4 ms·

Using Cloudflare Workers and reCAPTCHA v3 for a Static Site Contact Form

39 points by speckx 1mo ago

goda90 1mo ago
Is reCAPTCHA v3 the one that has the chance of forcing you to use a Google or Apple phone to scan a QR code even if opening it on a PC?
- bhhaskin 1mo ago
  If I hit something like that I am just gonna close the tab and move on with my day. If it's something really important then I am going to very loudly complain to their support until I can bypass it.
  - Sander_Marechal 1mo ago
    I had my first "scan this code with your phone" last week. Nope. Close tab and never go there again.
dom96 1mo ago
Workers are great for this sort of thing and these days with Turnstile and Email Sending beta[1] you can have Cloudflare handle it all 1 - https://developers.cloudflare.com/email-service/ https://developers.cloudflare.com/email-service/
- aquariusDue 1mo ago
  Cloudflare Workers and HTMX also pair up well.
- rowlandc 1mo ago
  That was my thought too .. why use anything but CloudFlare for this? Turnstile works great and it can send email itself.. why go external?
  - torisima 1mo ago
    Exactly. You can do it entirely with Cloudflare. Even if you limit yourself to what's available on the free tier, there's a surprisingly wide range of things you can build.
- nohuman-labs 1mo ago
  [dead]
devy 1mo ago
Google has reduced the free tier limit for reCAPTCHA v3 from 1 million down to 10,000 assessments per month as part of its mandatory migration to Google Cloud. [1] So basically it's NOT a viable anti-spam mechanism for many use cases any more because that 10k asessment is easily breached. Let alone the fact that you can't use recaptcha v3 unless you signs up for Google Cloud as well. Cloudflare Turnstile is a valid alternative though. [2] [1] https://docs.cloud.google.com/recaptcha/docs/migration-overview https://docs.cloud.google.com/recaptcha/docs/migration-overv... [2] https://www.cloudflare.com/products/turnstile/ https://www.cloudflare.com/products/turnstile/
- arbol 1mo ago
  If you're getting hundreds of thousands of spam submissions then you probably need to pay for bot protection.
SeenSure 1mo ago
[flagged]
p32929 1mo ago
Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all. I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2 https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free tier moves under you, which is exactly what happened to reCAPTCHA v3 per the top comment. The honest counter-argument is that a form converts better than a mailto link. For a business that is true and measurable. For a CV or portfolio site it mostly is not: the messages you actually want arrive by email or DM anyway, and the form collects SEO spam, which is why you then need a captcha, which is this entire thread. If you do need the form, the Turnstile suggestion upthread is the right shape - one vendor, one failure mode, instead of three services stitched together.

39 points by speckx 1mo ago

Is reCAPTCHA v3 the one that has the chance of forcing you to use a Google or Apple phone to scan a QR code even if opening it on a PC?

bhhaskin 1mo ago
If I hit something like that I am just gonna close the tab and move on with my day. If it's something really important then I am going to very loudly complain to their support until I can bypass it.
- Sander_Marechal 1mo ago
  I had my first "scan this code with your phone" last week. Nope. Close tab and never go there again.

dom96 1mo ago

Workers are great for this sort of thing and these days with Turnstile and Email Sending beta[1] you can have Cloudflare handle it all 1 - https://developers.cloudflare.com/email-service/ https://developers.cloudflare.com/email-service/

aquariusDue 1mo ago
Cloudflare Workers and HTMX also pair up well.
rowlandc 1mo ago
That was my thought too .. why use anything but CloudFlare for this? Turnstile works great and it can send email itself.. why go external?
- torisima 1mo ago
  Exactly. You can do it entirely with Cloudflare. Even if you limit yourself to what's available on the free tier, there's a surprisingly wide range of things you can build.
nohuman-labs 1mo ago
[dead]

devy 1mo ago

Google has reduced the free tier limit for reCAPTCHA v3 from 1 million down to 10,000 assessments per month as part of its mandatory migration to Google Cloud. [1] So basically it's NOT a viable anti-spam mechanism for many use cases any more because that 10k asessment is easily breached. Let alone the fact that you can't use recaptcha v3 unless you signs up for Google Cloud as well. Cloudflare Turnstile is a valid alternative though. [2] [1] https://docs.cloud.google.com/recaptcha/docs/migration-overview https://docs.cloud.google.com/recaptcha/docs/migration-overv... [2] https://www.cloudflare.com/products/turnstile/ https://www.cloudflare.com/products/turnstile/

arbol 1mo ago
If you're getting hundreds of thousands of spam submissions then you probably need to pay for bot protection.

SeenSure 1mo ago

[flagged]

p32929 1mo ago

Worth saying for the personal-site case specifically, which is most of the static sites people bolt a contact form onto: the form is often not worth the infrastructure at all. I maintain an open-source portfolio template (https://github.com/p32929/portfolio-v2 https://github.com/p32929/portfolio-v2) and the contact section is deliberately just links - email, GitHub, LinkedIn. No endpoint, no captcha, no keys to rotate, and nothing to migrate when a free tier moves under you, which is exactly what happened to reCAPTCHA v3 per the top comment. The honest counter-argument is that a form converts better than a mailto link. For a business that is true and measurable. For a CV or portfolio site it mostly is not: the messages you actually want arrive by email or DM anyway, and the form collects SEO spam, which is why you then need a captcha, which is this entire thread. If you do need the form, the Turnstile suggestion upthread is the right shape - one vendor, one failure mode, instead of three services stitched together.