“What CAPTCHA should I use on a signup or contact form?”
What CAPTCHA should I use on a signup or contact form?
Short answer
Use the lowest-friction check that stops your abuse. A honeypot catches simple bots, rate limits slow the rest, and a CAPTCHA is for forms under real attack. A short arcade game such as CaptchaKit's suits signups and community sites where brand feel matters. Pair any CAPTCHA with a server-side check.
Steps
- 1
Measure the abuse first
Count fake signups or spam messages per week. If it is a handful, a honeypot field and basic rate limiting may be enough.
- 2
Match the challenge to the form
Pick a short game for signups, a quick one for comments, an invisible tool where you want no visible step.
- 3
Verify on the server
Whatever you choose, check the token on your server before you create the account or send the message.
- 4
Give people a way through
Offer an alternative path for visitors who cannot play or see the challenge.
- 5
Test and watch
Submit the form as a visitor, with keyboard only, and on a phone. Watch spam volume for a week.
Start with the cheapest controls
A CAPTCHA is not the first thing to reach for. A hidden honeypot field catches the laziest bots at no cost to visitors. Rate limits per IP and per email slow floods. Email verification stops accounts that never confirm. Add a CAPTCHA when those are not enough, because every visible step costs some real visitors.
When you do add one, you have three broad styles to choose from: invisible or proof of work (Turnstile, ALTCHA, Friendly Captcha), image or checkbox challenges (reCAPTCHA, hCaptcha) and games (CaptchaKit). See reCAPTCHA alternatives for prices.
Which CaptchaKit game for which form
The docs list a best-for hint for each game. Connect 4 is listed for general signups, Color Match for signup flows, Whack-a-Bot for login forms, Stack It for comment forms, Tap in Order for checkout flows, and Maze Runner for high-security forms. For sports and ticketing sites it lists Penalty Kick and Hoops, and for gaming sites Pac-Man Lite.
Average play times range from 6 seconds to 20. If your contact form gets only a few messages a day, the shortest games keep it light. If you pick more than one game, the widget shows a Switch game button so visitors can pick.
Contact forms
Contact forms mostly attract link spam. A honeypot plus server-side rate limiting covers most of it. If bots keep getting through, add a CAPTCHA and verify the token before the email sends. CaptchaKit's embed is one script tag and one div, and the server call is a single POST to /api/verify. See how to verify a CAPTCHA token.
Signup forms
Signups invite fake accounts, which cost money in email, support and abuse handling. A game on the signup step is visible but short, and it gives the form a bit of personality. Keep the account creation behind the server-side check, add email confirmation, and watch the dashboard for solve rates. Be honest about the limits: a determined attacker can script any client-side challenge, as covered in are game CAPTCHAs secure.
Do not skip the alternative
Some visitors cannot play a game or see an image. CaptchaKit's widget includes a "Can't play? Accessible check" link that switches to a screen-reader-friendly question and issues the same token, and its games play from the keyboard. Whatever tool you pick, offer a path like this and test it. See are CAPTCHAs accessible.
Before you ship
Keep the API key on the server. Verify the token before any side effect. Test with keyboard only. Test on a small phone. Test with a screen reader. Check what the widget sets in cookies and compare it with your privacy notice. Write down the date and who checked it.
Putting it together
For a small business site: honeypot, rate limit and a game on the contact form only if spam persists. For a SaaS signup: email confirmation, a rate limit, and a CAPTCHA with server-side verification, plus an alternative path for people who cannot play. For a community site: a game that fits the theme on signup and comments. For a store: protect login and checkout, keep the widget short, and test on phones.
Then read reCAPTCHA alternatives to compare prices, and the docs to see the integration in full.
Questions
Do I need a CAPTCHA on a contact form?
Not always. A honeypot and rate limits handle many sites. Add a CAPTCHA when spam persists.
Which CaptchaKit game is best for signups?
The docs list Connect 4 for general signups and Color Match for signup flows.
What if I want no visible challenge?
Choose an invisible or proof-of-work tool such as Turnstile's invisible mode, ALTCHA or Friendly Captcha.
Does CaptchaKit work on a static HTML form?
Yes. Add the script tag and div, read data-token on submit, and verify it on a backend you control. The docs show the pattern.
How much does CaptchaKit cost?
Pay what you want, one time, for the pack or a single game. Business is $29 a month. See pricing.
Can I try a game first?
Each game has a demo page, for example Color Match.
Sources
- CaptchaKit documentation (checked 2026-10-17)
- CaptchaKit pricing (checked 2026-10-17)
- CaptchaKit privacy policy (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.