Batoi Research Group 
Introduction
A Completely Automated Public Turing test to tell Computers and Humans Apart, popularly known as CAPTCHA, is a program you must have seen on many websites. It helps in differentiating between genuine users and bots or automated users. Through challenges and reasoning, this program identifies automated scripts and real users. It restricts automated scripts and bots from running or inserting feedback and inputs in various websites.
According to a report, overall, internet users spend roughly 500 years every day on CAPTCHAs. But you must be wondering what this reCAPTCHA is? In this article, we will unfold the mysteries of reCAPTCHA - driven by Google with a promise of preventing bot-based traffic. We will also dig deep into the pros and cons of reCAPTCHA.
What Is reCAPTCHA?
ReCAPTCHA is Google's security service or measure that protects websites from automated scripts, spam, and abuse by differentiating humans from non-human users or bots. Google released it in 2007. Google's reCAPTCHA is by far the most widely-used CAPTCHA system. Currently, 6 million websites, including top companies like CNN, Facebook, Pixabay, DropBox, Ticketmaster, Medium, etc. The Turing test within the CAPTCHA helps determine whether the computer can perform human-like behavior. Is Google's reCAPTCHA Completely Free?
Google's reCAPTCHA is not free. Although Google promotes it as a free service, the freemium allows only up to one million API calls per month. Organizations that leverage reCAPTCHA with more than a million calls per month need to sign up to upgrade the service to reCAPTCHA Enterprise. The reCAPTCHA's enterprise edition costs 1 USD per 1,000 calls. This price is for a range of 1,000,001 to 10,000,000 calls per month. If the reCAPTCHA API call exceeds more, Google recommends contacting the cloud sales team. Visit Google's reCAPTCHA chart from this link.
How does reCAPTCHA Work?
The verification process of reCAPTCHA leverages AI to identify human actions and behaviors that the bot cannot follow. The entire testing process is automated so that the process does not involve human interference. That is why the tests are continuously maturing as the reCAPTCHA uses machine learning to distinguish malicious or automated bots and humans seamlessly. Internally, for every user request, the reCAPTCHA returns a value between 0 and 1. It defines whether the request originated from a bot or a human.
A score close to 0 will generate the message "Sorry, you're a bot," while a score close to 1 generates a message "Congrats, you're a human." It also allows customization to the testing mechanism. To improve test accuracy, website admins can specify explicit actions such as "sending a connection request" or "repeatedly visiting the homepage." It will help the reCAPTCHA comprehend how normal human behavior can vary.
Pros and Cons of reCAPTCHA
ReCAPTCHA actively prevents the site from automated scripts, bots, and data theft and allows the website administrator to run a secure application with integrity. Here are some of the advantages of using Google reCAPTCHA.
- Security: The reCAPTCHA test is influential as it provides an additional layer of security for web applications having comment areas and sign-up forms. It prevents attacks leveraging auto-scripts and bots.
- Free: Google's reCAPTCHA is free of cost to some extent. So, any developer who wants to test it or provide a small service through a web app can employ the free version rather than the enterprise version.
- Saves time: Using reCAPTCHA saves time as the website service remains available to genuine users only. The test deters bots from flooding your website, form, web app, blog, or comment section with fake users.
- Diverse test options: Google's reCAPTCHA comes with various options while testing legitimate users and bots.
Although it provides a test to distinguish between humans and bots leveraging machine learning, the tests are not entirely free of flaws. Here are some of the cons of using this tool.
- Efficacy: Some advanced bots and auto-scripts can trick some of the older reCAPTCHA tests, making the sites prone to bot attacks and spam.
- User Experience (UX): ReCAPTCHA tests often hamper the user experience by interrupting the normal flow of what users are attempting to accomplish. This repetitive interruption often results in a negative user experience and might even compel visitors to leave the site.
- Costly: For some new businesses with high traffic, the expense of paid reCAPTCHA (enterprise version) might be challenging to endure.
How to Install reCAPTCHA on a Website?
Think first, in which section of your website you want to add the reCAPTCHA. It is usually relevant with online forms, comment sections, contact pages, or sign-up sections. Now, follow the steps below to create V3 Site Key and Secret Key in Google reCAPTCHA.
Login to your Google account using your user credential. Upon successful login, open a new tab and type the URL www.google.com/recaptcha
Give the label as (Your Domain Name). Select reCAPTCHA v3 from the reCAPTCHA type. Give your domain name details as (www.example.com).
By default, your email ID will be shown as the Owner's email ID. If you want to add more users for managing reCAPTCHA, then enter the email ID in the + text box. Check on the Accept the reCAPTCHA Terms of Service checkbox. Check the Send alerts to owners checkbox. It will help send alerts if Google detects problems with your site, such as misconfigurations or increased suspicious traffic.
Click on the Submit button.
Copy the keys and use them on your website.
Conclusion
All web applications and websites are prone to various cyberattacks because of the large attack surface. So, to mitigate or minimize the risk of bot-based attacks, spam, or auto-scripts, every website admin and owner should take full advantage of adding reCAPTCHAs. Although it comes with minor drawbacks, it caters to many benefits that can help the website grow in the long run.
