Cloudflare Turnstile vs reCAPTCHA Enterprise vs hCaptcha Pro: Real Bot Protection Cost per 100 Million Challenges in 2026

The short answer: at 100 million challenge events a month, Cloudflare Turnstile's self-serve plan is free, with no published volume cap. Google's reCAPTCHA and hCaptcha both have a genuinely priced Premium/Pro self-serve tier that stops well short of 100 million assessments — reCAPTCHA Premium's published rate only extends to 1,000,000 assessments a month, and hCaptcha Pro's overage rate is the highest self-serve figure it publishes, with no confirmed rate card beyond that either. Literally extrapolating each vendor's metered rate out to 100 million produces about $99,908 for reCAPTCHA and about $99,000–$99,040 for hCaptcha Pro, but neither figure is a confirmed Enterprise bill: at this volume, the real workload belongs to committed-volume Enterprise pricing on both vendors, which is not established by, and is very likely priced differently from, the self-serve Premium/Pro rate extended past its published ceiling. The two extrapolated figures are shown here as an ILLUSTRATIVE upper-bound reference point, not as what a real 100-million-assessment customer would actually be billed.

First, distinguish what each product actually is

These three are not identical products wearing different price tags. Cloudflare Turnstile is a CAPTCHA/challenge widget: it issues a pass/fail or risk token for a browser interaction, with no separate fraud-scoring or account-risk product bundled in on its free tier. reCAPTCHA Enterprise is Google's unified name for its assessment API, covering both the CAPTCHA-style checks most sites use and more advanced fraud-signal features (account defender, password-leak detection) at a Premium or Enterprise tier. hCaptcha separates a free Basic challenge tier from a paid Pro tier that adds a near-passive ("99.9% passive") verification mode, and a separate Enterprise product that adds session-risk scoring, account-takeover and credential-stuffing detection. This article prices the baseline challenge/assessment volume, not bot-management, fraud-scoring or SMS verification add-ons, which are priced separately where they exist.

What each vendor actually bills

Cloudflare Turnstile (OFFICIAL, Cloudflare's current plans page). Standard: free, with unlimited sitekeys and unlimited requests, in managed, non-interactive and invisible modes; up to 20 widgets per account. Cloudflare's own documentation describes this as unconditional on the standard plan, not capped by a published monthly request ceiling. One third-party source states a 1,000,000-request-a-month free limit before an "Enterprise cliff" near $2,000-plus a month; this conflicts with Cloudflare's own plans page, which states no request cap on Standard, and this article treats Cloudflare's own published terms as authoritative. Enterprise: by contract, adding analytics beyond 24 hours, an SLA, custom bot-score rules and dedicated support — none of which change the free assessment volume on Standard.

reCAPTCHA (OFFICIAL, Google Cloud's reCAPTCHA documentation and pricing page). reCAPTCHA is billed through Google Cloud, with every customer getting 10,000 free assessments a month, enforced per Google Cloud project. Current tiers: Essentials: free up to 10,000 assessments/month, with no paid path to higher volume on this tier. Premium: the first 10,000 assessments free, then a flat $8/month for the next 90,000 (10,001–100,000), then $1 per 1,000 assessments from 100,001 to 1,000,000, adding enhanced detection, account defender and password-leak detection. Enterprise: a fixed-volume monthly commitment with a minimum 12-month term, priced around $1 per 1,000 committed assessments, with the full feature set, WAF integration, multi-site management and an SLA. A Google Cloud billing account is required even to use the free tier. Separately, on April 2, 2026, Google changed reCAPTCHA's contractual data-handling role from data controller to data processor, removing references to Google's own Privacy Policy and Terms of Service from the reCAPTCHA badge and customer sites — a legal and data-governance change, not a pricing change; Google's own documentation states explicitly that this update carried no change to reCAPTCHA's cost.

hCaptcha (OFFICIAL structure; Pro entry price REPORTED with a conflict between sources). Free (Basic): up to 10,000 requests a month, not unlimited, and without hCaptcha's "99.9% passive" low-friction mode or advanced analytics. Pro: $99/month when paid annually, or $139/month billed month-to-month, both describing roughly 100,000 included evaluations, with overage at about $0.99 per 1,000 beyond that. Enterprise: custom, adding session risk scoring, bot defense and fraud protection (account takeover, credential stuffing, card testing, multi-accounting, synthetic identities), with a published 99.99% SLA. hCaptcha does not publish a self-serve rate card extending to 100 million assessments a month; the Pro-plan overage rate used here is the highest-volume published self-serve figure available, and at genuine 100-million-a-month volume, a committed Enterprise agreement is the realistic path, not an indefinite extrapolation of Pro's per-1,000 overage rate.

