Why does my form fail in China, and what can replace reCAPTCHA?

A visitor in China can fill in your form, click send, and get nothing. You never hear about it, because a lost lead leaves no trace in your inbox.

This guide explains the cause and what to use instead. It’s part of our guide How to put your website in China.

For every other Google dependency, see which Google services fail in China.

We ran no test from China for this page. Everything below comes from public tests and documents, and we say where they stop.

Does reCAPTCHA work in China?

Not by default. The standard script loads from www.google.com, and that exact address failed all 4 of GreatFire’s recent tests.¹

Here is what we read on November 1, 2026 for the hosts Google lists for reCAPTCHA,⁴ plus its alternative script host.

Address (https)	Role	GreatFire result	Failed tests, last 90 days
www.google.com/recaptcha/api.js	Default script	Blocked, last test October 18, 2026 1	4 of 4
www.recaptcha.net/recaptcha/api.js	Google’s alternative host	Not blocked, last test October 18, 2026 2	0 of 2
www.gstatic.com/recaptcha	Script resources 4	Not blocked, last test August 20, 2026 37	0 of 1
recaptcha.google.com	Frame host 4	Never tested 42	None

Reports match the test. A user quoted Marketo Support in October 2023 saying reCAPTCHA is completely blocked in China, so forms using it won’t accept submissions from there.⁸

Why can one script kill the whole form?

Because the form is often built to wait for it. The visitor sees a normal page, but the submit step depends on a widget that never arrives.

An August 2021 Marketo thread shows the mechanism clearly. Users in China had a disabled submit button. Removing the disabled attribute didn’t help, and the submission still failed.⁷

The explanation accepted in that thread: the button stays disabled while reCAPTCHA initializes. If it never initializes, the form can’t pass validation.⁷

Chinafy, which sells a China optimization service, lists the same symptoms: a widget that doesn’t render, forms that won’t submit, endless loading and errors.⁵

1. 1The visitor fills in the form
2. 2The CAPTCHA script is called
3. 3The script does not load
4. 4The button stays disabled, or validation fails
5. 5Nothing sent, no trace on the company side

CAPTCHA isn’t the only suspect. Chinafy names jQuery on Google’s CDN among WordPress dependencies that struggle in China,³⁸ and GreatFire shows http://ajax.googleapis.com blocked in 2 of 2 tests, up to October 31, 2026.⁴¹

A form script that needs jQuery could stall the same way. That last step is our inference, so check what your form loads.

So you have two jobs, not one. Replace the check, and change how the form behaves when any check fails.

GeeTest and Tencent Cloud both document this. GeeTest’s client falls back when a request doesn’t return HTTP 200.¹⁷

Tencent’s guide generates a recovery ticket when its script fails to load, so your code can decide what to do next.¹⁹

A way through has a cost: bots get it too. Tencent’s ticket is created in the browser, so don’t treat it as proof of a person.¹⁹ That’s why the server-side checks further down matter.

Is recaptcha.net a real fix?

It may work today, but nobody can promise it will keep working. The evidence points both ways, and none of it settles the question.

• For: Google says you can use www.recaptcha.net when www.google.com isn’t accessible to your users. Its FAQ, last updated October 29, 2026, still says so.⁴
• For: The script at that address connected in 2 of 2 GreatFire tests.²
• Against: Two users on Google’s developer forum reported it blocked in January and February 2024.⁶
• Against: Chinafy, in April 2025, calls it unreliable, citing unnamed developers and site owners.⁵
• Mixed: A GitHub issue opened in 2022 runs both ways. One user found no block from Shanghai in August 2023, and the author said in March 2026 it still appeared blocked.⁴⁰
• Gap: Neither Google FAQ mentions China.³⁴ We found no promise from Google that it works there.

Two connection tests can’t prove a form works, and scattered user reports can’t describe a whole country. All we can say is that the address connected recently.

If you try it, swapping one tag isn’t enough. Google says to change the script host, then every other place your site uses www.google.com/recaptcha/.³

Plugins may hide those references, so you may not control them all.

Why doesn’t Turnstile solve it?

Because Cloudflare says so. Its FAQ states that Turnstile is not supported in mainland China, and that visitors there may have issues on both global and China Network zones.⁹

This trap is easy to fall into. Contact Form 7 ships a Turnstile integration and presents it as a CAPTCHA alternative.¹⁰ A site that switches for that reason may have swapped one problem for another in China.

One recent change can mislead you. Cloudflare’s October 28, 2026 changelog says Challenge Pages on China Network zones now use Turnstile widgets hosted on the mainland.¹¹

That covers challenge pages on those zones. Visitors routed through Cloudflare’s global network keep the standard page.¹¹ The entry says nothing about the widget in your form.

China Network also requires an ICP filing or license for each domain.³⁹ See do CDNs and Cloudflare work in China.

Which alternatives can you use?

You have four routes: no CAPTCHA, a self-hosted one, a Chinese service, or hCaptcha Enterprise. We found no independent measurement of any of them, so this table compares evidence, not performance.

