hCaptcha Pro for WordPress: Fewer Challenges, More Control

hCaptcha for WP includes challenge-response verification to selected WordPress areas to help distinguish people from automated systems and limit spam, abuse and brute-force activity. It supports the free hCaptcha service, hCaptcha Pro and hCaptcha Enterprise.

Choose a service and challenge behavior

hCaptcha Pro uses advanced machine learning to reduce the challenge rate and adds interface customization. Enterprise adds site-specific risk scores and fraud protection to address human and automated abuse. Pro and Enterprise include passive and no-challenge modes, including a 99.9% passive mode designed to reduce interruptions for users.

Honeypot fields and minimum submit time checks can catch automated submissions before a challenge appears. You can also require verification before form submission or turn hCaptcha off for logged-in visitors.

Protect WordPress forms, accounts and content

Enable integrations for WordPress Core, WooCommerce, Contact Form 7, Elementor and more than 60 other plugins and themes. Protection can cover logins, registration, password recovery, comments, forms, selected URLs and other submission points. Compatibility includes major hide-login, custom-login and two-factor authentication plugins.

When the corresponding protections are enabled, selected posts, pages, collections and search results are protected in WordPress REST responses, native REST comment creation requires hCaptcha, and REST post-password attempts are blocked. Each safeguard depends on its own protection setting.

Set access controls and site preferences

Allowlist trusted IP addresses and denylist abusive ones, or allowlist and denylist countries. Multisite support can synchronize hCaptcha options across a WordPress Multisite Network. Choose supported languages, widget sizes and themes, or edit a custom theme in the plugin.

Delayed API loading lets you load the hCaptcha API immediately or wait for visitor interaction. Live and Pro or Enterprise test modes help check a configuration. The Migration Wizard scans for Google reCAPTCHA or Cloudflare Turnstile settings and applies supported changes. Detailed analytics cover hCaptcha events and form submissions; selected security actions are available through the WordPress Abilities API for automation.

Configure and review data handling

Install the plugin, open Settings → hCaptcha, enter the sitekey and secret for your site, check the configuration, then select integrations and a test mode. The default configuration does not use cookies, stealth tracking or database storage of personal data. If you enable CAPTCHA on native password-protected posts, successful verification sets a first-party cookie containing signed proof of the password scope, not the password itself. On protected pages, the hCaptcha service may receive the answering user's IP address and browser data for analysis. Optional Statistics is off by default; enabling it sends the current request IP and plugin configuration to hCaptcha.