VAPTCHA Human Verification

Description

VAPTCHA Human Verification is a completely free WordPress human verification plugin. It helps protect standard WordPress forms from automated abuse while keeping the original page layout unchanged.

The plugin protects:

• WordPress login
• User registration
• Password reset
• Comments

Verification opens only when a visitor submits an enabled form. The plugin does not add a visible verification button or modify the native WordPress form styling.

Free to use

• The VAPTCHA Human Verification plugin is completely free to download and use.
• The ready-to-use shared verification unit works immediately after activation at no additional cost.
• No VAPTCHA account is required for the shared unit.
• Site owners can optionally connect their own verification unit for independent statistics and management.

Security by design

The plugin follows WordPress security practices and is designed to keep verification credentials and form data protected:

• VKEY is used only by server-side PHP and is never sent to the browser, HTML, JavaScript, REST responses, or browser developer tools.
• Protected forms use WordPress nonces, input sanitization, and escaped output.
• Missing, expired, invalid, or forged verification data is rejected.
• Verification and network failures fail closed instead of accepting the protected action.
• The plugin does not modify WordPress login or comment styles and does not add a public credit link.

The plugin includes a ready-to-use shared verification unit, so protection works immediately after activation. For independent verification statistics and unit management, create a verification unit at https://www.vaptcha.com/ and enter its VID and VKEY on the settings page.

External services

This plugin connects to the VAPTCHA human verification service to protect the WordPress forms selected by the site administrator.

• When a protected form is displayed, the browser loads the VAPTCHA SDK from https://c4.vaptcha.com/src/v4.js.
• When a visitor submits a protected form and verification starts, the SDK connects to VAPTCHA service endpoints to provide human verification. VAPTCHA processes the visitor’s IP address, browser and device signals (including the user agent), verification-session identifiers, verification results, and the interaction data produced within the verification interface, such as operation timing and trajectory characteristics.
• The SDK may use cookies or browser local storage for limited verification-session or device-recognition identifiers. They are used only to help complete verification, reduce repeated verification, prevent abuse, and protect service security; they are not used for advertising or unrelated tracking.
• Before WordPress accepts a protected action, the WordPress server sends the VID, VKEY, verification token, verification-session identifier, and visitor IP address to https://v41.vaptcha.com/api/verify for server-side verification. The plugin does not send WordPress usernames, passwords, comment text, or other form contents to VAPTCHA.

The VAPTCHA service is provided by VAPTCHA:

• User Service Agreement
• Privacy Statement

By installing and activating the plugin, the site administrator enables this external service for the selected forms and is responsible for providing any notice required for the site’s visitors.

Privacy

Protected forms use the external VAPTCHA service. See the VAPTCHA Privacy Statement for the information processed for verification, including the limited use of cookies and browser local storage. No VAPTCHA-powered public credit link is added by this plugin. Site administrators should disclose this processing in their own privacy notice where required.