One in five websites uses CAPTCHA — a deliberate security decision, never bundled infrastructure
| of sites have CAPTCHA detected | |
|---|---|
| CAPTCHA Adoption | 22.5% |
Unlike WAF, which ships invisibly inside CDN and cloud hosting stacks, CAPTCHA requires deliberate procurement and configuration — every deployment is an intentional decision. That deliberateness shows in the co-occurrence data: CAPTCHA sites are among the most heavily layered on the web.
The vendor market
reCAPTCHA and Cloudflare Turnstile share nearly nine in ten CAPTCHA deployments
| Share | |
|---|---|
| reCAPTCHA | 49.4% |
| Cloudflare Turnstile | 39.4% |
| GeeTest | 7.7% |
| hCaptcha | 1.9% |
| Arkose Labs FunCaptcha | 1.5% |
| Other | 0.1% |
reCAPTCHA holds a legacy lead, but Cloudflare Turnstile has closed the gap fast — its deep integration with Cloudflare's WAF makes adoption nearly automatic for sites already on the platform. GeeTest (7.7%) is the dominant specialist outside the two giants.
The integrated stack
96% of CAPTCHA deployments triggered on the initial request — hCaptcha is the exception
| Always-on (page load) | Rate-triggered (burst) | |
|---|---|---|
| reCAPTCHA | 98.3% | 1.7% |
| Cloudflare Turnstile | 96.9% | 3.1% |
| GeeTest | 90.1% | 9.9% |
| hCaptcha | 17% | 83% |
| Arkose Labs | 97.3% | 2.7% |
In 96% of detections, CAPTCHA fired on the initial crawler request with no prior interaction — consistent with an always-on deployment. hCaptcha is the clear exception: 83% of its detections required a burst of six requests first, pointing to a reactive configuration rather than an upfront challenge.
Security posture
CAPTCHA sites are the high-security cohort — three to four times more likely to layer Rate Limiting and Antibot
| CAPTCHA sites | All other sites | |
|---|---|---|
| WAF | 100% | 90% |
| JavaScript | 58% | 36% |
| Rate Limiting | 50% | 14% |
| Antibot | 45% | 11% |
| TLS | 18% | 13% |
Rate Limiting (50% vs 14%) and Antibot (45% vs 11%) show the starkest gaps — CAPTCHA sites are three to four times more likely to layer these defences on top. WAF is near-universal for both cohorts, confirming CAPTCHA deploys as an addition rather than a substitute.
By site scale
CAPTCHA is more prevalent on smaller sites — adoption shows a general decline as traffic grows
| CAPTCHA adoption | |
|---|---|
| Micro < 350K/mo | 33.2% |
| Small 350K – 1.1M | 29.4% |
| Mid 1.1M – 4.2M | 29.3% |
| Large 4.2M – 21.5M | 26.2% |
| Major 21.5M+ | 23.1% |
The inverse relationship is broadly consistent across traffic tiers — not noise. Smaller sites choose CAPTCHA because it is inexpensive to deploy and requires no dedicated security team. As traffic grows, that calculus shifts: the friction imposed on real users becomes costly, and the budget for invisible antibot alternatives becomes available.
By industry
Tobacco at 52% leads a cluster of niche industries that make heavy use of CAPTCHA
| Value | |
|---|---|
| Tobacco | 52% |
| Ceramics & Pottery | 38% |
| Textiles | 38% |
| Distance Learning | 37% |
| Fishery | 37% |
| Beauty & Cosmetics | 36% |
| Packaging & Containers | 35% |
| Crafts | 34% |
| Adult Content | 33% |
| Architecture | 33% |
| Nanotechnology | 33% |
| Writing & Editing | 33% |
| Advertising & Marketing | 32% |
| Museums | 32% |
| Farms & Ranches | 32% |
Tobacco's 52% reflects a compliance mandate — age-gate verification is routinely implemented through CAPTCHA rather than identity systems. The cluster below shares no obvious common threat model; small operator scale and limited security investment may be what keeps CAPTCHA as the visible default.
