Title: hCaptcha for WP
Author: hcaptcha
Published: मई 2, 2019
Last modified: अक्टूबर 5, 2026
---
Search plugins
# hCaptcha for WP
[hcaptcha](https://profiles.wordpress.org/hcaptcha/) लिखले बारे
[डाउनलोड](https://downloads.wordpress.org/plugin/hcaptcha-for-forms-and-more.5.4.1.zip)
[Live Preview](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/?preview=1)
* [Details](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/#description)
* [समीक्षा](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/#reviews)
* [Installation](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/#installation)
* [Development](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/#developers)
[मदद](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/)
## बिबरन
The strongest CAPTCHA. Switch from reCAPTCHA and Turnstile for free.
A built-in Migration Wizard helps you move from Google reCAPTCHA or Cloudflare Turnstile
to hCaptcha in just a few clicks.
[hCaptcha](https://www.hcaptcha.com/) is a drop-in replacement for reCAPTCHA that
puts user privacy first.
Need to keep out bots? hCaptcha protects privacy while offering better protection
against spam and abuse. Help build a better web.
hCaptcha for WP [makes security easy](https://www.hcaptcha.com/integration-hcaptcha-for-wp)
with broad integration support, detailed analytics, and strong protection. Start
protecting logins, forms, and more in minutes.
### Benefits
* **Privacy First:** hCaptcha is designed to protect user privacy. It doesn’t retain
or sell personal data, unlike platforms that **g**ather, **o**wn, and m**o**netize**
gl**obal b**e**havior.
* **Better Security:** hCaptcha offers better protection against bots and abuse
than other anti-abuse systems.
* **Easy to Use:** hCaptcha is easy to install and use with WordPress and popular
plugins.
* **Broad Integration:** hCaptcha works with WordPress Core, WooCommerce, Contact
Form 7, Elementor, and over 60 other plugins and themes.
### Features
**Highlights**
* **Migration Wizard:** Migrate from Google reCAPTCHA or Cloudflare Turnstile to
hCaptcha in just a few clicks.
* **Built-in Anti-Spam:** Honeypot fields and minimum submit time catch bots before
the hCaptcha challenge, reducing friction for real users.
* **Detailed Analytics:** Get detailed analytics on hCaptcha events and form submissions.
* **AI-Ready Security:** Selected security actions are exposed via the WordPress
Abilities API for automation and AI-driven workflows.
* **Pro and Enterprise:** Supports Pro and Enterprise versions of hCaptcha.
* **No Challenge Modes:** 99.9% passive and passive modes in Pro and Enterprise
versions reduce user friction.
* **Protect Site Content:** Protects selected site URLs from bots with hCaptcha.
Works best with Pro 99.9% passive mode.
* **Logged-in Users:** Optionally turn off hCaptcha for logged-in users.
* **Delayed API Loading:** Load the hCaptcha API instantly or on user interaction
for zero page loading impact.
* **IP Access Control:** Allowlist trusted IPs to skip hCaptcha and denylist abusive
IPs to block form submissions.
* **Country Access Control:** Allowlist or denylist countries to control where
hCaptcha protections apply.
* **Multisite Support:** Sync hCaptcha settings across a Multisite Network.
**Anti-Spam**
* **Honeypot Protection:** A hidden field catches bots before they reach the hCaptcha
challenge, reducing friction for real users.
* **Minimum Submit Time:** Blocks instant form submissions from automated scripts.
* **IP Denylist:** Block abusive IPs from submitting any protected form.
* **Country Blocking:** Restrict form submissions by country to stop region-specific
spam campaigns.
**Customization**
* **Language Support:** Supports multiple languages.
* **Custom Themes:** Customize the appearance of hCaptcha to match your site.
* **Custom Themes Editor:** Edit custom themes directly in the plugin.
* **Login Compatibility:** Compatible with all major hide login, custom login,
and 2FA login plugins.
* **Login Attempts:** Protect your site from brute force attacks.
**Ease of Use**
* **Test Modes:** Use hCaptcha in live and Pro/Enterprise test modes.
* **Activation and Deactivation:** Activate and deactivate plugins and themes with
hCaptcha in one click.
* **Forced Verification:** Optionally force hCaptcha verification before form submission.
* **Check Config:** Check hCaptcha configuration before saving keys and settings.
* **Auto-Verification:** Automatically verify custom forms.
* **Standard Sizes and Themes:** Choose the size and theme of the hCaptcha widget.
### How hCaptcha Works
The purpose of a CAPTCHA is to distinguish between people and machines via a challenge-
response test and thus increase the cost of spamming or otherwise abusing websites
by keeping out bots.
To use this plugin, install it and enter your sitekey and secret in the Settings
hCaptcha menu after signing up on hCaptcha.com.
[hCaptcha Free](https://www.hcaptcha.com/) lets websites block bots and other forms
of abuse via humanity challenges.
[hCaptcha Pro](https://www.hcaptcha.com/pro) goes beyond the free hCaptcha service
with advanced machine learning to reduce the challenge rate, delivering high security
and low friction along with more features like UI customization.
[hCaptcha Enterprise](https://www.hcaptcha.com/) delivers a complete advanced security
platform, including fraud protection and more to address both human and automated
abuse.
### Privacy Notices
hCaptcha is designed to comply with privacy laws in every country, including GDPR,
LGPD, CCPA, and more.
For example, hCaptcha has been certified under ISO 27001 and 27701 and is enrolled
in the EU-US, UK-US, and Swiss-US Data Privacy Framework for GDPR compliance.
Details are available at [www.hcaptcha.com/certifications](https://www.hcaptcha.com/certifications)
and [www.hcaptcha.com/gdpr](https://www.hcaptcha.com/gdpr).
With the default configuration, this plugin does not:
* track users by stealth;
* write any user’s personal data to the database;
* send any data to external servers;
* use cookies.
Once you activate this plugin, the hCaptcha-answering user’s IP address and browser
data may be sent to the hCaptcha service on pages where you have activated hCaptcha
protection. However, hCaptcha is designed to minimize data used, process it very
close to the user, and rapidly discard it after analysis.
