Akismet, reCAPTCHA, hCaptcha, Turnstile, and Content Moderation: What Each Actually Protects
Ask five developers how to stop form spam and you will get five tools: Akismet, reCAPTCHA, hCaptcha, Cloudflare Turnstile, maybe a honeypot. The problem is that these are not competing answers to one question — they answer different questions, and lumping them together is how sites end up with three overlapping tools and still-dirty forms.
Here is a straight comparison of what each one actually does, where it is strong, and where it leaves a gap. No single tool on this list is bad. They are just aimed at different targets, and knowing which target you have is the whole game.
Two Different Jobs
Everything here does one of two jobs — and a couple try to straddle both:
Bot detection asks: is this visitor a machine? It looks at the browser, the behaviour, the network signals. reCAPTCHA, hCaptcha, and Turnstile live here.
Content evaluation asks: is this submission acceptable? It looks at what was actually typed — spam, profanity, hate speech, junk, phishing links. Akismet does a slice of this (spam only); dedicated content moderation does all of it.
The reason forms stay dirty despite protection is that most sites deploy a bot detector and assume the job is done — leaving the content question, where a lot of modern abuse lives, completely unanswered.
The Tools, One by One
Akismet. The WordPress-native incumbent, built by Automattic, with a spam-blocking track record measured in the hundreds of billions of items. It is genuinely good at what it does: catching spam, especially comment and contact-form spam, on WordPress. Its limits are that it is spam-only — no profanity, hate speech, or junk categories — it works largely on a pass/fail basis rather than tunable per-form scores, and it is most at home inside WordPress. If your only problem is classic spam on a WordPress site, it is hard to beat. If you need content categories or per-form control, it is only part of the picture.
Google reCAPTCHA. The most widely deployed bot detector on the web. Ubiquitous, well-understood, and now — since the 2024 move into Google Cloud — running a much smaller free tier (10,000 assessments a month, per account) with paid tiers above it. It is a session-and-behaviour bot check. It does not read your submissions, it raises privacy questions in some jurisdictions, and its image challenges are increasingly solved by bots anyway. Strong at deterring casual automation; silent on content.
hCaptcha. A privacy-first reCAPTCHA alternative with a free tier (revenue-share) and paid plans from around $99/month. Positioned on privacy and on paying site owners rather than harvesting data. As a category, though, it is the same as reCAPTCHA: a bot check, not a content check. Choose it over reCAPTCHA on privacy and pricing grounds — but it does not close the content gap either.
Cloudflare Turnstile. The newest of the bot detectors and, for many sites, the most appealing: genuinely free and unlimited on the standard plan, invisible, privacy-conscious, no per-account quota trap. If you want frictionless bot detection at no cost, it is excellent. Like the others in this group, it evaluates the session, not the submission.
Content moderation (Babelshield and the category generally). This is the other job entirely: scoring each submission for spam, profanity, hate speech, and junk, from bots and humans alike, against thresholds you set per form — with no CAPTCHA in the user's way. Its strength is precisely the gap the bot detectors leave: human-written and AI-written spam, abusive content, and phishing text that pass a bot check cleanly. It is not a volumetric-bot mitigation tool; if you are being hit with a raw flood of automated requests, you still want a bot layer in front. The two are complements, not substitutes.
The Map
| Tool | Primary job | Catches spam content | Catches profanity / hate | Bot mitigation | User friction | Notable limit |
|---|---|---|---|---|---|---|
| Akismet | Spam filtering | Yes (spam only) | No | Indirect | None | WordPress-centric, pass/fail |
| reCAPTCHA | Bot detection | No | No | Yes | Some (v2) / low (v3) | Free tier cut, privacy, content-blind |
| hCaptcha | Bot detection | No | No | Yes | Some | Content-blind |
| Turnstile | Bot detection | No | No | Yes | None (invisible) | Content-blind |
| Content moderation | Content evaluation | Yes | Yes | No (pairs with a bot layer) | None | Not volumetric-bot mitigation |
How to Actually Choose
Skip the brand argument and start from your problem:
"I get classic spam on a WordPress site." Akismet, possibly on its own. It is built for exactly this.
"I'm being hit by automated bots hammering my forms." A bot detector — Turnstile if you want free and frictionless, hCaptcha if privacy and paying site owners matter to you, reCAPTCHA if you are already in the Google ecosystem and within the free tier.
"Real people (or convincing AI) are submitting spam, abuse, or junk that passes my bot check." Content moderation. This is the gap none of the bot detectors touch, and it is the fastest-growing category of form abuse.
"All of the above." Pair a free bot layer (Turnstile) with content moderation. The bot layer blunts the volume; the content layer catches what gets through and reads what was actually submitted. That combination covers both jobs without stacking three redundant CAPTCHAs.
The Honest Bottom Line
There is no single winner here, and any comparison that crowns one is selling something. Akismet, reCAPTCHA, hCaptcha, and Turnstile are good tools that mostly answer the bot question. Content moderation answers the content question. Most sites have both problems and only address the first — which is exactly why "we have reCAPTCHA and we still get spam" is such a common complaint. Match the tool to the job, be willing to run one from each column, and your forms finally stay clean without punishing the people you actually want to hear from.
References
Akismet. Product documentation and spam-blocking statistics, akismet.com.
Google Cloud. reCAPTCHA documentation and billing, 2024–2026.
hCaptcha. Pricing and positioning, 2026.
Cloudflare. Turnstile documentation, 2026.