The CAPTCHA on your Shopify store costs $1.50 per thousand to defeat

A Shopify merchant who ticks the two spam-protection boxes in their admin is deploying a defence that costs an attacker somewhere between a tenth and three tenths of a cent to defeat. That price is not a secret, and it is not quoted on a criminal forum. It is published on the pricing pages of at least a dozen companies that sell CAPTCHA solutions in bulk, alongside API documentation, SDKs for five programming languages, and volume discounts.

This is the missing context in a discussion that has been running on the Shopify Community, under a dozen different titles, since 2021. A merchant reports drowning in contact form spam. An expert replies: enable CAPTCHA under Online Store → Preferences. The merchant replies that both boxes are already ticked. The expert does not reply again.

One merchant, three days into a new store, described receiving "an insane amount of spam" with both options enabled. On a second thread a merchant counted ten spam messages in a single morning. A third summarised the pattern:

"Every post I see regarding this matter is met with an Expert saying that reCAPTCHA will solve the issue. Yet, replies consistently follow with 'I have this set up and STILL get spam.' Then, all of a sudden, the Expert disappears."

Shopify Community, thread on contact form spam

Nobody is being fobbed off. The advice is the correct first step. It is incomplete in four specific and knowable ways, and no one has laid them out.

What the setting actually switches on

Under Online Store → Preferences → Spam protection, Shopify offers merchants two checkboxes. Ticking them injects hCaptcha into a defined set of storefront forms. According to Shopify's developer documentation, that set covers customer login, account creation, password reset, contact, newsletter signup and blog comments. Shopify migrated to hCaptcha from Google reCAPTCHA in a phased rollout; the admin setting and most help articles still use the older name.

The mechanism matters more than the list. Shopify inserts the code through the content_for_header Liquid object and identifies which forms to protect by looking for its own hidden form_type input, whose value will be contact, customer or new_comment. The challenge does not initialise on page load. It wires up when a visitor first interacts with the form, typically on clicking into a field.

One consequence catches merchants out immediately. The checkboxes are grouped and cannot be split. The first covers contact, newsletter and blog comments together; the second covers login, account creation and password reset. A merchant who wants the contact form guarded and the newsletter signup left frictionless has no way to arrange that in Shopify.

Four conditions must hold before a single bot is stopped:

1. The setting is enabled.
2. Your theme outputs content_for_header, unmodified, on the layout containing the form.
3. The form carries Shopify's native form_type input.
4. Nothing else on the page prevents hCaptcha's resources from loading.

Shopify's documentation flags the last one explicitly: "Some third-party applications may block hCaptcha resources, or otherwise manipulate the DOM in ways that cause hCaptcha to not wire up correctly. Such apps could be focused on improving page load metrics or managing GDPR consent."

The coverage map

Below is every place a stranger can push text into a Shopify store, and what is guarding each one. The built-in CAPTCHA covers the forms Shopify ships and nothing else.

The checkout row warrants a note, because checkout is where the most alarming-looking spam arrives and it is not governed by the storefront CAPTCHA setting at all. Shopify Payments runs a platform-level machine learning model that, by the company's published figures, intercepts roughly 90 percent of card-testing attacks before they reach a payment processor. That is Shopify measuring Shopify, and we have no independent way to verify it. The direction is right regardless: a flood of declined transactions is a payments fraud problem, fought in a layer where the merchant holds almost no controls, and no form-spam app, ours included, is the correct tool for it.

The four routes around it

Assume the best case: the setting is on, the theme is clean, the form is native, and nothing blocks the script. The challenge fires exactly as designed. Spam still arrives, for four reasons that have nothing to do with the challenge being weak.

Route 1: the form is not Shopify's

Covered in the map above. In our own support queue this is the most common cause by a wide margin, which is why it goes first.

Most form-builder and page-builder apps ship their own spam protection, and in the ones we have examined it is switched off by default. The fix therefore lives in that app's settings rather than Shopify's. Look for a section labelled spam, security or bot protection, which will usually contain a CAPTCHA toggle and sometimes a honeypot option.

If the app offers nothing, the form is unprotected regardless of what the Preferences page reports. The options at that point are to replace it with a native Shopify form, put a third-party filter in front of it, or accept the spam. Knowing which of the three is being chosen is worth more than any further adjustment to the Shopify checkbox.

Route 2: the challenge gets solved, for about a tenth of a cent

There is a mature commercial industry that sells solved CAPTCHA tokens in bulk. It operates in the open, with public pricing pages, API documentation, client libraries and volume discounts.

2Captcha, which has been trading since 2007, lists reCAPTCHA v2 at $1 to $2.99 per thousand solves. Competing services quote reCAPTCHA v3 at around $1.45 per thousand and hCaptcha, the challenge Shopify actually serves, in the same range. Several advertise a minimum score parameter for reCAPTCHA v3, under which the buyer names the score the returned token must carry and pays more for a higher one.

Converted to the unit that matters to a merchant: defeating the CAPTCHA on a Shopify contact form costs the sender roughly $0.0015 per submission. A thousand spam messages in your inbox represents an outlay of about a dollar fifty.

None of this makes CAPTCHAs useless, and the conclusion merchants sometimes draw from it, that the checkbox is pointless, is wrong. A CAPTCHA is an economic control rather than an absolute one. It raises the cost per submission, and whether that is sufficient depends entirely on what a successful submission is worth to the sender.

