HN Explorer

12 comments

[ 0.21 ms ] story [ 29.5 ms ] thread
goda90
Is reCAPTCHA v3 the one that has the chance of forcing you to use a Google or Apple phone to scan a QR code even if opening it on a PC?
bhhaskin
If I hit something like that I am just gonna close the tab and move on with my day.

If it's something really important then I am going to very loudly complain to their support until I can bypass it.

Sander_Marechal
I had my first "scan this code with your phone" last week. Nope. Close tab and never go there again.
dom96
Workers are great for this sort of thing and these days with Turnstile and Email Sending beta[1] you can have Cloudflare handle it all

1 - https://developers.cloudflare.com/email-service/

aquariusDue
Cloudflare Workers and HTMX also pair up well.
rowlandc
That was my thought too .. why use anything but CloudFlare for this? Turnstile works great and it can send email itself.. why go external?
torisima
Exactly. You can do it entirely with Cloudflare. Even if you limit yourself to what's available on the free tier, there's a surprisingly wide range of things you can build.
devy
Google has reduced the free tier limit for reCAPTCHA v3 from 1 million down to 10,000 assessments per month as part of its mandatory migration to Google Cloud. [1] So basically it's NOT a viable anti-spam mechanism for many use cases any more because that 10k asessment is easily breached. Let alone the fact that you can't use recaptcha v3 unless you signs up for Google Cloud as well.

Cloudflare Turnstile is a valid alternative though. [2]

[1] https://docs.cloud.google.com/recaptcha/docs/migration-overv...

[2] https://www.cloudflare.com/products/turnstile/

arbol
If you're getting hundreds of thousands of spam submissions then you probably need to pay for bot protection.
p32929
Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all.

I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free tier moves under you, which is exactly what happened to reCAPTCHA v3 per the top comment.

The honest counter-argument is that a form converts better than a mailto link. For a business that is true and measurable. For a CV or portfolio site it mostly is not: the messages you actually want arrive by email or DM anyway, and the form collects SEO spam, which is why you then need a captcha, which is this entire thread.

If you do need the form, the Turnstile suggestion upthread is the right shape - one vendor, one failure mode, instead of three services stitched together.