Companies Using hCaptcha

I've spent more than ten years building technographic systems, and hCaptcha's count is one you have to take apart before you quote it. A domain counts here when a page on it loads hCaptcha's script, links to hcaptcha.com, exposes hCaptcha's browser objects or lists hcaptcha.com in its Content-Security-Policy header. Our October 2026 crawl finds 139,756 domains that pass, 4th of the 38 tools we track in Bot Detection & CAPTCHA with 2.23%, and we matched 63,777 of them to a company. hCaptcha is a service of Intuition Machines, per its about page.

What the count is made of

The largest block is Shopify. 36.18% of hCaptcha domains run Shopify, and on the stores we opened, the page code loads Shopify's storefront-forms hCaptcha script and labels the forms "Protected by hCaptcha". Those merchants got hCaptcha with their store. WordPress is on 34.07%, mostly through form plugins. In a random sample of 27 live domains, 18 had hCaptcha in their page code: 7 loaded the script, 8 were Shopify stores and 3 carried a WordPress plugin or similar code. Three only listed hCaptcha in their security header, three were for-sale pages, two showed nothing and one didn't answer.

The big-company end looks different. Of the 76 large-company sites in our candidate list that we could fetch, 34 only allow hCaptcha in their security header; nine of those we opened in a browser loaded no hCaptcha at all. Another 26 are investor-relations sites, CBRE's, 3M's and Intuit's among them, that share one hCaptcha site key.

Sales Signal: split any hCaptcha list three ways before using it: Shopify stores (the platform chose), sites with the widget on the page (the owner chose), and header-only sites (nobody may be using it on that page). Only the middle group made a buying decision about CAPTCHA.

The October drop

The chart reads 90,120 in June, 161,153 in July, 183,859 in August, 192,526 in September and 139,756 in October. Part of any month-to-month change is ours: the set of domains we crawl turns over every month, and our detection widens over time. But the October fall has a specific cause. Of the 75,809 domains that lost hCaptcha in the last 45 days, 53,609 carry a for-sale title of the "Name.com is for sale" kind. In a sample of 30 recent drops, 23 were such pages, still live but no longer loading hCaptcha; five were Shopify stores whose pages still carry Shopify's hCaptcha code; one had moved to Turnstile. So September's peak included tens of thousands of parked domains, and the 89,452 domains that dropped hCaptcha since 16 March 2026 are dominated by them.

"hCaptcha didn't lose a quarter of its customers in a month. A parking template stopped loading it, and the Shopify stores in the count come and go with their forms." - Mehmet Suleyman, Founder at TechnologyChecker.io

Sales Signal: treat October's figure, roughly 140,000 domains, as the working base. The drop doesn't show customers leaving, and a churn pitch built on it would be selling against parked domains.

Who the customers are

64.71% of matched companies with a known size have 1 to 10 employees and 21.57% have 11 to 50, so 86.28% have 50 or fewer. They're young as well: 56.43% were founded in 2010 or later, 21.16% in the 2020s alone. By country the US leads with 15,806 matched companies, but Germany (7,123), the United Kingdom (5,704) and France (5,431) together reach 18,258. Retail (5.9%) and Retail Apparel and Fashion (2.56%) lead the industries, which is the Shopify block again.

Above that sits a smaller set of companies that put hCaptcha on the page themselves: Revolut on its sign-in page, Groupe BPCE on its group site, NVIDIA on its documentation hub, ADNOC, Alcoa, CNRS on its science journal and Baker Hughes on its training site.

Sales Signal: for anything sold to small European e-commerce, hCaptcha sites in Germany, the UK and France are a dense list. For enterprise security vendors, start with the sites that load the widget on a login or sign-up page, where fraud is the real problem.

Overlap with reCAPTCHA and Turnstile

reCAPTCHA is about 26 times hCaptcha's size at 3,617,019 domains, and the two often share a site: 10,912 domains run both, about two thirds of the 16,290 ever seen with both. Since March, 2,349 domains that dropped reCAPTCHA now run hCaptcha and 1,478 went the other way. Turnstile, which Cloudflare announced in September 2022, has 265,122 domains, almost twice hCaptcha's count. Only 1,086 domains run both. Of the sites that dropped hCaptcha since March, 560 now run Turnstile, while 244 that dropped Turnstile now run hCaptcha. That history has a twist: in April 2020 Cloudflare moved its own CAPTCHA from reCAPTCHA to hCaptcha, citing a privacy concern about relying on Google. CleanTalk, fifth with 68,967 domains, trades a few dozen domains each way with hCaptcha.

"Thousands of sites run hCaptcha next to reCAPTCHA. The traffic between them is in the low thousands, both ways, which is sites adding a second check, not leaving one." - Mehmet Suleyman, Founder at TechnologyChecker.io

Sales Signal: the 10,912 sites running two CAPTCHAs are the consolidation opportunity. Someone there is maintaining two integrations for one job.

The stack around it

Two platforms carry most of it. Across the 133,650 clean live domains in our stack sample, Shopify is on 36.18% and WordPress on 34.07%. On WordPress, Contact Form 7 (12.56%) and WPForms (4.2%) show where the widget usually sits; WooCommerce is on 6.88%. Google Analytics runs on 54.71%, Cloudflare serves 53.8% and Matomo appears on 5.1%. How a crawler sees each of these signals is covered in our writeup on technology detection methods.

Sales Signal: a WordPress form plugin with hCaptcha support reaches a third of this base. Shopify app vendors can reach another third, though those merchants never chose hCaptcha and won't want to hear it criticised.

Price and reviews

hCaptcha's pricing page lists Basic at $0, Pro at $99 a month billed yearly or $139 monthly with 100,000 evaluations included and $0.99 per 1,000 after that, and Enterprise by quote (checked 10 October 2026). With 64.71% of matched companies at 10 or fewer staff, most of the base is very likely on the free plan. G2's record is thin: a few single-mention snippets praising simple challenges and fraud prevention, no complaints. Visitors meet hCaptcha far more often than buyers review it.

Sales Signal: the paying customers are the minority with the widget on high-value flows such as sign-in, account creation and checkout. Find them by page, not by domain count.

Key takeaways

• 4th in its category. 139,756 domains and 2.23%, behind reCAPTCHA, Cloudflare Bot Management and Turnstile.
• A third via Shopify. 36.18% of domains are Shopify stores using Shopify's built-in hCaptcha forms.
• The October fall is parked domains. 53,609 of 75,809 recent drops carry a for-sale title.
• Big names are often header-only. 34 of 76 large-company sites only allow hCaptcha in a security header.
• Coexists with reCAPTCHA. 10,912 domains run both.

Sales applications

For outreach, reference the page, not the brand: "Your sign-up form uses hCaptcha; here is what we'd add for account-takeover protection." For targeting, filter our hCaptcha list to non-Shopify sites in Germany, the UK and France with 11 to 200 staff, then confirm the widget sits on a login or checkout page. For a competitive angle, the 10,912 sites running hCaptcha and reCAPTCHA together are the place to argue for one tool.

The numbers on this page come from our own crawl and company matching, refreshed monthly. Browse the full hCaptcha list at TechnologyChecker.io.