The reCAPTCHA alternative that reads the message.
Messages that pass a captcha: real submissions and how Doorman judged them
-
Specimen · Contact formNº 103738 5560
From growth@rankwise.io
“Your restaurant isn't showing on page one of Google. We can fix your local SEO in 30 days, guaranteed. Can I send a proposal?”
Sales pitch
1% chance it’s real · 82 ms
Void -
Specimen · Contact formNº 102060 7941
From zara@quill.example
“I run Quill Legal. We use Xero today. Half our clients are in the UK. Can we get a demo this week?”
91% chance it’s real · 87 ms
Genuine -
Specimen · Contact formNº 100383 0322
From hello@pixelcraft.agency
“We build stunning websites for architects. Your current site feels dated. 15 minute call to show you some concepts?”
Sales pitch
2% chance it’s real · 84 ms
Void -
Specimen · Contact formNº 098705 2703
From kofi@proton.me
“I run Brightline Dental. Clients keep asking to pay by card and we can't take it. Does it import from what we use now?”
81% chance it’s real · 78 ms
Genuine -
Specimen · Contact formNº 097027 5084
From hello@scaleleads.co
“Are you accepting guest posts? I have a well researched article on small business cash flow that fits your audience.”
pitch
2% chance it’s real · 83 ms
Void -
Specimen · Contact formNº 095349 7465
From claire.m@gmail.com
“Hi, my son chipped a front tooth at football. Do you have anything this week for children? He's 11.”
95% chance it’s real · 90 ms
Genuine
Sound familiar?
reCAPTCHA asks whether a visitor is human. Doorman reads what they sent and whether it's someone who wants what you sell, so a pitch from a bot that passes the check is still kept out, and a real customer never sees a puzzle.
14 days of Pro free, no card. Then free for 100 submissions a month, or Pro from $29.
- Bots pass captchas nowOutreach tools now write a tailored pitch for each site, run in real browsers and solve the challenge. A human check doesn't tell a buyer from a pitch.
- Challenges cost real customersEvery puzzle is friction on the form you most want people to finish.
- A score isn't a reasonWhen a real enquiry is blocked, a risk score doesn't tell you why. Doorman shows the sentence that decided it.
Doorman and reCAPTCHA, side by side.
| Question | Doorman | reCAPTCHA |
|---|---|---|
| What it checks | What the visitor sent, against what you sell | Whether the visitor behaves like a human |
| Pitches from bots that pass the check | Kept out | Pass: the bot solves it |
| What real visitors see | Nothing | Nothing (v3) or a challenge (v2) |
| Why something was blocked | The exact sentence | A score |
| Unsure submissions | Held and forwarded to you, not dropped | Your code decides on a score threshold |
| Script on your page | None: a form URL or one server call | Google's script on every protected page |
| Price | Free for 100 submissions a month, then $29 | Free tier, then billed through Google Cloud |
You can run both: keep reCAPTCHA for high-volume bot traffic and let Doorman read what gets through. Comparison of publicly documented behaviour as of September 2026. Sources: developers.google.com/recaptcha, cloud.google.com/recaptcha/docs/compare-tiers.
Which one is right for you?
Choose Doorman if
- The junk in your forms is typed by people: agency pitches, SEO outreach, partnership offers
- You want no challenge and no third-party script on your pages
- You want the reason for every block, and unsure submissions held rather than lost
- You'd rather not wire up a score threshold yourself
Choose reCAPTCHA if
- Your problem is high-volume automated bots across many pages, not what forms say
- You already use Google Cloud and want bot scores on logins and page actions, not just forms
- You need a free check at very large volume and a score is enough
Many sites run both: reCAPTCHA in front for bulk bot traffic, Doorman on the forms to read what gets through.
Switch in two minutes
- Hosted form change the form's action to your Doorman URL and remove the reCAPTCHA script and widget.
- From your server replace the siteverify call with one doorman.check call; act on deliver, hold or drop.
- Or ask your agent copy one prompt into Claude Code, Codex or Cursor and it does the swap.
- Start safely watch mode delivers what it would have dropped, tagged, until you switch it to enforce.
<!-- before --> <script src="https://www.google.com/recaptcha/api.js" async defer></script> <form action="/contact" method="POST"> … <div class="g-recaptcha" data-sitekey="…"></div> <!-- after: no script, no widget --> <form action="https://withdoorman.com/f/f_yourForm" method="POST"> …
Checked, not guessed.
Every decision comes from Doorman's models reading the submission, in milliseconds, with the reason attached.
- 13/13
- agency and SEO pitches dropped in our labelled set; a captcha would pass all of them
- 0
- genuine enquiries dropped; the unsure ones were held for you
- ~100 ms
- to judge a submission, invisible to the visitor
Labelled test set: 104 invented but labelled contact-form and checkout submissions, judged live; latency is the median of those checks. Questions were not tuned to the set.
Questions
Does Doorman stop bots too?
Yes. Scripted and generated submissions are judged like any other and dropped, and hosted form endpoints are rate limited per IP. For very high-volume bot attacks you can keep a bot check in front as well.
Is it a drop-in replacement?
For forms, yes: change the action URL or swap the server-side verify call for a check call. It isn't a general bot wall for every page of your site.
What about privacy?
Doorman sees only what the form sends plus the sender's IP, keeps it for your plan's retention period, and never uses it for training. No third-party script runs on your page.
How much does it cost?
Free for 100 submissions a month. Pro is $29 a month for 5,000 and Business is $79 a month for 50,000, and every account starts with 14 days of Pro. Until November 30, the first 100 paying customers get Pro at $19 and Business at $59, kept for as long as they stay. See pricing.
Try it on your own forms.
Start with 14 days of Pro, free. Turn on watch mode to see every call before you trust it.