For more details, please
see the hCaptcha privacy policy at:
* [hCaptcha.com](https://hCaptcha.com/privacy)
If you enable the optional plugin-local statistics feature, the following additional
data will be recorded in your database:
* counts of challenge verifications per form
* **only if you enable this optional feature:** the IP address challenged on each
form
* **only if you enable this optional feature:** the User Agent challenged on each
form
We recommend leaving IP and User Agent recording off. In that configuration, the
local event records do not contain either value.
The separate Collect Anonymously setting controls only local event storage. If IP
address or User Agent collection is enabled, this setting stores those values as
salted hashes instead of their original values.
Statistics is optional and off by default. Enabling it sends the visitor IP of the
current request (X-Forwarded-For), the full site URL with /plugin-stats appended,
and plugin configuration to hCaptcha at https://a.hcaptcha.com/api/event to help
prioritize plugin development. Configuration includes the plugin version, license
type, active integrations and their enabled forms, multisite status, and site/secret
key presence flags, without key values. Reports are sent when Statistics is turned
on and on initialization after plugin updates. The IP belongs to the request triggering
the report, which may be an administrator or cron request; if no public IP is available,
127.0.0.1 is sent as a fallback. The recipient also receives ordinary network metadata,
such as the server IP. Collect Anonymously, Collect IP, and Collect User Agent affect
only local event storage, not these reports. Custom code can force or filter sends
even with Statistics off.
The existing telemetry transport is retained for compatibility. It posts JSON with`
Content-Type: application/json`, a fixed browser-style `User-Agent` (not the visitor
browser value), and `X-Forwarded-For` containing the IP selected by the plugin from
the current request using its trusted IP header settings/filter, or the `127.0.0.1`
fallback. This fallback is not an anonymized visitor IP. The JSON fields are `d`(`
wp-plugin.hcaptcha.com`), `n` (`plugin-stats`), `u` (the full `home_url('plugin-
stats')`, including any installation path), `r` (`null`), `w` (the fixed value `
1024`), and `props` (configuration). The configuration fields are `hCaptcha`, `License`,`
Site key`, `Secret key`, `Multisite`, `Active`, and active integration names with
their enabled form identifiers. At most 30 configuration fields are sent, with `
Active` limited to 2000 characters. `Site key` and `Secret key` are presence flags(`
0` or `1`); their values are not sent. Local event records are not included in the
remote report.
For developers, ordinary calls to `hcap_send_plugin_stats` require Statistics to
be enabled. The plugin forces a send when the setting changes from off to on, before
the new value is saved; other code can also explicitly request a forced send. The`
hcap_allow_send_plugin_stats` filter can allow or block any send, including a forced
send. The Playground integration uses this filter to block telemetry. Collect Anonymously
does not change the remote report.
### Plugins, Themes, and Forms Supported
* WordPress Login, Register, Lost Password, Comment, and Post/Page Password Forms
* ACF Extended Form
* Affiliates Login and Register Forms
* Asgaros Forum New Topic and Reply Form
* Avada standard and multistep Forms
* Back In Stock Notifier Form
* bbPress New Topic, Reply, Login, Register, and Lost Password Forms
* Beaver Builder Contact and Login Forms
* Blocksy Companion Newsletter Subscribe, Waitlist, and Product Review Forms
* BuddyPress — Create Group and Registration Forms
* Classified Listing Contact, Login, Lost Password, and Listing Register Forms
* CoBlocks Form
* Colorlib Customizer Login, Lost Password, and Customizer Register Forms
* Contact Form 7
* Cookies and Content Security Policy
* Customer Reviews for WooCommerce Review and Q&A Forms
* Divi Comment, Contact, Email Optin, and Login Forms
* Divi Builder Comment, Contact, Email Optin, and Login Forms
* Download Manager Form
* Droit Dark Mode
* Easy Digital Downloads Checkout, Login, Lost Password, and Register Forms
* Elementor Pro Form and Login Form
* Essential Addons for Elementor Login and Register Forms
* Essential Blocks Form
* Events Manager Booking Form
* Extra Comment, Contact, Email Optin, and Login Forms
* Fluent Forms, including Conversational, Multi-Step, and Login Forms
* Forminator Forms
* Formidable Forms
* GiveWP Form
* Gravity Forms
* Gravity Perks Nested Forms
* Icegram Express Form
* Jetpack Forms
* Kadence Form and Advanced Form
* LearnDash Login, Lost Password, and Register Forms
* Login/Signup Popup Login and Register Forms
* Mailchimp for WP Form
* MailPoet Form
* Maintenance Login Form
* MemberPress Login and Register Forms
* MetForm
* Ninja Forms
* Otter Blocks Forms
* Passster Protection Form
* Password Protected Form
* Profile Builder Login, Recover Password, and Register Forms
* Really Simple CAPTCHA
* Quform Forms
* Sendinblue Form
* Simple Download Monitor Form
* Simple Membership Login, Lost Password, and Register Forms
* Spectra — WordPress Gutenberg Blocks Form
* Subscriber Form
* Support Candy New Ticket Form
* Theme My Login — Login, Lost Password, and Register Form
* Tutor LMS — Checkout, Login, Lost Password, and Register Form
* Ultimate Addons for Elementor Login and Register Forms
* Ultimate Member Login, Lost Password, and Member Register Forms
* UsersWP Forgot Password, Login, and Register Forms
* WooCommerce Login, Registration, Lost Password, Checkout, Order Tracking, and
Order Withdrawal Forms
* WooCommerce Germanized Return Request Form
* WooCommerce Wishlist Form
* Wordfence Security Login Form
* Wordfence Login Security Login Form
* WP Dark Mode
* WP Job Openings Form
* WPForms Form
* wpDiscuz Comment and Support Forms
* wpForo New Topic and Reply Forms
### Please note
**NOTE:** This is a community-developed plugin. Your PRs are welcome.
For feature requests and issue reports, please
[open a pull request](https://github.com/hCaptcha/hcaptcha-wordpress-plugin).
