reCAPTCHA Detector
Paste any URL and instantly see whether the site is built with reCAPTCHA — with the matched evidence.
We do not store the URL you audit. Want the full audit (performance / images / SEO / accessibility + real-browser speed test)? → run the full audit
Why check this
Confirm the platform first: Third-party scripts decides what can be changed and whether it is worth it.
What this is
reCAPTCHA is Google's anti-bot challenge library embedded on login, signup, checkout and contact forms. Security and growth teams install it to blunt credential stuffing and spam, but the challenge scripts add third-party connections and can delay interaction readiness. Confirming a public-page mount tells you whether latency or false blocks belong to the form journey before you tune CDN firewall rules. Invisible v3 and checkbox v2 leave different DOM fingerprints even when the brand name never appears in visible copy.
How to tell from a public page
- [reCAPTCHA] reCAPTCHA HTML/source match on `gstatic.com/recaptcha` (evidence shows hit count).
- [reCAPTCHA] reCAPTCHA HTML/source match on `google.com/recaptcha` (evidence shows hit count).
- [reCAPTCHA] Secondary reCAPTCHA clue (recaptcha): leftover hosts still spelling reCAPTCHA.
- [reCAPTCHA] Policy-only reCAPTCHA mentions (recaptcha) without a structural reCAPTCHA host stay unconfirmed.
How to read the result
Ratify confirmed reCAPTCHA after collecting host, header, cookie, attribute or script-path matches. Challenges may load only on authenticated routes or inside third-party iframes the initial fetch never enters. Common false positives: Documentation pages or comment widgets that mention reCAPTCHA without embedding gstatic hosts. After a hit: Measure challenge script bytes, check overlap with edge bot fights, and decide v2 vs v3 UX cost.
What to do next
Measure challenge script bytes, check overlap with edge bot fights, and decide v2 vs v3 UX cost. Bot challenges interact with edge rules on Cloudflare detector. Form UX plus vitals land on run the full performance / images / SEO / accessibility audit on the home page.
Related detectors
FAQ
How is reCAPTCHA detected?
From structural signatures in the public HTML and response headers (domains, paths, attributes, scripts). Every verdict lists how many times each pattern matched — nothing is guessed.
Can the result be wrong?
If only a bare brand keyword matches without structural evidence, we label it \u201clikely\u201d instead of \u201cconfirmed\u201d — we would rather under-report than cry wolf.
Do you save the URLs I check?
No. The audit runs inside the request and the URL you paste is not written to storage. There are no third-party tracking scripts on the page either, so no log of who checked what exists. Copy the result yourself if you want a record.
Can a website hide what it is built with?
Partly, but rarely completely. The HTML sent to your browser, the response headers, script paths and asset structure have to be exposed to work, so there is always something readable. Server-side code, build config and private APIs stay invisible. That is why this tool reports the evidence it found rather than claiming a full picture. No match does not mean the technology is absent.
How can I tell reCAPTCHA v2 from v3?
The usual cue is whether a visible widget exists. v2 renders a checkbox or an image challenge, so you can see the iframe and the asset paths. v3 is script-only: nothing appears to the user and a score decides whether to let the request through. So not seeing a visible challenge does not mean reCAPTCHA is absent. It may simply be v3.
Optimization help is available
Tell me your URL and what you want fixed — you get a clear scope, price and timeline.
To：[email protected] | Cc：[email protected]
