Title: CaptchaCore Author: speeditsolutions Published: September 17, 2026 Last modified: September 17, 2026 --- Search plugins ![](https://ps.w.org/captchacore/assets/banner-772x250.png?rev=3699930) ![](https://ps.w.org/captchacore/assets/icon-256x256.png?rev=3699930) # CaptchaCore By [speeditsolutions](https://profiles.wordpress.org/speeditsolutions/) [Download](https://downloads.wordpress.org/plugin/captchacore.2.6.0.zip) * [Details](https://wordpress.org/plugins/captchacore/#description) * [Reviews](https://wordpress.org/plugins/captchacore/#reviews) * [Installation](https://wordpress.org/plugins/captchacore/#installation) * [Development](https://wordpress.org/plugins/captchacore/#developers) [Support](https://wordpress.org/support/plugin/captchacore/) ## Description CaptchaCore protects WordPress forms against bots and spam without showing image puzzles and without tracking your visitors. Instead of asking people to identify traffic lights, the browser solves a small cryptographic computation in the background while the plugin observes whether the interaction looks human. A single visitor never notices it. A bot farm sending millions of requests pays for every single one. * Proof of work (SHA-256) in a web worker, so the interface never blocks * Behavioural and environment signals: mouse movement, typing rhythm, scrolling, canvas timing, WebGL renderer * No cookies and no image puzzles in normal operation * Processing on our own servers in Germany, no transfer to the United States * Widget of 16 KB gzip with no external dependencies * Keyboard operable and marked up for screen readers #### Integrations WordPress core: * Login form (also custom login forms rendered by wp_login_form) * Registration * Lost password * Comments and WooCommerce product reviews WooCommerce (each one switchable): * Login and registration on the My Account page * Lost password on the My Account page * Checkout, on the classic checkout page ([woocommerce_checkout] shortcode). The block-based checkout is not supported yet; the settings page tells you if your shop uses it. Form builders and page builders: * Formidable Forms — a native field type you drag into any form * Elementor — a CaptchaCore widget for the page builder and a field for Elementor Pro forms Beyond WordPress, the same service has packages for Laravel and Symfony, a plugin for WoltLab Suite and a REST API for everything else: https://captchacore.eu/docs/ integrationen The plugin ships with English source strings and is ready for translation on translate. wordpress.org. CaptchaCore is a hosted service. The plugin does nothing until you enter your own credentials, which you can create free of charge for private websites. ### External services This plugin connects your site to **CaptchaCore**, a service operated by SpeedIT Solutions UG (haftungsbeschränkt), Isernhagen, Germany. Without that service the plugin cannot verify anything. It stays inactive until you enter your own credentials in the settings. **1. Form verification — https://api.captchacore.eu** When: every time one of the forms you protect is submitted (login, registration, comment, lost password, WooCommerce account forms and checkout, Formidable, Elementor). What is sent: the token created by the widget, the type of the form, the IP address of the visitor and the page URL without its query string. Why: to decide whether the request comes from a human or from a bot. The service stores IP addresses in truncated form. You set the retention period in your CaptchaCore account; the default is 30 days. **2. Delivery of the widget script — https://src-eu.captchacore.eu (default) or https://src.captchacore.eu (optional, worldwide)** When: on every page that contains a protected form. What is sent: the usual connection data of a file request, meaning the IP address and the browser identification. Why: to deliver the JavaScript file of the widget. The default endpoint uses European servers only. Enable the worldwide endpoint only if you need it. **3. Availability check** When: only inside the WordPress admin area, when you open the settings page — the plugin asks the CaptchaCore service whether your credentials work. What is sent: your secret key for authentication. No visitor data. Current availability of the service and past incidents: https://captchacore.eu/status Nothing else is transmitted. The plugin sets no cookies, sends no usage statistics and reports no data about your website to us. Terms of use: https://captchacore.eu/seite/nutzungsbedingungen Privacy policy: https://captchacore.eu/seite/datenschutz Data processing agreement under Art. 28 GDPR: https://captchacore.eu/seite/dsgvo ## Screenshots [[ [[ [[ ## Installation 1. Upload the plugin under Plugins > Add New 2. Activate the plugin 3. Open Settings > CaptchaCore 4. Enter the service URL, the site key and the secret key You can create an account and a key pair at https://captchacore.eu — free of charge for private websites. ## FAQ ### Do I need an entry in my cookie banner? No. Neither the plugin nor the widget sets a cookie. Only the under-attack mode of the service sets a short-lived technical session cookie, which is strictly necessary for operation. CaptchaCore still belongs in