Download websites that use reCAPTCHA

About reCAPTCHA

A bot defence is installed in response to a problem, which makes reCAPTCHA one of the few entries in this index whose presence implies that something happened. Nobody adds friction to their own forms speculatively. As of September 2026 we detect it on 4,078,622 sites, and each of those is a site that was worth attacking, or believed itself to be.

That inference is the useful part. Spam and credential pressure follow value, so the presence of a challenge on a form is weak but genuine evidence that the site handles something worth taking: accounts, payments, bookings, submissions with commercial worth attached. Sites with nothing to steal rarely accumulate enough abuse to justify the friction.

There is a second reading about who administered the site. Deploying a challenge requires obtaining keys and configuring a service, which is a step above installing a plugin and clicking activate. Its presence therefore skews toward sites with somebody technical involved, or at least somebody who followed a guide to the end.

The population also carries an unusual privacy and compliance dimension. The service is operated by a large advertising company and executes in the visitor's browser, which places it inside the scope of several regulatory conversations. For anyone selling consent tooling, privacy auditing or alternatives in this category, the population of sites already running it is the addressable market, and it is not published anywhere.

United States accounts for 1,793,093 of detections and the .com zone leads.

The queries that matter here are intersections with commercial signals. A challenge plus a payment integration plus a login path describes a transactional site. A challenge on an otherwise static brochure site usually means somebody drowned in form spam, which is a different and often more immediate need.

The webatla export carries every detection on a domain together, rebuilt daily, so those intersections are a local filter rather than a sequence of paid lookups.

The friction itself has commercial consequences worth measuring. Challenges reduce form completion, and businesses that depend on inbound enquiries are trading leads for spam reduction whether or not they have quantified the exchange. A site with a challenge on a high-intent form is a site with a problem it has solved in a way that costs it revenue.

That makes the population a market for alternatives rather than merely a list of adopters. Vendors selling invisible or risk-based bot mitigation are selling against exactly this trade, and the sites where the trade is most expensive are identifiable by what surrounds the challenge: a payment path, a booking flow, a quote request. Presence plus commercial intent locates the sites where the friction is costing the most.

Google operates it as a Proprietary service and it has been available since 2007. The service is free to deploy, which is why its footprint reflects site owners' decisions rather than any commercial relationship.