Almost every Drupal website has forms that accept user input — a contact form, comments on blog posts, user registration, webforms, and so on. Wherever a form is exposed to the public, you need a way to protect it from SPAM.
One of the most common approaches is to add CAPTCHA functionality. A CAPTCHA is a challenge-response test placed inside web forms to work out whether the visitor is a human or an automated script.
The key module for this is the Drupal CAPTCHA module. Its purpose is to block form submissions from spambots — automated scripts that post spam content anywhere they can. The CAPTCHA module can add a challenge to virtually any user-facing form on a Drupal site. Out of the box it ships with image and math challenges, and its functionality is extended by a whole ecosystem of additional CAPTCHA modules.
The good news for anyone on a current site is that the module is actively maintained: the 2.x branch works with Drupal 9.5, 10 and 11, and it remains one of the most widely used contributed modules of any kind. The old image-refresh link is now built into the core image CAPTCHA widget, so you no longer need a separate module for it (more on that below).
Below are the best Drupal CAPTCHA-related modules recommended by Drupal4U. "Best" for us means: easy to configure, easy to handle, flexible and reliable — and, ideally, kind to your real visitors. Version numbers below reflect the state of each project at the time of writing, so always check the project page before you install.
CAPTCHA Riddler (Drupal 10/11)
CAPTCHA Riddler is a lovely way to make your CAPTCHA more personal by using a question as the challenge. It is a sub-module of CAPTCHA that lets site administrators write their own questions to foil automated bots. In our experience you get very little or no spam even with very simple questions — such as "what is the name of this website?" (giving the number of letters as a hint). It often works even better than an image CAPTCHA with a strong configuration, and compared to Google's reCAPTCHA — which can be annoying and time-consuming — it is far more user friendly. The result is more leads and more user-generated content, because visitors don't abandon the form.
- Create your own CAPTCHA questions so the challenge matches your site's personality
- Allow multiple accepted answers for a single question
- Store multiple questions and present just one at random to each user
The module now supports Drupal 11: the current 3.x branch is built for CAPTCHA 2.x and works with Drupal 10 and 11.
https://www.drupal.org/project/riddler
Honeypot (Drupal 10/11)
Honeypot uses both the honeypot and timestamp methods to deter spam bots from completing forms on your Drupal site. These methods are effective against many bots and are far less intrusive than reCAPTCHA-style challenges. Site owners regularly report dramatic reductions in spam. It isn't quite as watertight as a server-side reCAPTCHA, and in our experience it is a little less effective than CAPTCHA Riddler, but its huge advantage is usability: your visitors never see anything at all. If a frictionless experience is your main criterion, Honeypot is a very solid choice, and it pairs well with other modules on this list.
The way it works is simple and elegant: the module inserts a form field that is hidden from humans but visible to bots. Real users never fill it in; bots usually do — and Honeypot blocks any submission where that field contains a value. The timestamp check adds a second layer by rejecting forms that are submitted implausibly fast.
Honeypot is very widely deployed, and the current 2.2.x release works with Drupal 10.3 and 11.
https://www.drupal.org/project/honeypot
Antibot (Drupal 10/11)
Antibot is a newer favourite that has become extremely popular because it protects forms without showing anything to the user. It requires JavaScript to submit a protected form: on page load the form's action is swapped out, and it is only restored once the module detects genuine human interaction such as a mouse move, key press or touch gesture. Bots that don't run JavaScript — which is most of them — never get a working form to submit.
Because there is zero user friction and no third-party service, Antibot is a great "invisible" complement to CAPTCHA or Honeypot, and it keeps your forms compatible with page caching. The only real trade-off is that visitors with JavaScript disabled will be blocked, so it's worth offering an alternative contact route. Antibot is compatible with Drupal 11 (the 2.0.x branch) and is one of the most popular spam tools in the ecosystem.
https://www.drupal.org/project/antibot
reCAPTCHA v2 and v3 (Drupal 10/11)
Google's reCAPTCHA is still the best-known option, but it is not always the optimal one. In its standard v2 configuration it is very secure but not especially user friendly, which can cost you leads (contact forms) and user-generated content (comments). The "No CAPTCHA reCAPTCHA" checkbox — where the visitor usually just ticks a box to confirm they are human, and only faces a challenge if the system is unsure — was a step forward for usability.
reCAPTCHA v3 goes further and removes user friction almost entirely: it returns a score for each request based on the visitor's behaviour, and you decide what action to take at each score threshold. The small catch is that you have to register for API keys with Google, but that takes only a minute. A more significant consideration in 2025/2026 is privacy and GDPR: because reCAPTCHA sends data to Google, many European site owners now prefer the privacy-first alternatives further down this list.