We also suggest emailing the authors of plugins you’d like to support hCaptcha:
it will usually take them only an hour or two to add native support. This will simplify
your use of hCaptcha and is the best solution in the long run.
You may use native hCaptcha support if available for your plugin. Please check with
your plugin author if native support is not yet available.
However, the hCaptcha plugin provides a broader set of options and features so that
you can use it with any form on your site.
Instructions for popular native integrations are below:
* [WPForms native integration: instructions to enable hCaptcha](https://wpforms.com/docs/how-to-set-up-and-use-hcaptcha-in-wpforms)
## Screenshots
[⌊Login page with hCaptcha widget.⌉⌊Login page with hCaptcha widget.⌉[
Login page with hCaptcha widget.
[⌊Login page with hCaptcha challenge.⌉⌊Login page with hCaptcha challenge.⌉[
Login page with hCaptcha challenge.
[⌊Protected content.⌉⌊Protected content.⌉[
Protected content.
[⌊WooCommerce Login/Register page.⌉⌊WooCommerce Login/Register page.⌉[
WooCommerce Login/Register page.
[⌊Contact Form 7 with hCaptcha.⌉⌊Contact Form 7 with hCaptcha.⌉[
Contact Form 7 with hCaptcha.
[⌊Contact Form 7 live form in the admin editor.⌉⌊Contact Form 7 live form in the
admin editor.⌉[
Contact Form 7 live form in the admin editor.
[⌊Elementor Pro Form.⌉⌊Elementor Pro Form.⌉[
Elementor Pro Form.
[⌊Elementor Pro Form in admin editor.⌉⌊Elementor Pro Form in admin editor.⌉[
Elementor Pro Form in admin editor.
[⌊General settings page.⌉⌊General settings page.⌉[
General settings page.
[⌊Anti-Spam settings page.⌉⌊Anti-Spam settings page.⌉[
Anti-Spam settings page.
[⌊Integrations' settings page.⌉⌊Integrations' settings page.⌉[
Integrations’ settings page.
[⌊Activating plugin from the Integrations' settings page.⌉⌊Activating plugin from
the Integrations' settings page.⌉[
Activating plugin from the Integrations’ settings page.
[⌊Migration Wizard scan results on the Tools settings page.⌉⌊Migration Wizard scan
results on the Tools settings page.⌉[
Migration Wizard scan results on the Tools settings page.
[⌊(Optional) Local Forms statistics.⌉⌊(Optional) Local Forms statistics.⌉[
(Optional) Local Forms statistics.
[⌊(Optional) Local Events statistics.⌉⌊(Optional) Local Events statistics.⌉[
(Optional) Local Events statistics.
## Installation
Sign up at [hCaptcha.com](https://www.hcaptcha.com/) to get your sitekey and secret,
then:
1. Install hCaptcha either via the WordPress.org plugin repository (best) or by uploading
the files to your server. ([Upload instructions](https://www.wpbeginner.com/beginners-guide/step-by-step-guide-to-install-a-wordpress-plugin-for-beginners/))
2. Activate the hCaptcha plugin on the Plugins admin page
3. Enter your site key and secret on the SettingshCaptchaGeneral page
4. Enable desired Integrations on the SettingshCaptchaIntegrations page
## FAQ
### How do I use the hCaptcha plugin?
The hCaptcha plugin supports WordPress core and many plugins with forms automatically.
You should select the supported forms on the hCaptcha Integrations settings page.
For non-standard cases, you can use the `[hcaptcha]` shortcode provided by the plugin.
For example, we support Contact Forms 7 automatically. However, sometimes a theme
can modify the form. In this case, you can manually add the `[cf7-hcaptcha]` shortcode
to the CF7 form.
To make hCaptcha work, the shortcode must be inside the
…
tag.
### How do I migrate from reCAPTCHA or Turnstile?
Go to Settings hCaptcha Tools and use the Migration Wizard.
It scans your site for existing CAPTCHA providers, shows what can be migrated, and
applies the changes in one click.
### How do I use the new AI / Abilities features?
hCaptcha exposes selected security actions via the WordPress Abilities API for use
with automation tools, WP-CLI, and AI agents, making it suitable for agencies managing
multiple WordPress sites. Requires WordPress 6.9 or newer.
The typical workflow consists of two steps: inspect threats and block offenders.
** 1. Inspect recent threat activity **
You can request an aggregated threat snapshot for a given time window.
Using WP-CLI:
```
wp ability run hcaptcha/get-threat-snapshot --input='{"window":"55d"}' --user=admin
```
Using REST API (authenticated):
```
curl --globoff -u "USER:APP_PASSWORD" \
"https://example.com/wp-json/wp-abilities/v1/abilities/hcaptcha/get-threat-snapshot/run?input[window]=55d"
```
The response includes:
* overall metrics (total requests, failure rate) * confidence
and top error vectors * breakdown by error type and form source * a list of top
offenders (if present)
Example (simplified):
```
{
"metrics": { "total": 353, "failed": 215, "fail_rate": "0.61" },
"signals": { "confidence": "high", "top_vectors": ["empty", "spam"] },
"breakdown": {
"errors": { "empty": 160, "spam": 16 },
"offenders": [
{
"offender_id": "a1376a016c4156933c4d49b0bc56fa01",
"type": "ip",
"count": 2
}
]
}
}
```
** 2. Block abusive offenders **
If an offender appears suspicious, you can block it using its offender_id.
Using WP-CLI:
```
wp ability run hcaptcha/block-offenders \
--input='{"offender_ids":["a1376a016c4156933c4d49b0bc56fa01"]}' \
--user=admin
```
Using REST API (authenticated):
```
curl --globoff -u "USER:APP_PASSWORD" \
"https://example.com/wp-json/wp-abilities/v1/abilities/hcaptcha/block-offenders/run?input[offender_ids][]=a1376a016c4156933c4d49b0bc56fa01"
```
Example response:
```
{
"blocked": ["a1376a016c4156933c4d49b0bc56fa01"],
"effective_until": "2026-01-01T22:22:09Z"
}
```
** What is offender_id? **
```
offender_id is a stable hash of the IP address.
