The reCAPTCHA alternative that reads the message
reCAPTCHA asks whether a visitor is human. Doorman reads what they sent and whether it's someone who wants what you sell, so a person pasting pitches is kept out and a real customer never sees a puzzle.
Free for 1,000 checks a month. Paid plans from $12. No card required.
Transcript
- “Your contact form.” A message is typed into a contact form: “We do SEO and link building. Quick 15 min chat?” and sent.
- “It gets pitched all day.” The message arrives at Doorman’s door.
- “Doorman reads every one.” It is marked Dropped, sales pitch, with the giveaway sentence underlined. A real demo request is marked Delivered.
- “In ~100 ms. Pitches, bots and fraud out.” Card fraud, abuse, fake sign-ups and bot spam are kept out; real customers go to the inbox.
- “Tell your coding agent.” A Copy prompt button for Claude Code, Codex, Cursor and OpenCode is clicked.
- “It sets everything up.” The agent is asked to protect the contact form with Doorman, reads withdoorman.com/llms.txt, changes the form’s action URL and confirms a test submission was delivered.
- “Enterprise-grade. Priced for everyone.” Free: 1,000 checks a month. Pro: $12 a month. No captcha, no sales call.
- Doorman. Spam protection for every website.
Sound familiar?
People pass captchas
Agency and SEO outreach is typed by humans, and generated spam runs in real browsers. A human check doesn't tell a buyer from a pitch.
Challenges cost real customers
Every puzzle is friction on the form you most want people to finish.
A score isn't a reason
When a real enquiry is blocked, a risk score doesn't tell you why. Doorman shows the sentence that decided it.
Doorman and reCAPTCHA, side by side
| Question | Doorman | reCAPTCHA |
|---|---|---|
| What it checks | What the visitor sent, against what you sell | Whether the visitor behaves like a human |
| Human-written pitches and abuse | Kept out, with the line that gave it away | Pass: a person solves it |
| What real visitors see | Nothing | Nothing (v3) or a challenge (v2) |
| Why something was blocked | The exact sentence | A score |
| Unsure submissions | Held and forwarded to you, never lost | Your code decides on a score threshold |
| Fake sign-ups and card testing | Judged from the signals you send | Slows automated attempts |
| Script on your page | None: a form URL or one server call | Google's script on every protected page |
| Price | Free for 1,000 checks a month, then $12 | Free tier, then billed through Google Cloud |
You can run both: keep reCAPTCHA for high-volume bot traffic and let Doorman read what gets through. Comparison of publicly documented behaviour as of September 2026. Sources: developers.google.com/recaptcha, cloud.google.com/recaptcha/docs/compare-tiers.
Which one is right for you?
Choose Doorman if
- The junk in your forms is typed by people: agency pitches, SEO outreach, partnership offers
- You want no challenge and no third-party script on your pages
- You want the reason for every block, and unsure submissions held rather than lost
- You'd rather not wire up a score threshold yourself
Choose reCAPTCHA if
- Your problem is high-volume automated bots across many pages, not what forms say
- You already use Google Cloud and want bot scores on logins and page actions, not just forms
- You need a free check at very large volume and a score is enough
Many sites run both: reCAPTCHA in front for bulk bot traffic, Doorman on the forms to read what gets through.
Switch in two minutes
- Hosted form: change the form's action to your Doorman URL and remove the reCAPTCHA script and widget.
- From your server: replace the siteverify call with one doorman.check call; act on deliver, hold or drop.
- Or ask your agent: copy one prompt into Claude Code, Codex or Cursor and it does the swap.
- Start safely: watch mode delivers everything for a week and tags what it would have dropped.
<!-- before --> <script src="https://www.google.com/recaptcha/api.js" async defer></script> <form action="/contact" method="POST"> … <div class="g-recaptcha" data-sitekey="…"></div> <!-- after: no script, no widget --> <form action="https://withdoorman.com/f/f_yourForm" method="POST"> …
Checked, not guessed
Every decision comes from Doorman's models reading the submission, in milliseconds, with the reason attached.
Labelled test set: 104 invented but labelled contact-form and checkout submissions, judged live; latency is the median of those checks. Questions were not tuned to the set.
Questions
Does Doorman stop bots too?
Yes. Scripted and generated submissions are judged like any other and dropped, and hosted form endpoints are rate limited per IP. For very high-volume bot attacks you can keep a bot check in front as well.
Is it a drop-in replacement?
For forms, yes: change the action URL or swap the server-side verify call for a check call. It isn't a general bot wall for every page of your site.
What about privacy?
Doorman sees only what the form sends plus the sender's IP, keeps it for your plan's retention period, and never uses it for training. No third-party script runs on your page.
How much does it cost?
Free for 1,000 checks a month. Pro is $12 a month for 25,000 and Business is $49 a month for 250,000. Every plan gets the same models. See pricing.
Try it on your own forms
Free for your first 1,000 checks every month. Start in watch mode and see every call before you trust it.