Travel, government and automotive keep CAPTCHA below 10% — human-facing by design
| Value | |
|---|---|
| Apparel & Fashion | 15% |
| Venture Capital | 14% |
| Public Relations | 14% |
| Investment | 14% |
| Public Utility | 13% |
| Ecology & Environment | 13% |
| Accounting | 13% |
| Science | 11% |
| Airlines | 11% |
| Banking | 10% |
| Libraries | 9% |
| Automotive | 9% |
| Public Policy | 9% |
| Government | 8% |
| Travel & Tourism | 8% |
Government and Travel & Tourism sit at the floor — sectors where friction at the door carries a high cost in excluded legitimate users. Banking's low rate reflects replacement rather than absence: invisible antibot layers have displaced visible challenges where conversion pressure is highest.
By geography
CAPTCHA adoption is globally uniform
| Value | |
|---|---|
| Afghanistan | 22.8% |
| Åland Islands | 23.7% |
| Albania | 22% |
| Algeria | 20.9% |
| American Samoa | 27.3% |
| Andorra | 22.6% |
| Angola | 21.8% |
| Anguilla | 24.1% |
| Antigua and Barbuda | 24.2% |
| Argentina | 22.2% |
| Armenia | 22.9% |
| Aruba | 25.7% |
| Australia | 24.4% |
| Austria | 24% |
| Azerbaijan | 23% |
| Bahamas | 22.5% |
| Bahrain | 22.3% |
| Bangladesh | 22.3% |
| Barbados | 24.9% |
| Belarus | 23.2% |
| Belgium | 22.3% |
| Belize | 25.1% |
| Benin | 21.4% |
| Bermuda | 23.6% |
| Bhutan | 26.1% |
| Bolivia | 22.1% |
| Bosnia-Herzegovina | 22.2% |
| Botswana | 23.4% |
| Brazil | 22.9% |
| British Indian Ocean Terr. | 26.3% |
| British Virgin Islands | 23.9% |
| Brunei | 24.1% |
| Bulgaria | 21.6% |
| Burkina Faso | 24.4% |
| Burundi | 20.9% |
| Cabo Verde | 24.1% |
| Cambodia | 22.1% |
| Cameroon | 23% |
| Canada | 21.8% |
| Cayman Islands | 26.3% |
| Central African Republic | 28% |
| Chad | 24.8% |
| Chile | 23.4% |
| China | 22.9% |
| Colombia | 22.5% |
| Comoros | 19.1% |
| Congo | 24.7% |
| Cook Islands | 28.4% |
| Costa Rica | 22.6% |
| Côte d'Ivoire | 23% |
| Croatia | 21.7% |
| Curaçao | 23.3% |
| Cyprus | 21.8% |
| Czechia | 23% |
| Denmark | 22.6% |
| Djibouti | 21.5% |
| Dominica | 21.6% |
| Dominican Republic | 21.8% |
| DR Congo | 23.1% |
| Ecuador | 20.9% |
| Egypt | 20.2% |
| El Salvador | 23% |
| Equatorial Guinea | 24.9% |
| Eritrea | 25.3% |
| Estonia | 21.3% |
| Eswatini | 28.5% |
| Ethiopia | 22.4% |
| Falkland Islands | 17.5% |
| Faroe Islands | 23.6% |
| Fiji | 24.6% |
| Finland | 22.4% |
| France | 22.7% |
| French Polynesia | 22.4% |
| Gabon | 22.2% |
| Gambia | 24.5% |
| Georgia | 22.2% |
| Germany | 22.8% |
| Ghana | 23.8% |
| Greece | 22.2% |
| Greenland | 25.3% |
| Grenada | 23.8% |
| Guam | 23.5% |
| Guatemala | 22.8% |
| Guernsey | 29.3% |
| Guinea | 26.8% |
| Guinea-Bissau | 24.3% |
| Guyana | 23.9% |
| Haiti | 22.6% |
| Honduras | 22.7% |
| Hong Kong SAR | 21.4% |
| Hungary | 21.5% |
| Iceland | 22.7% |
| India | 22.7% |
| Indonesia | 23.1% |
| Iraq | 22.5% |
| Ireland | 21.6% |
| Isle of Man | 25.6% |
| Israel | 21.6% |
| Italy | 24% |