```
Raw IP addresses are never exposed to automation clients or AI agents.
This allows privacy-safe analysis and blocking, while still enabling deterministic
enforcement.
** Can AI agents use this automatically? **
Yes.
You can point an AI agent to a WordPress site with Abilities enabled and instruct
it to: * discover available abilities * collect threat statistics * decide whether
activity looks abusive * block the most active offenders
Internally, the agent performs the same commands shown above (`wp ability list`,`
get-threat-snapshot`, `block-offenders`).
** 3. Export plugin settings **
You can export current plugin settings as JSON (optionally including keys) for backup
or migration.
Using WP-CLI:
```
wp ability run hcaptcha/export-settings --include_keys --user=admin
```
Using REST API (authenticated):
```
curl --globoff -u "USER:APP_PASSWORD" \
"https://example.com/wp-json/wp-abilities/v1/abilities/hcaptcha/export-settings/run?input[include_keys]=1"
```
** 4. Import plugin settings **
Import settings from a JSON file path on the server. Use `allow_keys` to apply the
keys block and `dry_run` to validate without saving.
Using WP-CLI:
```
wp ability run hcaptcha/import-settings --allow_keys --dry-run=false --user=igor --input_file=1.json
```
Using REST API (authenticated):
```
curl --globoff -u "USER:APP_PASSWORD" \
"https://example.com/wp-json/wp-abilities/v1/abilities/hcaptcha/import-settings/run?input[input_file]=%2Fpath%2Fto%2Fhcaptcha-settings.json&input[allow_keys]=1&input[dry_run]=0"
```
### WP-CLI commands for exporting and importing settings
The plugin also adds the `wp hcaptcha export` and `wp hcaptcha import` commands.
**Export settings**
```
`
```
wp hcaptcha export –pretty > hcaptcha-settings.json
wp hcaptcha export –include-
keys –file=./hcaptcha-settings.json `
Parameters:
* `--include-keys` — include the `site_key` and `secret_key` values.*`--
pretty` — pretty-print JSON for readability. * `--file=` — write JSON to a
file instead of STDOUT.
**Import settings**
```
`
```
wp hcaptcha import ./hcaptcha-settings.json
wp hcaptcha import ./hcaptcha-settings.
json –dry-run wp hcaptcha import ./hcaptcha-settings.json –allow-keys `
Parameters:
* `--dry-run` — validate the JSON without saving. * `--allow-keys` —
allow importing keys from the `keys` block.
### You don’t support plugin X. How can I get support for it added?
[Open a PR on GitHub](https://github.com/hCaptcha/hcaptcha-wordpress-plugin): or
just email the authors of plugin X. Adding hCaptcha support is typically quite a
quick task for most plugins.
### Does the [hcaptcha] shortcode have arguments?
Full list of arguments:
```
[hcaptcha action="my_hcap_action" name="my_hcap_name" auto="true|false" ajax="true|false" force="true|false" theme="light|dark|auto" size="normal|compact|invisible" honeypot="true|false"]
```
The shortcode adds not only the hCaptcha div to the form but also a nonce field.
You can set your own nonce action and name. For this, use arguments in the shortcode:
```
[hcaptcha action="my_hcap_action" name="my_hcap_name"]
```
and in the verification:
```
$result = \HCaptcha\Helpers\API::verify_post( 'my_hcap_name', 'my_hcap_action' );
```
For the explanation of the auto=”true|false” argument, see the section _“How to
automatically verify an arbitrary form”_. By default, `auto="false"`.
The argument force=”true|false” allows forcing verification of hCaptcha widget before
submitting the form. By default, `force="false"`.
The argument size=”normal|compact|invisible” allows setting the size of hCaptcha
widget. By default, `size="normal"`.
The argument honeypot=”true|false” allows enabling or disabling the honeypot for
the shortcode form. By default, it follows the global Honeypot setting.
### How to add hCaptcha to an arbitrary form
First, add the hCaptcha snippet to the form.
If you create the form as an HTML block in the post content, insert the shortcode`[
hcaptcha]` inside it. It may look like this:
```
```
If you create the form programmatically, insert the following statement inside it:
```
?>
Additional Options or ‘login’
Events Manager
$source: ‘events-manager/events-manager.php’ $form_id: event_id
Icegram Express
$source: ’email-subscribers/email-subscribers.php’ $form_id: form_id
Customer Reviews for WooCommerce
$source: ‘customer-reviews-woocommerce/ivole.php’
$form_id: review or q&a
Jetpack
$source: ‘jetpack/jetpack.php’ $form_id: ‘contact_$form_hash’
Kadence Form
$source: ‘kadence-blocks/kadence-blocks.php’ $form_id: post_id
Kadence Advanced Form
$source: ‘kadence-blocks/kadence-blocks.php’ $form_id: form_id
LearnDash
$source: ‘sfwd-lms/sfwd_lms.php’ $form_id: ‘login’, ‘lost_password’ or‘
register’
LearnPress
$source: ‘learnpress/learnpress.php’ $form_id: ‘checkout’, ”login’,
or ‘register’
Login/Signup Popup
$source: ‘easy-login-woocommerce/xoo-el-main.php’ $form_id: ‘
login’, or ‘register’
MemberPress
$source: ‘memberpress/memberpress.php’ $form_id: ‘login’ or ‘register’
Passster
$source: ‘content-protector/content-protector.php’ $form_id: area_id
Password Protected
$source: ‘password-protected/password-protected.php’ $form_id:‘
protect’
Profile Builder
$source: ‘profile-builder/index.php’ $form_id: ‘login’, ‘lost_password’
or ‘register’
Simple Membership
$source: ‘simple-membership/simple-wp-membership.php’ $form_id:‘
login’, ‘lost_password’ or ‘register’
Subscriber
$source: ‘subscriber/subscriber.php’ $form_id: ‘form’
Support Candy
$source: ‘supportcandy/supportcandy.php’ $form_id: ‘form’
Theme My Login
$source: ‘theme-my-login/theme-my-login.php’ $form_id: ‘login’, ‘
lost_password’ or ‘register’
Tutor LMS
$source: ‘tutor/tutor.php’ $form_id: ‘checkout’, ”login’, ‘lost_password’
or ‘register’
Ultimate Addons
$source: ‘ultimate-elementor/ultimate-elementor.php’ $form_id: ‘
login’ or ‘register’
Ultimate Member
$source: ‘ultimate-member/ultimate-member.php’ $form_id: form_id
or ‘password’
UsersWP
$source: ‘userswp/userswp.php’ $form_id: ‘forgot’, ‘login’ or ‘register’
WooCommerce Germanized
$source: ‘woocommerce-germanized/woocommerce-germanized.
