# CAPTCHA

Add a CAPTCHA to your Form Plume form and decide when visitors solve a challenge. Compare Cloudflare Turnstile, hCaptcha, and Google reCAPTCHA.

CAPTCHA asks a provider to decide whether a browser interaction looks human.

Use it when invisible controls are not enough. Start with [Honeypot](/docs/spam-protection/honeypot), [rate limits](/docs/spam-protection/rate-limits), and [email hygiene](/docs/spam-protection/email-hygiene) so legitimate visitors solve as few challenges as possible.

## Choose a provider

- [Cloudflare Turnstile](/docs/spam-protection/captcha/turnstile) is the privacy-oriented default.
- [hCaptcha](/docs/spam-protection/captcha/hcaptcha) is useful when you already use its platform.
- [Google reCAPTCHA](/docs/spam-protection/captcha/recaptcha) supports checkbox and score-based flows.

Every provider gives you a public site key and a private secret. The site key belongs in the page. Save the secret only in Form Plume.

The browser sends a short-lived token with the form. Form Plume verifies it directly with the provider before accepting the submission.