hCaptcha for WordPress

hCaptcha for WordPress (hCaptcha for WP on WordPress.org) is the official, community-developed plugin for adding the hCaptcha challenge service to a WordPress site. hCaptcha positions itself as a privacy-first replacement for Google reCAPTCHA, and the plugin includes a Migration Wizard that scans for existing reCAPTCHA or Turnstile setups and switches them over.

You sign up at hCaptcha.com, paste in a site key and secret, then enable the forms you want to protect on the Integrations screen. Coverage is the plugin’s main strength: WordPress login, registration, lost password, comments and password-protected posts, WooCommerce login, registration, checkout and order tracking, plus more than 60 plugins and themes.

• Form plugins such as Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Formidable, Forminator and Ninja Forms
• Builders including Elementor Pro, Divi, Avada, Beaver Builder, Kadence, Spectra and Otter
• Community and membership plugins such as BuddyPress, bbPress, Ultimate Member, wpForo, MemberPress and LearnDash

Beyond the challenge itself, the plugin adds a honeypot and minimum submit time, IP allow and deny lists, country access control, an option to skip the widget for logged-in users, login-attempt limits, optional local statistics of events and forms, and multisite settings sync. The hCaptcha script is only printed on pages where a protected form appears and is delayed until the visitor interacts, which keeps page-speed scores intact. A shortcode and PHP helpers cover custom forms.

The plugin is free and works with the free hCaptcha tier, but that tier shows most visitors a visible challenge. The low-friction invisible and 99.9% passive modes, custom challenge themes and higher accuracy come with hCaptcha Pro, which starts at $99 per month billed annually, or Enterprise on a quote. Every check also depends on hCaptcha’s external service, and there is no cloud database of known spammers, so it stops bots rather than human spam.

Choose it if you want one CAPTCHA plugin that reaches almost every form on the site and prefer hCaptcha’s privacy stance over Google’s. Sites that want invisible protection for free may find Turnstile-based plugins a better match.