Option	What the sources say	Check before choosing
Server-side checks, no CAPTCHA	Nothing for the browser to load from outside. Marketo Support advised a China form with reCAPTCHA disabled 8	Spam handling falls on you
ALTCHA, self-hosted	MIT-licensed proof of work, with examples serving the script from your own files 2122	No China test found
GeeTest	Chinafy calls it widely adopted in China 5. GeeTest’s own page shows 56.2% market share among leading enterprise clients, and 56.3% of leading enterprises elsewhere, with no source for either 16	GreatFire has never tested static.geetest.com 18. No price shown 16
Tencent Cloud Captcha	Global script, documented load failure handling, server check required 19	The docs we read don’t describe results from China
Alibaba Cloud Captcha 2.0	Region defaults to the mainland. Client region and server endpoint must both sit inside or both outside China, or validation fails 20	Account conditions for a foreign company
hCaptcha	https://js.hcaptcha.com connected in 2 of 2 GreatFire tests, up to November 1, 2026, with two refused tests left out 14. Chinafy reports mixed results 5. China options are for Enterprise 13	Ask about those options before relying on the standard plan
Custom image CAPTCHA	Grazitti built one with 20 image patterns, for China IPs 36	No results reported. You maintain it

Note what’s missing from the first column: results. Vendors sell these products, and nobody we read has published a fair comparison. Chinafy also names MTCaptcha, BotDetect and KeyCAPTCHA,⁵ which we didn’t assess.

Our view: for a B2B contact form with modest traffic, start with server-side checks and add nothing else. There’s no third-party script to fail, and no vendor account to open.

Move to a Chinese service when spam actually becomes a problem, or when you protect logins or signups. That’s where a CAPTCHA earns its place. This is a judgment, not a test result.

Free check

Is your website visible on Baidu?

Enter your website. We check Baidu, access from China and how your site is set up, then email you the report.

Your websiteCheck my site

How do you stop spam without a CAPTCHA?

Run the checks on your own server, where a blocked domain can’t touch them. A few simple layers raise the bar, though none stops a determined attacker.

• Honeypot: A field hidden from people. Bots that fill it give themselves away.²³
• Time check: Flag forms submitted too quickly, for example under 5 seconds. WorkOS notes that bots typically take milliseconds.²³
• Rate limit: Cap submissions per IP address on your server, with room for an office sharing one address. WorkOS says combining honeypots with rate limiting strengthens protection.²³
• Manual review of doubtful entries: Flag them rather than delete them, so a real buyer isn’t lost.

WorkOS warns that sophisticated bots may detect honeypots.²³ A contact form needs friction for bots, not a fortress. A login page has higher stakes, so treat it differently.

Don’t filter too hard. HubSpot, for instance, lets you block free email domains.³² Think twice before using that on Chinese leads.

Many buyers may use personal addresses. That’s our caution, not a measured fact.

What about HubSpot, Typeform and Jotform?

Check the script your form actually loads, not the vendor’s home page. A vendor’s site can pass a test while its embed code calls something else.

Tool	Evidence on China	Gap
Google Forms	http://docs.google.com blocked, 1 of 1 test, September 7, 2026 24. AppInChina says Google Forms is blocked 25	No test of a form URL. Don’t rely on it for China
Typeform	https://typeform.com connected in 1 conclusive test, date unclear. A refused test on September 24, 2026 was left out 26	Embeds not tested
Jotform	Domain rated Mixed across 42 URLs 27. A 2019 user blamed Jotform’s CDN for embedded items failing, and support didn’t confirm it 28	js.jotform.com never tested 27
HubSpot	Lead capture forms “may not function properly” without localization, per AppInChina in 2025 30. IT Consultis calls direct embedding not a China-ready default and suggests a China-side capture layer 31	js.hsforms.net never tested 29
Jinshuju	Chinese form tool with an ICP number on its site, no English version visible 33	Chinese interface, and your data sits with a Chinese company

Plugins matter too. Chinafy names Contact Form 7 and HubSpot forms among tools that may use reCAPTCHA internally,⁵ and Gravity Forms among plugins that often call outside services.³⁸

For platform issues, see WordPress, Shopify and Webflow in China.

Where the data lands is a separate question from whether the form loads. Read does China’s privacy law apply to your website and ask a local adviser.

How do you test your form?

Simulate the failure first, then test from China. The first step needs no Chinese connection, and it shows how your form behaves on a bad day.

1. List the hosts. Open the page in Chrome, press F12, choose Network, and reload. Filter for recaptcha, gstatic, googleapis, hcaptcha, turnstile, hsforms, jotform and typeform. Submit a test entry and note where the form posts too.
2. Check the exact address. Look up each script URL on GreatFire, not the home page. Blocking is per address, so a home page tells you little.³⁵
3. Simulate the block. In Network, right-click the script and choose Block request. Chrome lists the pattern in Request conditions.³⁴
4. Reload and submit. If the button stays dead with no message, you’ve found your bug, without leaving your desk.
5. Confirm the lead arrives. Check your inbox or CRM. A success message doesn’t prove delivery.
6. Test from China. Have someone on a mainland network send a real entry, with no VPN. See how to test your site from China.

DevTools marks the request (blocked:devtools), which isn’t how a real failure looks.³⁴ Chinafy, a vendor, says a browser can wait 30 seconds or more on a failed render-blocking file,³⁸ so step 6 still counts. Closing DevTools also turns blocking off.³⁴

The bottom line

If you remember one thing, make it this: a form shouldn’t depend on a script it can’t load. Default reCAPTCHA fails in tests, Turnstile isn’t supported, and recaptcha.net is a stopgap.

Put your spam checks on your own server, show a plain email address, and test a real submission from China.

How Index in China can help

We localize sites into Simplified Chinese and get them indexed on Chinese search engines. Form fixes aren’t a listed part of that offer.

Being found only helps if a buyer can then reach you, so bring your form up when we talk.

Once leads arrive, see answering Chinese inquiries. Book a 30-minute call.

Book a 30-minute call

Monthly report BaiduIndexed Bing ChinaIndexed SogouIndexed