php’ $form_id: ‘return_request’
WooCommerce Wishlist
$source: ‘woocommerce-wishlists/woocommerce-wishlists.php’
$form_id: ‘form’
wpDiscuz
$source: ‘wpdiscuz/class.WpdiscuzCore.php’ $form_id: post_id
WPForms
$source: ‘wpforms-lite/wpforms.php’ or ‘wpforms/wpforms.php’ $form_id:
form_id
wpForo
$source: ‘wpforo/wpforo.php’ $form_id: ‘new_topic’ for a new topic form
and topicid for a reply form. Topicid can be found in HTML code searching for ‘data-
topicid’ in Elements.
Wordfence Login Security
$source: ‘wordfence-login-security/wordfence-login-security.
php’ $form_id: ‘login’
Wordfence Security
$source: ‘wordfence/wordfence.php’ $form_id: ‘login’
WordPress Core
$source: ‘WordPress’ $form_id: post_id for comment form, ‘login’,‘
lost_password’, ‘password_protected’, or ‘register’
WooCommerce
$source: ‘woocommerce/woocommerce.php’ $form_id: ‘checkout’, ‘login’,‘
lost_password’, ‘order_tracking’, or ‘register’
Below is an example of how to skip the hCaptcha widget on a Gravity Form with id
= 1.
```
/**
* Filters the protection status of a form.
*
* @param string|mixed $value The protection status of a form.
* @param string[] $source Plugin(s) serving the form.
* @param int|string $form_id Form id.
*
* @return bool
*/
function hcap_protect_form_filter( $value, $source, $form_id ): bool {
$value = (bool) $value;
if ( ! in_array( 'gravityforms/gravityforms.php', $source, true ) ) {
// The form is not sourced by Gravity Forms plugin.
return $value;
}
if ( 1 !== (int) $form_id ) {
// The form has id !== 1.
return $value;
}
// Turn off protection for a Gravity form with id = 1.
return false;
}
add_filter( 'hcap_protect_form', 'hcap_protect_form_filter', 10, 3 );
```
### How can I show the hCaptcha widget instantly?
The plugin loads the hCaptcha script with a delay until user interaction: mouseenter,
click, scroll, or touch. This significantly improves Google Pagespeed Insights score.
To load the hCaptcha widget instantly, you can use the following filter:
```
/**
* Filters delay time for hCaptcha API script.
*
* Any negative value will prevent the API script from loading at all,
* until user interaction: mouseenter, click, scroll, or touch.
* This significantly improves Google Pagespeed Insights score.
*
* @param int|mixed $delay Number of milliseconds to delay hCaptcha API script.
* Any negative value means delay until user interaction.
*/
function my_hcap_delay_api( $delay ): int {
return 0;
}
add_filter( 'hcap_delay_api', 'my_hcap_delay_api' );
```
### How can I load the hCaptcha API script only when a specific element is visible?
To load the hCaptcha API script only when a WordPress comment form is visible, you
can use the followign filter:
```
/**
* Filters delay API selector.
*
* When set, the hcaptcha.js script will be loaded only when the specified element is visible.
* This can improve page load performance by deferring the API script until it's necessary.
*
* @param string|mixed $delay_api_selector CSS selector of the element to observe.
*/
add_filter( 'hcap_delay_api_selector', static function ( $delay_api_selector ) {
$delay_api_selector = (string) $delay_api_selector;
if ( is_admin() || is_login() ) {
return $delay_api_selector;
}
$selectors = [
'.comment-form', // WP comment form.
'.elementor-form', // Elementor Pro.
'.wpcf7-form', // Contact Form 7.
'.fluentform, .frm-fluent-form', // Fluent Forms.
'.nf-form-cont', // Ninja Forms.
'.es_subscription_form, .es-form-field-container, .ig_popup', // Icegram Express Forms.
'.cr-reviews-ajax-reviews, .cr-qna-block', // Customer Reviews.
];
return implode( ', ', $selectors );
} );
```
### How can I delay the hCaptcha API script until a custom event?
Developers can use the `hcap_delay_api_event` filter to opt into event-based API
loading.
Return `true` to use the built-in trigger. It loads the API after pointer or keyboard
interaction with a protected HTML form. Tab navigation into the form is supported,
while programmatic focus is ignored. This works with WordPress core login, lost
password, and registration forms, Jetpack forms, and other integrations that render
hCaptcha inside a form.
```
add_filter( 'hcap_delay_api_event', '__return_true' );
```
Non-empty strings remain custom event names. In that mode, hCaptcha waits for `hCaptchaBeforeAPI`,
then listens for the returned event on `document`. The integration is responsible
for dispatching the event:
```
add_filter(
'hcap_delay_api_event',
static function (): string {
return 'my-consent-event';
}
);
// Later:
// document.dispatchEvent( new CustomEvent( 'my-consent-event' ) );
```
### How to set hCaptcha language programmatically?
hCaptcha defaults to using the user’s language as reported by the browser. However,
on multilingual sites you can override this to set the hCaptcha language to match
the current page language. For this, you can use the following filter:
```
/**
* Filters hCaptcha language.
*
* @param string|mixed $language Language.
*/
function my_hcap_language( $language ): string {
$language = (string) $language;
// Detect page language and return it.
