HTTP Archive sample: CWV pass rate with and without a CAPTCHA
| Group | Pass with CAPTCHA | Pass without | Median LCP with | Median LCP without | Homepages with CAPTCHA |
|---|---|---|---|---|---|
| Top 10K | 45.4% | 49.6% | 1,790 ms | 1,786 ms | 1,598 |
| Top 100K | 39.9% | 42.9% | 1,992 ms | 1,962 ms | 14,323 |
| Top 1M | 35.8% | 44.2% | 2,350 ms | 2,080 ms | 128,229 |
| WordPress | 45.8% | 50.4% | 2,161 ms | 2,152 ms | 33,499 |
| Shopify | 44.0% | 58.4% | 2,047 ms | 1,916 ms | 2,147 |
| Webflow | 47.8% | 50.3% | 2,122 ms | 2,133 ms | 602 |
| Other platforms | 32.9% | 41.2% | 2,371 ms | 2,076 ms | 107,669 |
| All homepages | 36.4% | 44.1% | 2,294 ms | 2,067 ms | 144,150 |
Source: PageSpeed Matters, HTTP Archive and CrUX, Sept 2026. Top 100K is ranks 10K to 100K and Top 1M is the rest. Medians are CrUX p75 values.
Summary
CAPTCHAs protect forms from spam and bots, but they arrive as third-party scripts, and some setups load them on every page rather than only where a form lives. We wanted two answers: which CAPTCHA tools sites actually use, and how sites that load one compare on speed.
On adoption, one tool dominates. reCAPTCHA appears on 1,580,818 of 40.3 million homepages crawled, against 107,207 for Cloudflare Turnstile and 78,873 for hCaptcha, roughly 8 to 1 against the two rivals combined. On speed, top 1M homepages that load a CAPTCHA pass Core Web Vitals less often than those that do not, on every platform in our comparison.
What we measured
We used two separate samples, and the numbers from each should be read on their own.
Adoption counts cover 40.3 million homepages crawled between January and October 2026. We counted homepages carrying each vendor's script paths.
Speed figures come from the HTTP Archive crawl of the top 1M sites from September 2026, on mobile, joined to Chrome UX Report (CrUX) field data at the 75th percentile. 144,150 homepages load a CAPTCHA and 638,700 do not. A homepage passes Core Web Vitals when loading, responsiveness and visual stability are all good.
This is a correlation. Sites that load a CAPTCHA are often heavier builds in general, so the speed gap should not be read as the cost of the CAPTCHA script alone.
reCAPTCHA leads, and WordPress sites use CAPTCHAs most
Across 40.3 million homepages crawled since January 1, 2026, reCAPTCHA is on 1,580,818, Cloudflare Turnstile on 107,207 and hCaptcha on 78,873.
HTTP Archive's top 1M crawl, which covers only the most visited sites and detects tools differently, shows the same order. reCAPTCHA is on 115,268 homepages, Cloudflare Turnstile on 26,692 and hCaptcha on 3,248. Because the two samples are built differently, counts from one should not be compared directly with the other.
By platform, CAPTCHAs are a WordPress habit. 29.5% of top 1M WordPress homepages load one (33,499 of 113,593), against 4.6% of Shopify homepages (2,147 of 47,127) and 17.4% of sites on other platforms. On WordPress, CAPTCHAs likely arrive through contact form and login protection plugins, some of which load the script on every page.
Sites with a CAPTCHA pass Core Web Vitals less often
Top 1M homepages loading a CAPTCHA pass Core Web Vitals 36.4% of the time (144,150 homepages), against 44.1% without (638,700). Their median LCP is 227 ms slower and their median INP is 21 ms slower.
The gap narrows among popular sites. In the Top 10K, homepages with a CAPTCHA pass 45.4% against 49.6% without (1,447 and 5,075 with CrUX). In ranks 10K to 100K it is 39.9% against 42.9%. In the rest of the top 1M it widens to 35.8% against 44.2%. Larger sites may be more likely to load CAPTCHA scripts only where they are needed, though our data does not show where on each site the script loads.
The gap shows up on every platform, widest on Shopify
Comparing sites on the same platform removes some of the platform mix, and the gap stays. WordPress homepages with a CAPTCHA pass 45.8% of the time (28,912 with CrUX) against 50.4% without (71,001). They also carry a median 1.26 MB of JavaScript against 0.58 MB, which suggests CAPTCHA sites are heavier builds overall, not just one script heavier.
Shopify homepages show the widest gap: 44.0% pass with a CAPTCHA (2,069) against 58.4% without (43,188), a 14.4 point difference. Webflow homepages are closer, at 47.8% against 50.3%, and sites on other platforms pass 32.9% with a CAPTCHA against 41.2% without.
What this means for your site
You can keep spam protection without paying for it on every page.
- Load the CAPTCHA only on pages with a form, not site-wide. Most form and security plugins have a setting for this.
- Load it when the visitor focuses the form or scrolls it into view, rather than during the first page load.
- Consider lighter or invisible checks, such as honeypot fields or server-side spam filtering, for low-risk forms.
- After any change, check the page in PageSpeed Insights and confirm the form still blocks spam.
If you run WordPress, check which plugin adds the CAPTCHA and whether it loads on your homepage at all. That is often the quickest win.
Sources
- PageSpeed Matters analysis of 40.3M homepages crawled January to October 2026
- HTTP Archive crawl of the top 1M sites, September 2026, mobile
- Chrome UX Report (CrUX) documentation, Google: https://developer.chrome.com/docs/crux
Frequently asked questions
What is the most popular CAPTCHA?
reCAPTCHA, by a wide margin. Across 40.3 million homepages crawled since January 1, 2026, it appears on 1,580,818, against 107,207 for Cloudflare Turnstile and 78,873 for hCaptcha.
Do CAPTCHAs slow down websites?
Sites that load one tend to be slower. Top 1M homepages with a CAPTCHA pass Core Web Vitals 36.4% of the time against 44.1% without, with a median LCP 227 ms slower and INP 21 ms slower. CAPTCHA sites are often heavier builds overall, so not all of that gap is the CAPTCHA script.
How common are CAPTCHAs on WordPress sites?
Common. 29.5% of top 1M WordPress homepages load a CAPTCHA, against 4.6% of Shopify homepages and 17.4% of sites on other platforms.
A CAPTCHA only needs to load where a form lives, and moving it off the rest of the site keeps spam protection without slowing every page. Need help with this? See our conversion rate optimization agency.