Bot Protection vs Google reCAPTCHA

Both score a visitor before an action, without a puzzle for most people. reCAPTCHA runs on Google Cloud and is free up to 10,000 assessments a month, then about $1 per 1,000; Bot Protection keeps the data in the EU as keyed hashes, explains every decision, and costs $29 for 1 million decisions.

At a glance

	Bot Protection	Google reCAPTCHA
How it works	A tag on your pages reads how the browser behaves; before a sign-up, sign-in or checkout your server makes one call and gets a decision.	A script on your pages; your server creates an assessment for each action and reads a score from 0.0 (bot) to 1.0 (person).
What your visitor sees	Nothing.	Nothing in score mode; a checkbox or challenge when you use a policy-based challenge or the older checkbox.
In your request path	No. Your server calls it with your own timeout.	No. Your server calls Google's API.
What your server gets	A class (human high to bot high), a bot score, the reasons, and an action: allow, challenge or block.	A score; explainability reasons on paid tiers (basic on Premium, advanced on Enterprise).
When it is down	Your server lets the visitor through: fail open.	Not stated for the API; past the free quota, assessments fail closed. Google's edge library for WAFs lets a request through on an error.
Watch before it blocks	Yes: in monitor mode every answer is allow, with what block mode would have done.	No mode of its own: a score-based key only scores; on the WAF path, Cloud Armor can preview a rule.
Price to start	A 14-day free trial with 10,000 decisions, then $29 a month for 1 million.	Essentials: free up to 10,000 assessments a month. Premium: $8 a month for 10,001 to 100,000, then $1 per 1,000. Enterprise: $1 per 1,000 on a 12-month commitment.
Integration	The tag, and one call from your server; a prompt for your coding agent does both.	The script, and an assessment from your server for each action.
Where it runs	Servers in Germany (EU); IPs and tokens are kept only as keyed hashes.	Google Cloud.

When Google reCAPTCHA is the better choice

You already run on Google Cloud and want one bill and one console.
You need what reCAPTCHA adds on paid tiers: password and SMS defense, carding and chargeback detection, account takeover scores.
You need mobile SDKs for iOS and Android today.

When Bot Protection is the better choice

You do not want a Google script on your sign-up page, and want the data in the EU.
Volume: 1 million decisions a month cost $29 on Starter; on reCAPTCHA Premium 1 million assessments cost about $908.
You want the reasons on every plan, and groups that catch farms across sessions.

Using both

Rarely worth it: both answer the same question. If you keep reCAPTCHA for its account-takeover score, ask Bot Protection at sign-up and checkout, where its reasons help most.

Questions

Is reCAPTCHA v3 invisible?

Yes: it scores in the background. You decide what each score means for your site.

Does Bot Protection read Google's score?

No. It decides from its own signals: the tag, the request and the groups of sessions it sees.

Sources

Checked on the vendors' own pages on 17 October 2026; prices change, so check theirs before you decide.

Bot Protection: the quickstart, pricing, and every comparison.