$page_language = 'some lang'; // Detection depends on the multilingual plugin used.
return $page_language;
}
add_filter( 'hcap_language', 'my_hcap_language' );
```
### How can I customize hCaptcha parameters for an individual widget?
Use the `hcap_widget_params` filter. It supports `sitekey`, `theme`, `size`, `hl`,`
tabindex`, `callback`, `expired-callback`, `chalexpired-callback`, `open-callback`,`
close-callback`, `error-callback`, and Enterprise `orientation`. The success callback
runs after the plugin’s internal callback so it does not replace form handling.
```
/**
* Filters hCaptcha render parameters for an individual widget.
*
* @param array $params hCaptcha render parameters.
* @param array $args Validated hCaptcha form arguments, including the form id.
*/
add_filter(
'hcap_widget_params',
static function ( array $params, array $args ): array {
$params['tabindex'] = 0;
$params['expired-callback'] = 'myHCaptchaExpired';
// Enterprise only.
$params['orientation'] = 'landscape';
return $params;
},
10,
2
);
```
### How can I display the disclosure for invisible hCaptcha?
The disclosure is disabled by default. Enable it with the `hcap_print_invisible_disclosure`
filter. The standard disclosure is printed next to each widget whose effective size
is `invisible`; visible widgets are not affected.
```
add_filter( 'hcap_print_invisible_disclosure', '__return_true' );
```
### How to denylist certain IPs
You can use the following filter. It should be added to your plugin’s (or mu-plugin’s)
main file. This filter won’t work being added to a theme’s functions.php file.
```
/**
* Filter the user IP to check if it is denylisted.
* For denylisted IPs, any form submission fails.
*
* @param bool|mixed $denylisted Whether IP is denylisted.
* @param string $ip IP.
*
* @return bool
*/
function my_hcap_denylist_ip( $denylisted, $ip ): bool {
$denylisted = (bool) $denylisted;
// Denylist some IPs.
if ( '8.8.8.8' === $ip ) {
return true;
}
return $denylisted;
}
add_filter( 'hcap_blacklist_ip', 'my_hcap_denylist_ip', 10, 2 );
```
### How does hCaptcha determine the visitor IP address?
hCaptcha uses `REMOTE_ADDR` by default. If your site is behind a trusted proxy or
CDN, go to Settings hCaptcha Anti-Spam Access Control and select only the IP
headers your edge service overwrites or strips from direct client requests.
Forwarding headers such as `X-Forwarded-For`, `CF-Connecting-IP`, and `X-Real-IP`
can be spoofed when they pass through from the browser unchanged. Do not enable
a header unless your hosting stack makes it trustworthy before WordPress receives
the request.
On upgrade, custom `hcap_trusted_address_headers` filters are migrated into this
setting. Otherwise the setting starts empty and an admin notice asks you to review
it.
### How to allowlist certain IPs
You can use the following filter. It should be added to your plugin’s (or mu-plugin’s)
main file. This filter won’t work being added to a theme’s functions.php file.
```
/**
* Filter user IP to check if it is allowlisted.
* For allowlisted IPs, hCaptcha will not be shown.
*
* @param bool|mixed $allowlisted Whether IP is allowlisted.
* @param string $ip IP.
*
* @return bool
*/
function my_hcap_allowlist_ip( $allowlisted, $ip ): bool {
$allowlisted = (bool) $allowlisted;
// Allowlist local IPs.
if ( false === $ip ) {
return true;
}
// Allowlist some other IPs.
if ( '1.1.1.1' === $ip ) {
return true;
}
return $allowlisted;
}
add_filter( 'hcap_whitelist_ip', 'my_hcap_allowlist_ip', 10, 2 );
```
### How do I change the appearance of the admin menu?
Starting from 4.1.0, the admin menu was moved to the top level with subpages.
You can customize this by returning it to the previous location in the admin Settings
section or tweaking its appearance.
To do this, use the following filter to your plugin’s (or mu-plugin’s) main file.
This code won’t work being added to a theme’s functions.php file.
```
/**
* Filter the settings system initialization arguments.
*
* @param array|mixed $args Settings system initialization arguments.
*/
function hcap_settings_init_args_filter( $args ): array {
$args = (array) $args;
$args['mode'] = 'tabs';
return $args;
}
add_filter( 'hcap_settings_init_args', 'hcap_settings_init_args_filter' );
$args array has the following fields:
mode: 'pages' or 'tabs' (default 'pages') — the appearance of the admin menu;
parent: a string — the parent menu item. Default '' for 'pages' mode and 'options-general.php' for 'tabs' mode;
position: a number — the position of the menu item. Default 58.990225 for 'pages' mode. It Has no effect on 'tabs' mode;
```
### Where do I report security bugs found in this plugin?
Please report security vulnerabilities by email to:
**security@hcaptcha.com**
When reporting a vulnerability, please include as much information as possible to
help us reproduce and investigate the issue, such as:
* A clear description of the vulnerability
* Steps to reproduce
* Proof-of-concept or exploit code (if available)
* Affected versions
We will review your report and respond as quickly as possible.
### Where can I get more information about hCaptcha?
Please see our [website](https://hcaptcha.com/).
### How can I rerun the setup wizard?
Use the plugin-generated “Restart wizard” onboarding link from the admin area. Onboarding
setup URLs are nonce-protected and should not be crafted manually.
## समीक्षा
### [EXCELLENT plugin](https://wordpress.org/support/topic/excellent-plugin-9982/)
[eeas38](https://profiles.wordpress.org/eeas38/) अक्टूबर 6, 2026 1 reply
I really appreciate this plugin. Simple but Powerfull and it's compatible with the
major themes like Divi and Elementor
### [Top & easy!](https://wordpress.org/support/topic/top-easy-2/)
[salilou](https://profiles.wordpress.org/hkr/) जुलाई 21, 2026 1 reply
It's a top plugin, easy to use! Thank you!
