hCaptcha — Performance Grade C
Heavy — high conversion risk
hCaptcha is a trust badges and security signals app for Shopify that scores Grade C overall in StackConflict’s independent performance lab. The grade is driven entirely by its download payload: our lab recorded 307.74 KB of JavaScript — a heavy JavaScript bundle that will delay first-paint on slower mobile connections, placing it in the C-tier for network cost. Notably, once downloaded, the script executes very efficiently: only 53 ms of desktop CPU time (Grade B), meaning the bottleneck is connection speed and first-paint delay, not main-thread execution.
The practical impact for Shopify merchants is a longer first-paint on slower connections. A 307.74 KB download must complete before the script can initialise — on a mid-range mobile connection (10 Mbit/s) this adds roughly 240 ms of network latency before the browser even begins execution. Once the script does load, it runs quickly: StackConflict’s 4× mobile throttle measurement recorded only 234 ms (0.23s) of CPU execution — well within acceptable limits. For merchants on high-speed connections or desktop-dominant traffic, the payload cost is far less noticeable than on mobile-heavy, emerging-market stores.
Verdict (Grade C — Heavy): If Shopify store speed and mobile conversion are priorities, merchants should evaluate lighter alternatives before committing to hCaptcha. StackConflict has benchmarked Pledge and Trusted Shops Trustbadge in the same trust category — both carry Grade A or B ratings with significantly lower payload and CPU profiles. The performance difference compounds on mobile-first stores where JavaScript parse, compile, and execution times are amplified by device limitations.
Lab Results
| Metric | Value | Grade |
|---|---|---|
| JS Payload | 307.74 KB | C |
| CPU Execution (desktop) | 53 ms | B |
| CPU Execution (mobile) | 234 ms | — |
| Cumulative Layout Shift | 0.0 | A |
| Overall Grade | — | C |
| Category | Trust | — |
| Last tested | 2026-05-30 | — |
Lab Verdict
Grade C driven by large download payload. Monitor mobile conversion impact carefully.
Grading Scale
Each app is graded across three independent dimensions. The final grade is the worst of the three — no dimension can be hidden by a good score elsewhere.
| Grade | Payload | CPU (desktop) | CLS | Risk |
|---|---|---|---|---|
| A | ≤ 30 KB | ≤ 50 ms | < 0.1 | Lightweight — zero friction |
| B | ≤ 150 KB | ≤ 150 ms | < 0.25 | Acceptable — monitor on mobile |
| C | ≤ 500 KB | ≤ 500 ms | < 0.5 | Heavy — high conversion risk |
| D | > 500 KB | > 500 ms | ≥ 0.5 | Critical — avoid on mobile stores |
Faster Alternatives
These trust apps have earned a Grade A or B in our lab and are drop-in alternatives worth evaluating:
About This Test
StackConflict measures app performance in a clean-room environment. Each app’s JavaScript bundle is injected into an owned Shopify development store via a Playwright-controlled browser, with no other third-party apps installed. V8 CPU cost is the ScriptDuration delta measured before and after injection on the same live page. Mobile CPU estimate applies the 4× Lighthouse slowdown factor to approximate real-device impact.
Data sourced from the StackConflict Lab. Last updated 2026-05-30.