your privacy policy; a ready-made passage is available at https://captchacore.eu/seite/datenschutz ### What happens if the service cannot be reached? You decide. The default is fail-open: forms are let through and the incident is logged. If you prefer to block instead, switch fail-open off in the settings. Whether the service is currently affected by an incident is shown on the public status page: https://captchacore.eu/status ### Does the plugin work behind Cloudflare or a reverse proxy? Yes. Enable the option “Behind reverse proxy / CDN” in the settings. Without that option the plugin deliberately uses only the direct connection IP, because proxy headers could otherwise be forged by any visitor. ### Does it work without JavaScript? No. Proof of work and behavioural analysis need JavaScript. For visitors without it, your fail-open setting decides whether the submission is accepted or rejected. ### Does it work with the WooCommerce Checkout block? Not yet. The block does not submit a form but sends JSON to the Store API, so the token never reaches the server. Switch the checkout page to the classic [woocommerce_checkout] shortcode, or leave the checkout unprotected and protect the account forms only. The settings page shows a note when your checkout uses the block. ### Is the service free? For private websites, permanently. Commercial plans start above that. See https:// captchacore.eu/pricing ## Reviews There are no reviews for this plugin. ## Contributors & Developers “CaptchaCore” is open source software. The following people have contributed to this plugin. Contributors * [ speeditsolutions ](https://profiles.wordpress.org/speeditsolutions/) [Translate “CaptchaCore” into your language.](https://translate.wordpress.org/projects/wp-plugins/captchacore) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/captchacore/), check out the [SVN repository](https://plugins.svn.wordpress.org/captchacore/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/captchacore/) by [RSS](https://plugins.trac.wordpress.org/log/captchacore/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 2.5.1 * Scripts and styles are now enqueued via wp_enqueue_script/wp_enqueue_style — no inline script or style tags remain * Forms are marked by an enqueued script instead of inline snippets (js/captchacore- forms.js) * Translation files are no longer bundled in the WordPress.org build; translations come from translate.wordpress.org #### 2.5.0 * The self-updater is now optional and only part of the build distributed directly from captchacore.eu. The build for the plugin directory ships without it, because updating from foreign servers is not allowed there. * Security: proxy headers (X-Forwarded-For, X-Real-IP, CF-Connecting-IP) are only evaluated when the new option “Behind reverse proxy / CDN” is enabled. Before that, any visitor could choose the IP address reported to the risk engine and bypass IP reputation. * All translated output is now escaped. * The reported page URL uses the actual scheme and no longer contains a query string. * readme: added the section about the external services in use, added the license URI, reduced the tags to five, rewritten in English. #### 2.4.2 * The login hook moved to `authenticate` with priority 5, so it now sees every login attempt, including those with usernames that do not exist. Previously about 80 percent of brute force attempts bypassed the captcha. * Token-less POST attempts are reported to the CaptchaCore server once per IP per minute for the audit log, throttled through a transient so brute force bots cannot amplify API traffic. #### 2.4.1 * Fixed “captcha required” in Formidable Forms although the verification tick was shown. Formidable considered the field empty because the token is sent separately, so an additional item_meta hidden input is now rendered. * Header forwarding for server-side bot detection (Sec-Fetch-Site, Accept-Language), which improves the detection of scripted clients. #### 2.4.0 * Version 2 of the API is now the default and the only supported version. * Adaptive risk engine with site profiles and form policies. * Confidence score and reason codes in the response. * EdDSA-signed tokens and bindings that tie a token to origin, site and form. * Four-level under-attack mode with step-up challenges and memory-hard proof of work. * IP reputation and campaign detection integrated. Older entries are documented at https://captchacore.eu/docs ## Meta * Version **2.6.0** * Last updated **7 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1** * PHP version ** 8.1 or higher ** * Tags * [bot protection](https://wordpress.org/plugins/tags/bot-protection/)[captcha](https://wordpress.org/plugins/tags/captcha/) [GDPR](https://wordpress.org/plugins/tags/gdpr/)[security](https://wordpress.org/plugins/tags/security/) [spam](https://wordpress.org/plugins/tags/spam/) * [Advanced View](https://wordpress.org/plugins/captchacore/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/captchacore/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/captchacore/reviews/) ## Contributors * [ speeditsolutions ](https://profiles.wordpress.org/speeditsolutions/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/captchacore/)