For a link-building operation sending the same pitch to fifty thousand stores, at a tenth of a cent each, the answer is that it is not sufficient. For an opportunist scraping unprotected forms, it is. This is why the same setting that ends the problem on one store does nothing on another, and why merchants comparing notes on a forum thread reach flatly contradictory conclusions about whether it works.

Route 3: the sender is a human

Merchants should read their last twenty spam messages before buying anything. If more than a quarter are SEO pitches, guest-post requests, link-building offers, unsolicited site-speed audits or wholesale-supplier introductions, a large part of the problem is not automated. A person, usually paid per submission, is typing into the form.

No CAPTCHA stops this, and it would be dishonest to imply otherwise, including about our own product. A human passes a human-detection test. The effective control is a mail rule, and we return to it in the matrix below.

Route 4: it never wired up

This is the silent failure, and the reason merchants search for "Shopify hCaptcha not working" and find nothing useful. Because the challenge initialises on interaction rather than page load, and because it depends on an unmodified content_for_header, it can be entirely absent from a page while the Shopify admin continues to report it as enabled. No warning is raised anywhere in the interface.

Ten-minute triage: read your own spam

Before installing anything, a merchant can establish which of the four routes applies. The evidence is already in the inbox and the page source.

Run these in order. Each step only means what it says if the ones above it came back clean.

1. Confirm the CAPTCHA is physically present

   Open the contact page, click into a field to trigger the wire-up, then view source or open developer tools and search for h-captcha. A live installation renders a div.h-captcha carrying a data-sitekey attribute.

   Nothing there → Route 4. Your theme, or an app, is the problem. Disable recently-added speed and consent apps one at a time and re-test.
2. Identify which form the spam came through

   Shopify contact form submissions arrive at the store contact address with a recognisable structure. App-built forms usually arrive from the app, carrying its branding or a different reply-to address. Sort ten messages into two piles.

   Six or more from app forms → Route 1. Fix it in that app's settings; Shopify's checkbox will never help you.
3. Score the messages for humanity

   Count how many are gibberish or empty submissions, against how many are coherent sales pitches that mention the actual store or product.

   More than half coherent pitches → Route 3. This is a filtering and mail-rule problem, not a bot problem.
4. Check the timing signature

   Check the timestamps. Dozens within a few minutes at consistent intervals, usually overnight, indicates automation. A steady trickle of two or three a day across working hours in several time zones indicates people.

   Tight bursts, with steps 1 and 2 clean → Route 2. The challenge is present, the form is native, and something is still getting through it. The answer is scoring and behavioural signals rather than a harder puzzle. If step 1 came back empty, tight bursts mean Route 4: automation walking through a gate that isn't there.

What each defence actually stops

Most guides end with a list of things to try without saying which route each addresses. Merchants consequently stack four defences against one route and leave the other three open.

Two rows in that table deserve stating plainly.

The last row is a real option. Shopify support staff have suggested it on the company's own forums: remove the contact form and publish an email address and phone number instead. The cost is the enquiries lost from people unwilling to open a mail client. The benefit is a quiet inbox. A store taking ten genuine enquiries and three hundred spam messages a month should run that arithmetic before dismissing it. It is not the answer we sell. It is sometimes the correct one.

Keyword mail rules are undervalued. They cost nothing, take about fifteen minutes, and are the only item on the list that does anything about a human sender. Filter on the phrases that recur in the actual spam, typically guest post, do-follow, affordable packages, bulk order enquiry and we noticed your website, into a folder reviewed weekly rather than hourly. Mail rules do not stop the submission. The message still arrives; it arrives somewhere it will be read once a week. This is worth doing whether or not anything else is installed.

How to stop spam on Shopify, in order of effort

Putting it together, in the order that gives you the most relief per minute spent:

1. Verify, don't assume. Run the ten-minute triage. Knowing your route saves you from fixing the wrong thing three times.
2. Keep Shopify's CAPTCHA on. It is free and it does absorb the naive traffic. Just stop expecting it to be the whole answer.
3. Write your mail rules today. Fifteen minutes, permanent benefit, works against the category nothing else touches.
4. Extend scoring beyond the six forms Shopify can see. This is the gap that leaves most merchants exposed. It is also the gap our app exists to close, along with every competitor's.
5. Add traps and behavioural signals. A purchased token proves a challenge was solved. It says nothing about whether the browser filling the form was real, or how it moved and typed. A hidden field that only automation completes costs nothing and catches the traffic that never loaded the storefront at all.
6. Confirm what the filter does when its verification service is unreachable. A spam filter that blocks a paying customer during a third-party outage has cost the store more than the spam did.

That last item is the question we would put to any vendor in this category, ourselves included. The answer belongs in the documentation rather than in a merchant's discovery of it during an incident.

The merchant quoted at the top of this report, three days into a new store with both boxes ticked and an expert who stopped replying, was on Route 1 or Route 4. Neither has anything to do with the checkbox they were told to tick. Ten minutes of triage would have established which, and they would have stopped waiting for an answer that was not coming.

The underlying position has not changed since Motoyama's team documented the solving market in 2010. A challenge sets a price. The price is currently about a tenth of a cent, it has fallen every year for sixteen years, and the only question that matters to a merchant is whether their inbox is worth more than that to the person on the other end.

Our next dispatch examines the scoring layer in detail, including what a risk score of 0.3 represents and where to set a threshold. Merchants seeing the traffic arrive through the newsletter form rather than the contact form should read our report on subscription bombing, where the store is not the target but the weapon.