Akismet vs reCAPTCHA: Two Tools, Two Different Jobs
The most common form-protection question has a frustrating answer: these two are not alternatives. One reads your submissions, the other reads your visitors, and running the wrong one is why so many protected forms are still full of junk.
"Akismet or reCAPTCHA?" is the question people actually type into Google, and it deserves a better answer than most comparisons give it.
The honest one is that they are not competitors. Akismet reads what was submitted. reCAPTCHA reads who submitted it. Picking between them is like choosing between a smoke alarm and a door lock, and the reason so many sites run one and still drown in spam is that they picked the wrong half of the problem.
Here is what each one actually checks, what each costs now, and how to decide.
What Each One Is Looking At
Akismet is a content filter, built by Automattic and running across a claimed 100 million sites. When a comment or form submission arrives, your site sends the content along with metadata such as the IP address and user agent to Akismet's servers. Akismet compares it against everything its network has learned about spam and returns a verdict. One API call equals one evaluation of whether a submission is spam.
reCAPTCHA never looks at your message field. It evaluates the session: browser and device signals, behaviour on the page, and a cookie it sets. It returns a risk score, or in the v2 case a challenge result, and your code decides what to do with it. Google now runs it as part of Google Cloud Fraud Defense.
That single difference drives everything below.
What Each One Costs In 2026
Both changed their pricing in ways that caught people out, and in opposite directions.
reCAPTCHA moved into Google Cloud and now runs three tiers. Essentials is free for up to 10,000 assessments per calendar month. Premium starts when you attach a billing account: the first 10,000 assessments stay free, 10,001 to 100,000 costs a flat $8, and everything above 100,000 is $0.001 per assessment, which works out at $1 per 1,000. Enterprise is a sales conversation with volume discounts.
Two details in Google's documentation matter more than the headline numbers. The free 10,000 is per organisation per calendar month, aggregating across all of your accounts, sites, keys, web pages and mobile applications. And if you exceed it without billing enabled, further assessment requests return a Resource Exhausted (429) error until the quota resets on the first day of the next month.
reCAPTCHA's free allowance is 10,000 assessments per calendar month per organisation, aggregated across all accounts and sites. Exceed it without billing and requests return a 429 quota error until the next calendar month. Source: Google Cloud, reCAPTCHA billing documentation, 2026
Akismet's free Personal plan is non-commercial only. Automattic's support documentation is specific about what disqualifies you, and the list is broad enough to catch most business sites: advertising, affiliate links, promoting a business or service, accepting donations, running an e-commerce plugin. Commercial plans are metered by monthly spam checks, starting at roughly $9.95 a month for a single site and 500 checks, with a business tier around $49.95 a month and custom enterprise pricing above that. Prices move, so confirm on their pricing page before you quote a client.
The failure modes differ too. Akismet says protection keeps working if you occasionally go over your monthly allowance. reCAPTCHA stops issuing assessments and returns errors.
The Comparison That Matters
| Akismet | reCAPTCHA | |
|---|---|---|
| What it evaluates | The submitted content | The session and the visitor |
| Catches classic spam text | Yes, this is its job | No |
| Catches profanity or hate speech | No, spam only | No |
| Catches a phishing URL in a message | Only if the pattern is known spam | No |
| Catches automated traffic | Indirectly, via content patterns | Yes, this is its job |
| Human-written and AI-written spam | Sometimes, if the network has seen it | No |
| User friction | None | None on v3, some on v2 |
| Output | Pass or fail | A score or a challenge result |
| Free option | Non-commercial sites only | 10,000 assessments a month per organisation |
| Data leaving your server | Submission content and metadata | Behavioural and device signals, plus a cookie |
| Per-form sensitivity | Not really | Threshold on the v3 score |
Read the third and fourth rows together. Neither tool covers profanity, hate speech or abuse, and Akismet only catches a phishing link if the wider pattern already looks like spam to its network. If your forms feed a human queue, that gap is where your actual risk lives.
Choosing, In Plain Terms
You run a WordPress site and get classic spam. Akismet, and you may need nothing else. It was built for exactly this and it is very good at it. Check whether your site qualifies for the free tier before you assume it does. Most of the major form plugins will hand submissions to it for you: Gravity Forms, WPForms and Contact Form 7 all ship an Akismet integration, and a flagged entry goes to a spam folder rather than being destroyed.
You are getting hammered by automated volume. A bot detector. reCAPTCHA if you are already in Google Cloud and comfortably inside 10,000 assessments a month, Cloudflare Turnstile if you would rather not think about quotas, hCaptcha if privacy positioning matters to you.
You run several sites or a client portfolio. Watch the per-organisation aggregation before you standardise on reCAPTCHA. Twenty client forms under one Cloud organisation share a single allowance of 10,000, and one busy client can exhaust it for everyone else. Splitting across organisations works but gives you a sprawl of billing accounts to administer.
Real people, or convincing AI, are submitting things you do not want. Neither tool is aimed at this. A person in a click farm passes reCAPTCHA because they are a person, and a uniquely generated message that has never appeared anywhere else gives Akismet's network nothing to match against.
Why "We Have Both And Still Get Spam" Is So Common
Stack Akismet and reCAPTCHA and you have covered two of the three things that can go wrong with a submission. You have a bot check and a spam-text check. You still have no answer for content that is neither automated nor recognisably spam: abuse aimed at your support team, a slur that becomes a stored record, a phishing brief written to look like a project enquiry, or gibberish that inflates your conversion count.
That third category is the one growing fastest, because generating fluent, specific, one-off text stopped being difficult. It reads like a real enquiry, it passes a bot check because a browser really did submit it, and it passes a pattern-matching spam filter because the pattern is new every time.
Content-level moderation is the layer built for it: every submission scored across spam, profanity, hate speech and junk, from bots and humans alike, against thresholds you set per form, with nothing in the visitor's way. It is not a bot mitigation tool, so if raw automated volume is your problem you still want a bot layer in front of it.
The Practical Answer
If you want one line to act on: use Akismet if your problem is classic spam on WordPress, use a bot detector if your problem is automated volume, and add content scoring if your problem is what people and language models are actually typing into your forms. Most businesses have at least two of those problems and buy for one.
The comparison is only awkward because the two tools have been marketed as answers to the same question for fifteen years. They never were.
References
Google Cloud. reCAPTCHA billing information and tier documentation, docs.cloud.google.com, 2026.
Akismet. "Should I choose a free or paid subscription?" and "Akismet API Usage Limits", akismet.com support documentation, 2026.
Akismet. Pricing and enterprise pricing pages, akismet.com, 2026.
Cloudflare. Turnstile documentation, 2026.
Imperva/Thales. "2026 Bad Bot Report: Bots in the Agentic Age."