Privacy-focused protection for WordPress
hCaptcha for WP helps distinguish people from automated systems and protect WordPress sites against spam, abuse, and brute-force activity. The plugin supports hCaptcha Pro and hCaptcha Enterprise, giving sites a paid path beyond the free hCaptcha service.
hCaptcha Pro uses advanced machine learning to reduce the challenge rate while maintaining high security and low friction. It also adds UI customization. hCaptcha Enterprise provides a broader advanced security platform with site-specific risk scores, fraud protection, and tools for addressing both human and automated abuse.
Protect forms, logins, and site content
Use hCaptcha protection across WordPress Core, WooCommerce, Contact Form 7, Elementor, and more than 60 other plugins and themes. The plugin can protect logins, registration and password-related areas, forms, selected site URLs, and other submission points.
- Protect login areas and help defend against brute-force attacks.
- Protect selected site content and URLs from automated activity.
- Optionally force verification before a form is submitted.
- Turn hCaptcha off for logged-in users when appropriate.
- Use compatibility with major hide-login, custom-login, and two-factor authentication plugins.
Reduce friction and manage access
Pro and Enterprise support no-challenge modes, including a 99.9% passive mode designed to reduce interruptions for real visitors. Honeypot fields and minimum submit time checks can catch automated submissions before a hCaptcha challenge is shown.
Site administrators can allowlist trusted IP addresses, denylist abusive IPs, and allowlist or denylist countries. These controls help adapt protection to the needs of a store, membership site, form-heavy website, or organization operating across multiple regions. Multisite support allows hCaptcha settings to be synchronized across a WordPress Multisite Network.
Configuration, analytics, and customization
A built-in Migration Wizard helps move from Google reCAPTCHA or Cloudflare Turnstile in a few clicks. Detailed analytics cover hCaptcha events and form submissions, while selected security actions are exposed through the WordPress Abilities API for automation and AI-driven workflows.
Choose supported languages, widget sizes, and themes, or create a custom theme. The Custom Themes Editor lets you edit custom themes directly in the plugin. Delayed API loading can load the hCaptcha API immediately or on user interaction, helping avoid page-loading impact. Live and Pro/Enterprise test modes are available for checking a configuration before wider use.
Installation and setup
Install hCaptcha for WP in WordPress, then open Settings → hCaptcha. After signing up on hCaptcha.com, enter the sitekey and secret provided for the site. Use the configuration check before saving settings, select the areas to protect, and test the chosen mode. The plugin also supports one-click activation and deactivation for plugins and themes with hCaptcha.
The plugin is designed with privacy in mind. Its default configuration does not use cookies, stealth tracking, or database storage of personal data, although the hCaptcha service may receive the answering user’s IP address and browser data on protected pages for analysis.
