Protects WooCommerce (login, registration, lost password, checkout), Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Forminator, Gravity Forms and Elementor Forms - cookieless, EU-hosted, no cookie banner required.<\/p>\n\n
A privacy-first alternative to reCAPTCHA: captchaapi.eu stops form spam without making your visitors click traffic lights. A free tier with commercial use allowed gets you started. The work happens in the background: the visitor's browser solves a small proof-of-work puzzle while they fill in the form, and a token rides along with the submission. There is nothing to solve and nothing to see.<\/p>\n\n
When a form is submitted, your server confirms that token with captchaapi.eu over a single request, secured by your secret key. It is the same model every hosted CAPTCHA uses, and it keeps the secret on your server, never in the browser.<\/p>\n\n
WordPress core:<\/p>\n\n
WooCommerce:<\/p>\n\n
Form plugins:<\/p>\n\n
Each form can be turned on or off from the settings screen. The WooCommerce and form-plugin options appear only when that plugin is active.<\/p>\n\n
Each token verifies exactly once - the service enforces single use - so the plugin keeps no local replay table and nothing to clean up on a schedule.<\/p>\n\n
This plugin connects to the captchaapi.eu service. Create a project at https:\/\/captchaapi.eu to get a site key and a secret key. A free tier is available.<\/p>\n\n
This plugin connects to captchaapi.eu, a third-party CAPTCHA service, to protect your forms from spam. It is required for the plugin to function.<\/p>\n\n
On any public page that contains a protected form, the plugin loads the service's widget script (captcha.js) from your configured captchaapi.eu endpoint. The visitor's browser then communicates with the captchaapi.eu API to perform a proof-of-work challenge and obtain a token that is attached to the form on submit. This happens for every visitor who loads a protected form.<\/p>\n\n
To issue and validate a token the service receives your public site key, the proof-of-work result, and - as with any HTTP request - the visitor's IP address. The IP address is used for rate limiting and abuse\/bot detection (including a coarse, IP-derived country) and is processed transiently: a hashed form and aggregate counters are held briefly in a cache. No raw IP address and no per-visitor record are written to a database. The service sets no cookies. Data is processed on servers in the EU (Nuremberg, Germany).<\/p>\n\n
When a protected form is submitted, your server sends the token to the captchaapi.eu \/verify endpoint, authenticated with your secret key, and trusts the service's accept-or-reject answer. The secret key stays on your server and is never sent to the browser.<\/p>\n\n
wp-content\/plugins\/captchaapi<\/code>, or install it from the Plugins screen.<\/li>\n- Activate it.<\/li>\n
- Open Settings -> captchaapi.eu.<\/li>\n
- Enter your site key and secret key from your project dashboard.<\/li>\n
- Choose which forms to protect and save.<\/li>\n<\/ol>\n\n
For a stricter setup, keep the secret key out of the database by defining it in wp-config.php<\/code>:<\/p>\n\ndefine( 'CAPTCHAAPI_SECRET_KEYS', 'your_secret_key' );\n<\/code><\/pre>\n\nDuring a key rotation, list the current and the new key together, separated by a comma:<\/p>\n\n
define( 'CAPTCHAAPI_SECRET_KEYS', 'current_key,new_key' );\n<\/code><\/pre>\n\n\n\nDo my visitors have to solve anything?<\/h3><\/dt>\nNo. There is no image challenge and no checkbox. The proof-of-work runs in the browser while the form is being filled in.<\/p><\/dd>\n
Does form submission slow down?<\/h3><\/dt>\nVerification is a single server-to-server request on submit, with a short timeout. The browser does its proof-of-work in the background before the submit, usually in well under a second.<\/p><\/dd>\n
What happens if captchaapi.eu is unreachable?<\/h3><\/dt>\nBy default the plugin fails closed: a missing or unverified token is rejected rather than waved through. If you would rather keep forms working during an outage, turn on the optional failsafe mode: when the verify request cannot reach captchaapi.eu, it lets submissions through and automatically resumes strict protection once the service is back.<\/p><\/dd>\n
Does it work with Contact Form 7?<\/h3><\/dt>\nYes. Enable Contact Form 7 in the settings. The plugin acquires a token before Contact Form 7 sends the form and verifies it on the server.<\/p><\/dd>\n
Which form plugins are supported?<\/h3><\/dt>\nWooCommerce, WPForms, Fluent Forms, Formidable Forms, Forminator, Gravity Forms, and Elementor Forms, in addition to Contact Form 7. Enable each from the settings screen; the option appears only when that plugin is active. The plugin attaches a token before the form is sent and verifies it on the server.<\/p><\/dd>\n