hCaptcha for WP adds hCaptcha protection to WordPress. It helps distinguish people from automated systems across supported forms, logins, selected site content, and REST requests.

What Pro and Enterprise add

hCaptcha Pro uses advanced machine learning to reduce the challenge rate and includes interface customization. Pro and Enterprise support passive and no-challenge modes, including a 99.9% passive mode designed to reduce interruptions for users. hCaptcha Enterprise adds fraud protection for human and automated abuse.

Choose where checks apply

The extension integrates with WordPress Core, WooCommerce, Contact Form 7, Elementor, and more than 60 other add-ons and themes. Supported areas include login, registration, password recovery, comments, checkout, and other submissions. You can require verification before form submission, turn off hCaptcha for logged-in users, and protect selected URLs and content. Content protection works best with Pro’s 99.9% passive mode.

When the matching protections are enabled, the plugin can keep configured posts, pages, collections, and search results out of WordPress REST responses, require hCaptcha for native REST comments, and block REST post-password attempts. Each safeguard depends on its corresponding protection being enabled.

How request controls affect visitors

Honeypot fields and minimum submit time checks can catch automated submissions before a challenge appears. Administrators can allowlist trusted IPs so hCaptcha is skipped, denylist abusive IPs to block protected form submissions, and allowlist or denylist countries to control where protections apply. On websites behind a proxy or CDN, trusted IP headers should be selected only when the hosting setup ensures they cannot be supplied unchanged by visitors.

Delayed API loading lets the hCaptcha script load immediately or after interaction with a protected form. Multisite support can synchronize settings across a WordPress Multisite Network. The plugin also includes a Migration Wizard for moving from Google reCAPTCHA or Cloudflare Turnstile, analytics for hCaptcha events and form submissions, and test modes for checking configurations. Selected security actions are available through the WordPress Abilities API for automation; these features require WordPress 6.9 or newer.

Set up and privacy details

Install hCaptcha for WP, then enter the sitekey and secret in Settings > hCaptcha. Run the configuration check, choose the integrations and areas to protect, and test the selected mode. Language, widget size, and theme settings are available, and the Custom Themes Editor lets you edit themes in the plugin.

By default, the plugin does not track users by stealth, store personal data in the WordPress database, or use cookies. When a visitor answers a challenge, their IP address and browser data may be sent to hCaptcha for analysis. If CAPTCHA is enabled for native password-protected posts, successful verification sets a first-party cookie with signed proof of the password scope, not the password itself.

Optional local Statistics is off by default. When enabled, reports sent to hCaptcha include the request IP, full site URL, and plugin configuration; sitekey and secret values are sent only as presence flags. Local event statistics are separate, and IP address and User-Agent collection can be left off.