Guide

reCAPTCHA migration

Replace the script, request a token on submit, and verify it on your server. Users do not solve a puzzle.

Why now

reCAPTCHA's free tier includes 10,000 assessments a month per organization, across all sites.
Without billing, requests return HTTP 429 after that limit until next month.
With billing, the cost is $8 flat for 10,001–100,000, then $1 per 1,000.

Source: Google Cloud, reCAPTCHA billing information, checked 2026-10-22.

Swap in 3 steps

1. Script

<!-- remove -->
<script src="https://www.google.com/recaptcha/api.js?render=SITE_KEY"></script>
<!-- add -->
<script src="https://nolgard.com/v1/client.js" data-site-key="SITE_KEY" defer></script>

2. Token on submit

// before: const token = await grecaptcha.execute('SITE_KEY', { action: 'signup' });
await Nolgard.ready;
const token = await Nolgard.execute({ action: 'signup' });

3. Server verify

// before: POST https://www.google.com/recaptcha/api/siteverify, then if (score < 0.5) reject
const result = await fetch('https://nolgard.com/v1/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ secret: process.env.NOLGARD_SECRET, token, remoteIp, action: 'signup', account: { email } }),
}).then(r => r.json());
// Use result.decision (allow | limit | challenge | shadow | block), not a score threshold.

The scores run in opposite directions: reCAPTCHA 1.0 means human; Nolgard score 100 means automated. Branch on decision. Start the site in Observe mode. Decisions and modes

Plugins

Turn off the plugin's reCAPTCHA after you enable Nolgard.