### [very good](https://wordpress.org/support/topic/very-good-7783/)
[ho3sain2434](https://profiles.wordpress.org/ho3sain2434/) मई 31, 2026 1 reply
it.s very good pluging for site thanks for us to creat this pligin
### [Great protection against spam](https://wordpress.org/support/topic/great-protection-against-spam/)
[JesusDR](https://profiles.wordpress.org/jesusdr/) मार्च 30, 2026 1 reply
Great protection against spam
### [It is a lot easier to set up than reCaptcha](https://wordpress.org/support/topic/it-is-a-lot-easier-to-set-up-than-recaptcha/)
[IanErickson](https://profiles.wordpress.org/ianerickson/) मार्च 7, 2026 1 reply
Working good so far.
### [hCaptcha is hands-down the best CAPTCHA solution out there in 2026!](https://wordpress.org/support/topic/hcaptcha-is-hands-down-the-best-captcha-solution-out-there-in-2026/)
[continuoussafety2018](https://profiles.wordpress.org/continuoussafety2018/) मार्च
3, 2026 1 reply
Switched from reCAPTCHA and never looking back. Excellent bot protection, actually
respects user privacy (no creepy Google tracking), GDPR/CCPA friendly out of the
box, and the challenges are clear & fair. The free tier is generous and it even
pays site owners — win-win. Zero frustration for real users, killer spam reduction.
5 stars all the way!
[ Read all 87 reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/)
## Contributors & Developers
“hCaptcha for WP” is open source software. The following people have contributed
to this plugin.
Contributors
* [ hcaptcha ](https://profiles.wordpress.org/hcaptcha/)
* [ kaggdesign ](https://profiles.wordpress.org/kaggdesign/)
“hCaptcha for WP” has been translated into 11 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/hcaptcha-for-forms-and-more/contributors)
for their contributions.
[Translate “hCaptcha for WP” into your language.](https://translate.wordpress.org/projects/wp-plugins/hcaptcha-for-forms-and-more)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/hcaptcha-for-forms-and-more/),
check out the [SVN repository](https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hcaptcha-for-forms-and-more/)
by [RSS](https://plugins.trac.wordpress.org/log/hcaptcha-for-forms-and-more/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 5.4.1
* Fixed WordPress login authentication when login integrations have different protection
settings.
* Improved Auto-Verification compatibility with forms on query-based page URLs
and Brevo forms, while simplifying form registration storage.
#### 5.4.0
* Added optional AJAX submission for standard WordPress comment forms, with inline
error messages.
* Added form data processing for anti-spam checks in 10 popular integrations: WordPress
Core, WooCommerce, Divi, Ultimate Addons for Elementor, Essential Addons, Mailchimp,
Maintenance, Ultimate Member, bbPress, and GiveWP.
* Added filtering of form fields identified as passwords, verification tokens,
or payment details before anti-spam processing.
* Improved an anti-spam entry collection to retain additional non-sensitive fields
and avoid overwriting fields with duplicate labels.
* Added Tutor LMS Pro integration.
* Added Tutor LMS form data processing for anti-spam checks on login, registration,
password recovery, and checkout.
* Added Tutor LMS login, registration, password recovery, and checkout forms to
the optional form-interaction API loading.
* Added hCaptcha protection to the WooCommerce Order Withdrawal Form.
* Added Essential Blocks form migration from Google reCAPTCHA to the Migration
Wizard.
* Added Tutor LMS Pro reCAPTCHA migration for Tutor LMS and WordPress login and
registration forms.
* Added an optional invisible hCaptcha disclosure controlled by the `hcap_print_invisible_disclosure`
filter.
* Added Montenegrin and Brazilian Portuguese hCaptcha widget locales.
* Added support for documented per-widget hCaptcha render parameters through the`
hcap_widget_params` filter.
* Updated the Custom Themes editor and default theme to match the latest documented
hCaptcha theme schema.
* Improved plugin and theme dependency management on the Integrations page with
activation notices and safe, selectable dependency deactivation.
* Improved compatibility with Plugin Check (PCP).
* Improved server-side verification.
* Removed Paid Memberships Pro and Simple Basic Contact Form integrations after
their WordPress.org closures.
* Fixed Auto-Verification bypass after its transient expires or evicts a protected
form and prevented other pages from removing its registration.
* Fixed automatically added CSP sources, allowing unsafe JavaScript sources only
for Enterprise accounts.
* Fixed the Form Submit Time token lifecycle across page reloads and failed submissions
to prevent stale tokens from exhausting issuance limits.
* Fixed license detection when switching between Live and test modes.
* Fixed saving credentials after an automatic site configuration check.
* Fixed the Secret Key field appearing empty when a key is configured.
* Fixed LearnPress checkout verification fatal error and prevented account creation
before hCaptcha validation.
* Fixed Google reCAPTCHA appearing in the Beaver Builder editor when its reCAPTCHA
field is disabled.
* Fixed reusing an expired token after a failed AJAX submission for several integrations.
#### 5.3.0
* Added the Advanced Theme Editor with a live widget and challenge previews and
direct JSON editing.
* Added an Anti-Spam option to disable authenticated XML-RPC requests.
* Added a honeypot argument to the hCaptcha shortcode.
* Expanded delayed hCaptcha API loading on form interaction to 34 third-party integrations
and WordPress Core, covering 65 protected form scenarios.
* Fixed “Bad hCaptcha signature” errors on WordPress and bbPress login, registration,
and lost password forms.
* Fixed duplicate hCaptcha widgets on Profile Builder login forms that could block
valid sign-ins.
* Fixed LearnDash registrations being blocked by “Bad hCaptcha signature” errors
when WordPress registration protection is also enabled.
* Fixed a fatal error that prevented Affiliates registration forms from loading
before their first submission.
* Fixed hCaptcha reinitialization after Login/Signup Popup AJAX submissions using
FormData.
* Fixed misplaced hCaptcha widgets and unreadable error messages on two-column
BuddyPress registration forms.
* Fixed Elementor Pro form submit buttons remaining disabled after client-side
validation failures.
* Fixed delayed hCaptcha loading after interaction with Beaver Builder login forms.
* Fixed GiveWP compatibility.
* Fixed Paid Membership Pro compatibility.
* Fixed Gravity Forms block submissions to prevent the “Unsupported submission
flow” warning.
#### 5.2.0
* Added MetForm integration.
* Added MetForm migration to the Migration Wizard.