| Jamaica | 22.8% |
| Japan | 18.7% |
| Jersey | 26.4% |
| Jordan | 22.6% |
| Kazakhstan | 23.7% |
| Kenya | 23.3% |
| Kiribati | 23.5% |
| Kuwait | 21.3% |
| Kyrgyzstan | 22.7% |
| Laos | 23.1% |
| Latvia | 21.4% |
| Lebanon | 22% |
| Lesotho | 25.8% |
| Liberia | 22.9% |
| Liechtenstein | 21.8% |
| Lithuania | 21.2% |
| Luxembourg | 21.8% |
| Macao SAR | 21.6% |
| Madagascar | 23.2% |
| Malawi | 26.7% |
| Malaysia | 22% |
| Maldives | 23.8% |
| Mali | 25.1% |
| Malta | 23.9% |
| Marshall Islands | 28.5% |
| Mauritania | 25.6% |
| Mauritius | 22.6% |
| Mexico | 20.6% |
| Micronesia | 25.3% |
| Moldova | 22.4% |
| Monaco | 24.3% |
| Mongolia | 22.8% |
| Montenegro | 21.8% |
| Montserrat | 23% |
| Morocco | 23.2% |
| Mozambique | 24.5% |
| Nauru | 25.3% |
| Nepal | 22.2% |
| Netherlands | 21.9% |
| New Caledonia | 25.3% |
| New Zealand | 23.1% |
| Nicaragua | 22.1% |
| Niger | 23.8% |
| Nigeria | 22.8% |
| Niue | 17.6% |
| Norfolk Island | 26.4% |
| North Macedonia | 23.1% |
| Northern Mariana Islands | 22.4% |
| Norway | 22.8% |
| Oman | 23.1% |
| Pakistan | 21.5% |
| Palau | 27.1% |
| Palestine | 23.2% |
| Panama | 23.8% |
| Papua New Guinea | 24.6% |
| Paraguay | 23.8% |
| Peru | 23% |
| Philippines | 21.5% |
| Poland | 22.4% |
| Portugal | 22.3% |
| Puerto Rico | 22.9% |
| Qatar | 20.4% |
| Romania | 22.1% |
| Russia | 23.6% |
| Rwanda | 22.7% |
| Saint Barthélemy | 28.9% |
| Saint Helena | 31.8% |
| Saint Kitts and Nevis | 24.3% |
| Saint Lucia | 25% |
| Saint Martin | 21.7% |
| Saint Pierre-Miquelon | 28.2% |
| Saint Vincent | 25.6% |
| Samoa | 26.4% |
| San Marino | 25.4% |
| São Tomé and Príncipe | 25.5% |
| Saudi Arabia | 21.4% |
| Senegal | 24.5% |
| Serbia | 21% |
| Seychelles | 23% |
| Sierra Leone | 22.8% |
| Singapore | 21.8% |
| Sint Maarten | 23.5% |
| Slovakia | 22.7% |
| Slovenia | 22.4% |
| Solomon Islands | 24.6% |
| Somalia | 24% |
| South Africa | 23.1% |
| South Korea | 22.7% |
| South Sudan | 23.9% |
| Spain | 23.2% |
| Sri Lanka | 22.5% |
| Suriname | 22.8% |
| Sweden | 21.8% |
| Switzerland | 23.3% |
| Taiwan | 22.3% |
| Tajikistan | 23.6% |
| Tanzania | 22.9% |
| Thailand | 21.4% |
| Timor-Leste | 23.7% |
| Togo | 22.5% |
| Tonga | 25.6% |
| Trinidad and Tobago | 23.5% |
| Tunisia | 21.7% |
| Turkey | 23% |
| Turkmenistan | 22.1% |
| Turks and Caicos | 25.7% |
| Uganda | 21.3% |
| Ukraine | 22.8% |
| United Arab Emirates | 21% |
| United Kingdom | 22.1% |
| United States | 22.3% |
| Uruguay | 21.9% |
| US Virgin Islands | 24.8% |
| Uzbekistan | 20% |
| Vanuatu | 22.4% |
| Vatican City | 24.9% |
| Venezuela | 22.9% |
| Vietnam | 21.4% |
| Wallis and Futuna | 27.3% |
| Yemen | 24.8% |
| Zambia | 24% |
| Zimbabwe | 22.8% |
CAPTCHA rates cluster between 17% and 32% across all 221 surveyed countries — tighter than almost any other metric in this report. Unlike WAF, where Japan is a clear outlier, no country or region opts significantly out of human verification.