled, and I have a honeypot, but it didn’t stop.”
When it’s still worth using
When you are being hit by indiscriminate volume and you have nothing else in place, it is free and it takes ten minutes. Turn it on, and treat the drop in volume as breathing room rather than as a fix.
If you are choosing a challenge today and not merely keeping the one you inherited, Cloudflare Turnstile does the same job for a fraction of the friction. There is no protection argument for v2 over Turnstile in 2026; there is only an integration-cost argument.
Whatever you keep, move the check off the browser path too. Validate the token server-side on every route that writes a submission, including the one your JavaScript doesn’t use.
What to pair it with
No single method on this site is sufficient. These are the ones that fail differently enough to be worth running alongside it.
- Honeypot fields
- Free, invisible, and catches a different class of client — the one that renders your page but reads the DOM rather than looking at it.
- IP reputation and rate limiting
- Caps the worst hour. A challenge that is being solved at scale is still being solved one request at a time.
- Email verification
- Catches the misspelled-domain pattern robwalte describes, which passes any challenge because a human typed it.