* Added an option to delay the hCaptcha API until the user interacts with a protected
form.
* Added hCaptcha settings shortcuts to the WordPress Command Palette for quick
navigation to plugin options.
* Added validation of hCaptcha keys before making requests to fix the missing keys’
scenario.
* Added support for custom login URLs in Perfmatters 2.5.8 and later.
* Fixed unbounded growth of the auto-verification form registry transient by limiting
its size with LRU eviction.
* Fixed hCaptcha placement above express payment buttons on WooCommerce cart pages.
* Fixed hCaptcha signature verification for nested Kadence Advanced Forms and pages
with multiple Advanced Forms.
* Fixed hCaptcha signature verification for Divi Comment Forms when the WordPress
Comment Form integration is disabled.
* Fixed fatal errors on Gravity Forms submissions containing Multi Select fields.
* Fixed compatibility with Maintenance 4.32.
#### 5.1.0
* Added version switching to the What’s New popup.
* Added a Help button on hCaptcha admin pages to generate support reports for GitHub
or WordPress.org, with optional System Info included.
* Added hcap_delay_api_event filter for delayed loading of the hCaptcha API upon
user interaction.
* Hardened form verification for 22 integrations.
* Fixed hcap_delay_api_selector filter for delayed loading of hCaptcha in the Jetpack
contact forms.
* Fixed hCaptcha auto-insertion for Jetpack block contact forms that render the
Submit button with core Button block markup.
* Fixed hCaptcha auto-insertion for WooCommerce Checkout blocks when the Return
to Cart link is enabled.
* Fixed manually added hCaptcha shortcodes inside Jetpack contact forms to use
the proper form signature.
* Fixed Events statistics table indexes for MariaDB/MyISAM databases with a 1000-
byte key length limit.
* Fixed System Info migration entries to show that older migrations were not required
instead of displaying the Unix epoch date.
* Fixed hCaptcha token refresh for Blocksy newsletter and waitlist forms after
failed submissions.
* Fixed ACF Extended Forms integration to prevent reCAPTCHA from loading when hCaptcha
is used to avoid submission errors.
* Fixed hCaptcha verification for upgraded GiveWP donation forms.
* Fixed FST token replay errors after submitting GiveWP forms without completing
hCaptcha.
#### 5.0.1
* Fixed Elementor Pro Forms validation when the optional Form ID is empty or differs
from the Elementor widget ID.
* Fixed Events statistics table handling to avoid runtime table-existence checks
and recreate the table during activation or maintenance when needed.
#### 5.0.0
* Added Trusted IP Headers settings. hCaptcha uses REMOTE_ADDR by default; custom`
hcap_trusted_address_headers` filters are migrated into the setting during upgrade.
* Added Cloudflare detection to help identify when CF-Connecting-IP should be selected
as a Trusted IP Header.
* Added Trash support for Forms and Events statistics, including restore/permanent
delete actions, 30-day Trash cleanup, and migration for existing event tables.
* Added WooCommerce PayPal Payments integration for product, cart, mini-cart, and
checkout express flows.
* Added site icon on protected content pages.
* Hardened form verification for some popular forms.
* Fixed returning unexpected results by REST API in some cases.
* Fixed Avada Forms integration so internal hCaptcha fields are excluded from `[
all_fields]` notification emails.
* Fixed sending statistics at the plugin update in some rare cases when the switch
is off.
* Fixed an issue in some custom Gravity Forms layouts.
* Fixed an issue where a What’s New modal action could scroll the current Integrations
page before opening the target integration in a new tab.
* Fixed errors when resubmitting Essential Addons login and registration forms.
[See changelog for all versions](https://plugins.svn.wordpress.org/hcaptcha-for-forms-and-more/trunk/changelog.txt).
## मेटा
* Version **5.4.1**
* Last updated **1 week पहिले**
* Active installations **70,000+**
* WordPress version ** 6.0 चाहे एकरो से ऊपर **
* Tested up to **7.1.3**
* PHP version ** 7.4 चाहे एकरो से ऊपर **
* Languages
* [Chinese (Taiwan)](https://tw.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Dutch](https://nl.wordpress.org/plugins/hcaptcha-for-forms-and-more/), [English (US)](https://wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[French (France)](https://fr.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Greek](https://el.wordpress.org/plugins/hcaptcha-for-forms-and-more/), [Persian](https://fa.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Romanian](https://ro.wordpress.org/plugins/hcaptcha-for-forms-and-more/), [Russian](https://ru.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Spanish (Chile)](https://cl.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Spanish (Spain)](https://es.wordpress.org/plugins/hcaptcha-for-forms-and-more/),
[Swedish](https://sv.wordpress.org/plugins/hcaptcha-for-forms-and-more/), and
[Welsh](https://cy.wordpress.org/plugins/hcaptcha-for-forms-and-more/).
* [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/hcaptcha-for-forms-and-more)
* Tags
* [antispam](https://bho.wordpress.org/plugins/tags/antispam/)[captcha](https://bho.wordpress.org/plugins/tags/captcha/)
[hcaptcha](https://bho.wordpress.org/plugins/tags/hcaptcha/)[recaptcha](https://bho.wordpress.org/plugins/tags/recaptcha/)
[spam](https://bho.wordpress.org/plugins/tags/spam/)
* [Advanced View](https://bho.wordpress.org/plugins/hcaptcha-for-forms-and-more/advanced/)
## रेटिंग्स
4.6 out of 5 stars.
* [ 74 5-star reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/?filter=5)
* [ 3 4-star reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/?filter=4)
* [ 2 3-star reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/?filter=3)
* [ 2 2-star reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/?filter=2)
* [ 6 1-star reviews ](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/?filter=1)
[Your review](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/reviews/)
## Contributors
* [ hcaptcha ](https://profiles.wordpress.org/hcaptcha/)
* [ kaggdesign ](https://profiles.wordpress.org/kaggdesign/)
## मदद
Issues resolved in last two months:
8 out of 8
[View support forum](https://wordpress.org/support/plugin/hcaptcha-for-forms-and-more/)