hCaptcha for WP adds challenge-response checks to help distinguish people from automated systems across WordPress forms, logins, selected content and other protected areas. It supports the free hCaptcha service, hCaptcha Pro and hCaptcha Enterprise.

How Pro and Enterprise change verification

hCaptcha Pro uses advanced machine learning to reduce the challenge rate and adds interface customization. Pro and Enterprise include passive and no-challenge modes, including a 99.9% passive mode designed to reduce interruptions. Enterprise adds site-specific risk scores and fraud protection for addressing human and automated abuse.

Choose where WordPress protection applies

Enable integrations for WordPress Core, WooCommerce, Contact Form 7, Elementor and more than 60 other plugins and themes. Supported areas include logins, registration, password recovery, comments, checkout and other form submissions. You can require verification before submission, turn off hCaptcha for logged-in users, or protect selected site URLs. URL protection works best with Pro's 99.9% passive mode.

When their corresponding protections are enabled, the plugin can keep selected posts and pages out of WordPress REST post, page, collection and search responses, require hCaptcha for native REST comments, and reject REST password attempts.

Manage friction and access

Honeypot fields and minimum submit time checks can catch automated submissions before a challenge appears. Administrators can allowlist trusted IP addresses, denylist abusive IPs, and allowlist or denylist countries to control where protection applies. Multisite support can synchronize settings across a WordPress Multisite Network. Compatibility includes major conceal-login, custom-login and two-factor authentication extensions.

Configure and monitor the add-on

The Migration Wizard scans for Google reCAPTCHA or Cloudflare Turnstile configurations, shows what can be migrated and applies changes in one click. Analytics cover hCaptcha events and form submissions. Selected security actions are available through the WordPress Abilities API for automation and AI workflows; these functions require WordPress 6.9 or newer.

Choose supported languages, widget sizes and themes, or edit custom themes in the plugin. Delayed API loading can start immediately or wait for user interaction. Live and Pro or Enterprise test modes let you check a configuration. A configuration check is available before saving keys, and supported plugins and themes can be activated or deactivated with one click.

Setup and privacy

Sign up for hCaptcha to obtain a sitekey and secret, then install and activate the plugin. In Settings > hCaptcha, enter the keys, execute the configuration check, enable the integrations and forms you want to protect, and test the selected mode.

By default, the plugin does not track visitors by stealth, store personal data in the WordPress database or use cookies. If native password-protected posts are protected, successful verification sets a first-party cookie containing signed proof, not the password. The hCaptcha service may receive the answering visitor's IP address and browser data on protected pages for analysis. Optional Statistics is off by default. When enabled, Statistics stores optional local event data and sends hCaptcha a report with the triggering request's IP address, the site URL plus /plugin-stats, and plugin configuration; site and secret key values are omitted, with flags showing whether each is present. Separate IP address and User-Agent settings affect local event entries only.