reCAPTCHA Cut Its Free Tier by 99%: What It Costs Now

For most of its life, reCAPTCHA was the default answer to form spam for one simple reason: it was free, and generously so. A million verification calls a month, more than almost any site would ever use. That ended when Google moved reCAPTCHA into Google Cloud in 2024 and cut the free allowance to 10,000 assessments a month.

If you run a single low-traffic contact form, you may never notice. If you run several forms, or manage sites for other people, the details are worth knowing precisely, because two of them catch people out badly.

What reCAPTCHA Costs Now

reCAPTCHA is now part of Google Cloud Fraud Defense and runs on three tiers. These figures come from Google's own billing documentation.

So a site running 250,000 assessments a month sits on Premium and pays the $8 flat fee plus $1 per thousand for the 150,000 above the first hundred thousand, which lands at roughly $158 a month. Below 10,000, you pay nothing on either tier. Treat that as the assessment line only. Your actual Cloud invoice can carry other items depending on how the project is set up, and Google publishes the current rates on its pricing page.

The Three Details That Catch People Out

The quota is per organisation, not per site. Google's documentation is explicit: the free 10,000 assessments are per organisation per calendar month, and the limit aggregates usage across all accounts, all sites, all keys, all web pages and all mobile applications. Two projects with billing disabled share one allowance between them. If Project A uses 7,000 and Project B uses 3,000, you are at the ceiling.

Exceeding it without billing breaks the check, it does not just bill you. In an Essentials project, once your organisation passes 10,000 cumulative assessments in a calendar month, further CreateAssessment requests return a Resource Exhausted (429) quota error until the quota resets on the first day of the next month. Google does send email notifications as you approach and exceed the allowance, but if nobody is watching that inbox, your protection is simply off for the rest of the month.

An assessment is not a form submission. An assessment is a CreateAssessment call from your backend. If you follow the common reCAPTCHA v3 pattern of executing on multiple pages and scoring each one, your assessment count tracks activity across the site rather than the number of forms anyone actually filled in. A modest amount of traffic can consume the allowance without a single enquiry arriving.

The free 10,000 assessments are per organisation per calendar month, aggregated across all accounts and sites. In an Essentials project, requests beyond that return a Resource Exhausted (429) error until the first day of the next month. Source: Google Cloud, reCAPTCHA billing documentation, 2026

Why This Hits Agencies Hardest

Work through the arithmetic for a portfolio. Twenty client sites, all under one Google Cloud organisation, share a single free allowance of 10,000 assessments. That is an average of 500 per client per month before anything is billable, and averages are not how traffic works. One client runs a campaign, or gets hit by a bot flood, and the pool is gone. Every other client's forms start returning quota errors, and the first you hear about it is an email asking why the contact form stopped working.

None of this depends on which form plugin the sites run. A reCAPTCHA field on a Gravity Form, a Contact Form 7 form and an Elementor form all draw on the same organisation-wide allowance, so consolidating on one plugin does nothing to help.

You can split clients across separate Cloud organisations to give each its own allowance. Now you are administering a sprawl of billing accounts, keys and quota alerts, which is its own tax on your time and rarely appears on an invoice.

Either way, the thing that made reCAPTCHA attractive is gone. You could once sprinkle it everywhere and forget about it. Now it is a metered dependency that needs monitoring.

How To Check Where You Actually Stand

Before deciding anything, find out what you are using. Google gives you three ways:

• Billing reports in the Cloud console, for billable assessment volume and cost trends across the organisation.
• The feature usage dashboard on the Fraud Defense home page, for a breakdown of billed assessments over the last 30 days.
• Quota metrics and platform logs in Cloud Logging, if you want to catch RESOURCE_EXHAUSTED responses in your own monitoring rather than by email.

If you manage client sites, do this before the next campaign rather than after it.

What To Do Instead

If you are re-evaluating anyway, weigh the options by what they actually protect.

Cloudflare Turnstile. Free and unlimited on the standard plan, invisible, privacy-conscious, no per-organisation quota to track. Good pure bot detection at no cost. It evaluates the session, not the submission.

hCaptcha. Privacy-first positioning, free tier plus paid plans. Same category as reCAPTCHA: a bot check, not a content check.

Content-level moderation. Scores each submission for spam, profanity, hate speech and junk, from bots and humans alike, against thresholds you set per form, with no CAPTCHA in the user's way. This is the layer the CAPTCHA arms race never covered.

The Question Underneath The Price Change

It is tempting to treat this as a procurement decision, swap reCAPTCHA for Turnstile and move on. Those are reasonable bot detection tools and if bot detection is genuinely all you need, either is a fine replacement.

But the price change is a good moment to ask what reCAPTCHA was buying you. It answers one question: is this visitor a bot? It does not tell you whether a submission is spam, whether it contains profanity or hate speech, whether there is a phishing URL in the message field, or whether a real human just pasted promotional garbage into your form. As more spam is written by language models and submitted through browsers that behave like people, the bot-or-human question catches less and less of what actually reaches you.

You can spend the effort migrating from one CAPTCHA to another and end up with the same blind spot, just cheaper. Or you can use the disruption to move to protection that reads the content. If you need bot mitigation as well, pairing free Turnstile with content-level scoring gives you both halves without a reCAPTCHA bill.

Quick Answers

What is reCAPTCHA's free limit? 10,000 assessments per calendar month, per Google Cloud organisation.

Is reCAPTCHA still free? Yes, below that ceiling, on both the Essentials and Premium tiers.

Is the quota per site? No. It aggregates across every account, site, key, page and mobile app in your organisation.

What happens if I exceed it? With no billing account, assessment requests return a 429 quota error until the first of the next month. With billing enabled, you are charged Premium rates and service continues.

What does it cost above the free tier? A flat $8 for assessments 10,001 to 100,000, then $1 per 1,000 above that.

When does the quota reset? The first day of each calendar month.

The Takeaway

Google's free-tier cut is not the disaster some headlines made of it. For a single small form, 10,000 assessments a month is plenty. For anyone running multiple forms or multiple sites, it changes the arithmetic and exposes a per-organisation quota that was always lurking. Treat it as the prompt it is: reCAPTCHA was never reading your submissions, and now that it is not free either, there is little reason to keep building form protection around a question that misses half the problem.

References

Google Cloud. reCAPTCHA billing information, tiers and quota documentation, docs.cloud.google.com, 2026.

Google Cloud. reCAPTCHA quotas and limits, and platform logging documentation, 2026.

hCaptcha. Pricing and plans, 2026.

Cloudflare. Turnstile documentation and pricing, 2026.