Why extrapolating a metered rate indefinitely is the wrong model at 100 million

Formula: cost at X assessments on Premium = $8 + max(0, X − 100,000) ÷ 1,000 × $1, valid as published up to 1,000,000 assessments a month. At 500,000 assessments, that gives $408 a month; at 1,000,000, $908 a month — both genuinely priced, self-serve figures. Past 1,000,000, Google's own tier structure moves the customer to Enterprise, a committed-volume contract with a 12-month minimum term, not a continuation of the $1-per-1,000 Premium rate indefinitely. The $99,908 figure in this article's table is therefore a literal extrapolation of the metered rate past the point where Google's own pricing says a different product applies — useful as an upper-bound reference, not as a confident prediction of what a real 100-million-assessment customer would actually be billed under a negotiated Enterprise commitment. The same caution applies to hCaptcha's Pro overage rate at this volume.

Where "free" has a real condition attached

Cloudflare Turnstile's $0 at 100 million challenges is the headline result of this comparison, but it assumes self-serve Standard terms continue to apply at that volume without Cloudflare requiring an Enterprise conversation — a reasonable reading of Cloudflare's own published "unlimited requests" language, but one worth confirming directly for a specific account at genuinely large scale, since publicly stated self-serve terms can carry fair-use expectations not fully spelled out on a pricing page. hCaptcha's Basic tier is free only up to 10,000 requests a month, and withholds the passive, lower-friction verification mode that Pro and Enterprise provide — a materially smaller free allowance than Turnstile's, and one a genuinely busy site will exceed almost immediately, at which point Pro's $99–$139 monthly fee applies.

Sensitivity

1. Whether Turnstile's free tier holds at genuine scale. The entire cost conclusion for Turnstile depends on it; Cloudflare's own terms state no cap, but this should be confirmed directly for sustained 100-million-a-month volume.
2. Which hCaptcha Pro entry price is current. A $40/month difference between two reported figures, though it barely moves the total at 100 million assessments.
3. Whether traffic crosses reCAPTCHA's or hCaptcha's included-allowance thresholds at all. Below 10,000 (reCAPTCHA) or 100,000 (hCaptcha) assessments a month, both are free or near-free; above those lines, cost scales almost linearly with volume.
4. Whether advanced fraud-scoring features (account defender, session risk, bot defense) are needed. These sit on separately priced tiers above the baseline challenge volume modeled here.

Budgeting traps

• Treating the April 2, 2026 reCAPTCHA change as a pricing change. Google's own documentation states that update was a data-controller-to-data-processor legal role change (removing Privacy Policy/Terms references from the badge), with no change to pricing.
• Treating challenge count and successfully solved count as the same billed quantity. All three vendors meter the assessment call itself, not a confirmed-human outcome.
• Citing a stale Turnstile free-tier limit. Sources disagree between "unlimited" and "1,000,000/month"; Cloudflare's own plans page states no cap on Standard.
• Comparing hCaptcha's or reCAPTCHA's baseline assessment price to a bundled fraud-scoring quote from a competitor. Advanced risk features are separately tiered on all three vendors.
• Assuming a Google Cloud billing account is optional for reCAPTCHA. It is required even to use the current free 10,000-assessment tier.

What to ask before you buy

Confirm directly with Cloudflare whether Turnstile's self-serve terms remain unconditional at your actual sustained volume, since this comparison's headline $0 result depends entirely on that holding at 100 million challenges a month. Ask hCaptcha for its current Pro entry price and overage rate, given the conflict between two reported figures, and for an Enterprise quote once volume exceeds what Pro is published for. Ask Google for a committed Enterprise quote once your reCAPTCHA usage approaches or exceeds 1 million assessments a month, rather than budgeting off an extrapolated Premium rate — neither vendor's real price at 100 million assessments is established by this article's upper-bound figures.