Both modules are maintained and Drupal 11 ready. The base reCAPTCHA module (v2, and the entry point for keys) works with Drupal 10 and 11, as does reCAPTCHA v3.
https://www.drupal.org/project/recaptcha
https://www.drupal.org/project/recaptcha_v3
Cloudflare Turnstile (Drupal 10/11/12)
Cloudflare Turnstile is Cloudflare's free, privacy-respecting replacement for traditional CAPTCHAs, and it has quickly become one of the most recommended options for new Drupal sites. It adds a Turnstile challenge type to the CAPTCHA module: most visitors see nothing more than a brief "verifying" indicator — no image grids, no traffic lights, no puzzles — while Cloudflare runs a set of non-intrusive browser checks in the background. You don't need to route your whole site through Cloudflare to use it, and it doesn't rely on tracking users across the web, which makes it a strong fit where reCAPTCHA's data handling is a concern.
Setup is straightforward: enable the module alongside CAPTCHA, register for free site and secret keys in your Cloudflare dashboard, and choose which forms should display the widget. Notably, Turnstile is already ahead of the compatibility curve — the current 1.2.x release works with Drupal 10.6, 11 and 12. If you want a modern, low-friction, no-cost challenge and are future-proofing toward Drupal 12, this is our top pick among the third-party services.
https://www.drupal.org/project/turnstile
hCaptcha (Drupal 10/11)
hCaptcha is a privacy-first, drop-in replacement for reCAPTCHA that plugs into the CAPTCHA module. It offers the familiar checkbox and challenge experience users already recognise, but with a stronger stance on user privacy, and its Enterprise tier adds risk scoring and near-passive "no-CAPTCHA" modes for high-traffic sites. For teams that want a reCAPTCHA-style workflow without sending data to Google, hCaptcha is the most obvious like-for-like swap.
The module works with Drupal 10 and 11 (the 8.x-1.x branch, with explicit Drupal 11 support added).
https://www.drupal.org/project/hcaptcha
Friendly Captcha (Drupal 10/11)
Friendly Captcha is a European, GDPR-conscious alternative that replaces the "prove you're human" puzzle with an invisible proof-of-work challenge: the visitor's browser quietly solves a small cryptographic task in the background, which is trivial for a real user's device but expensive for a bot running at scale. There is nothing to click and nothing to read, so it is one of the smoothest options for accessibility and conversions. It also offers a self-hostable, open-source client if you'd rather not depend on a subscription service.
Friendly Captcha is a mature, well-supported member of the CAPTCHA ecosystem and works with Drupal 10 and 11.
https://www.drupal.org/project/friendlycaptcha
ALTCHA (Drupal 10/11)
ALTCHA is a free, fully open-source, privacy-first CAPTCHA alternative that also uses a proof-of-work mechanism, with no third-party calls required when self-hosted. That combination — no external service, no cookies, no tracking — makes it especially appealing for GDPR-sensitive projects and public-sector sites, and it can be deployed self-hosted or via the ALTCHA Sentinel service. A handy bonus is the obfuscation sub-module, which can hide email addresses, phone numbers and other sensitive text from scrapers.
ALTCHA depends on the CAPTCHA module, is actively developed, and works with Drupal 10.2 and 11. It is the newest option on this list — one to watch if privacy and open source are priorities.
https://www.drupal.org/project/altcha
Image CAPTCHA Refresh (Drupal 7)
Image CAPTCHA Refresh historically added a "refresh" link to the image CAPTCHA widget so users could request a new image if they couldn't read the current one. You no longer need this module on modern Drupal: the refresh functionality was folded into the core CAPTCHA module's image widget from Drupal 8 onwards. The standalone project is now Drupal 7 only and is no longer maintained, so it is included here only for historical reference and for anyone still running a legacy Drupal 7 site.
https://www.drupal.org/project/image_captcha_refresh
Hidden CAPTCHA (Drupal 7)
Hidden CAPTCHA used a simple idea: offer an input box that must stay empty, and block the submission if anything is entered — since bots tend to fill in every field they find. It didn't stop all spam, but it reduced it dramatically with no impact on real users. The concept lives on, and is arguably better implemented, in Honeypot and Antibot above. The original module is Drupal 7 only and has not been maintained since 2018, so on Drupal 10/11 you should reach for one of those modern equivalents instead.
https://www.drupal.org/project/hidden_captcha
Which should you choose for Drupal 11?
There's no single winner — the right answer depends on how much friction you can tolerate versus how much spam you're fighting:
- Want zero visible friction? Start with Honeypot and/or Antibot. They're invisible, free, and require no third-party service.
- Want a personal, on-brand challenge? CAPTCHA Riddler is charming and surprisingly effective for small-to-medium sites.
- Want a modern, low-friction service and are eyeing Drupal 12? Cloudflare Turnstile is our top pick.
- Need reCAPTCHA-style protection but care about privacy/GDPR? Choose hCaptcha, Friendly Captcha or ALTCHA over Google reCAPTCHA.
In practice, the most robust setups layer an invisible method (Honeypot or Antibot) underneath a challenge module, so real visitors almost never see a test while bots hit two walls instead of one.
Read more articles
- Log in to post comments