CaptchaLaCaptchaLa
Migration guide

Migrate from reCAPTCHA to CaptchaLa

Drop-in replacement in under 10 minutes. Keep your forms, swap the verification provider. Works with vanilla HTML, WordPress, Flarum and any backend.

Sign up & grab a keyRead the comparison
GreCAPTCHACurrent setup~10 minCaptchaLaDrop-in target

What the code change looks like

Before — reCAPTCHA v2
<div class="g-recaptcha" data-sitekey="YOUR_SITE_KEY"></div>
<script src="https://www.google.com/recaptcha/api.js" async defer></script>
After — CaptchaLa
<div class="captchala" data-app-key="YOUR_APP_KEY"></div>
<script src="https://cdn.captcha.la/v1/captchala.js" async defer></script>
Before — reCAPTCHA server verify (Node)
const res = await fetch('https://www.google.com/recaptcha/api/siteverify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body: new URLSearchParams({
    secret: process.env.RECAPTCHA_SECRET,
    response: req.body['g-recaptcha-response'],
  }),
})
const data = await res.json()
if (!data.success) return res.status(400).json({ error: 'bot' })
After — CaptchaLa server verify (Node)
const res = await fetch('https://api.captcha.la/v1/verify', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    appSecret: process.env.CAPTCHALA_SECRET,
    token: req.body['captchala-token'],
  }),
})
const data = await res.json()
if (!data.success) return res.status(400).json({ error: 'bot' })

Migration steps

  1. 1

    Sign up & grab your App Key + Secret

    Create a free CaptchaLa account, add a site, and copy the App Key (public) and App Secret (server-side). No card required.

  2. 2

    Swap the widget tag in your form

    Replace the reCAPTCHA div and script src with the CaptchaLa equivalents. The tag class changes from g-recaptcha to captchala, data-sitekey becomes data-app-key, and the script URL points to our CDN.

  3. 3

    Update the form submission field name

    reCAPTCHA injects a hidden field named g-recaptcha-response. CaptchaLa uses captchala-token. If your form handler reads the field by name, rename the constant; otherwise the hidden input flows through automatically.

  4. 4

    Update server-side verification

    Point the verify request at api.captcha.la/v1/verify with a JSON body containing appSecret and token. The response shape returns the same success boolean as reCAPTCHA, so existing branching code stays.

  5. 5

    Roll out gradually

    Most teams ship to one form (often the lowest-traffic one — newsletter signup or contact) first, watch conversion and challenge rate for a few hours, then expand. There's no minimum and no contract, so canarying is free.

Faster: use a plugin

WordPress + WooCommerce

Install the CaptchaLa plugin from the WordPress directory, paste your App Key + Secret, and the plugin handles login, registration, comments, WooCommerce checkout and CF7/Gravity/WPForms in one place.

View integration →

Flarum

Install the CaptchaLa extension via Composer, enable it in admin, and it covers registration, login, password reset and post replies.

View integration →

Frequently asked questions

Do I need to migrate all forms at once?

No. The two systems coexist on the same site — they don't share state or cookies. Migrate one form at a time.

What about reCAPTCHA Enterprise's risk scores? Do scores transfer?

Scores don't transfer (they're vendor-internal), but CaptchaLa returns its own risk score in the verify response. The numeric range and decision logic are documented; teams typically map their existing score threshold (e.g. 0.5) to ours within an hour.

Will my Google Site Verification or other Google integrations break?

No. reCAPTCHA is separate from Search Console / Site Verification / Analytics. Removing the reCAPTCHA tag has no effect on any other Google service.

Is there a migration script for sites with many embedded reCAPTCHA tags?

We don't ship one (the find-and-replace is one regex per repo, and every codebase's templating differs). The 10-line shell snippet most teams use is in the docs.