Title: hostily Captcha
Author: connect - Media & Teledienst
Published: November 3, 2026
Last modified: November 3, 2026
---
Search plugins
# hostily Captcha
By [connect – Media & Teledienst](https://profiles.wordpress.org/connectdeutschland/)
[Download](https://downloads.wordpress.org/plugin/hostily-captcha.0.2.5.zip)
* [Details](https://wordpress.org/plugins/hostily-captcha/#description)
* [Reviews](https://wordpress.org/plugins/hostily-captcha/#reviews)
* [Installation](https://wordpress.org/plugins/hostily-captcha/#installation)
* [Development](https://wordpress.org/plugins/hostily-captcha/#developers)
[Support](https://wordpress.org/support/plugin/hostily-captcha/)
## Description
hostily Captcha connects your site to a hostily Captcha service (https://captcha.
hostily.de or your own installation). Visitors confirm with one click (or invisibly):
their browser solves a small proof-of-work task, so there are no image puzzles and
no tracking cookies. Your server then checks the result with your project secret,
together with content rules, a honeypot field, a minimum fill-in time and detection
of identical submissions.
**Protected forms**
* WordPress: comments, login, registration, lost password, setting a new password,
multisite sign-up (wp-signup.php)
* WooCommerce: classic checkout, account registration, login
* Contact Form 7, WPForms, Gravity Forms, Elementor Pro Forms, Formidable Forms,
Ninja Forms, Gwolle Guestbook
* Your own forms via an action and a filter (see FAQ)
**Requirements**
The plugin needs a project at the hostily Captcha service: create a free account
at https://captcha.hostily.de (the free plan includes 1,000 checks per month for
one website). The plugin itself has no limits and no locked features; plans only
differ in the service’s monthly quota and extras such as statistics. If the quota
is exceeded, forms stay protected.
Every integration is only active when the matching plugin is active, and every form
can be switched off on the settings page (Settings -> hostily Captcha).
**Privacy**
* The plugin sets no cookies.
* The visitor’s browser talks only to the captcha service you configured (widget
script, task, result). No other third party is contacted.
* Your server sends the one-time token, the visitor’s IP address and (for forms
with content checks) the submitted form fields to the service. Password fields
are never sent. The service stores only hashed IP addresses and deletes events
after a retention period. Mention the service in your privacy policy.
**External service**
This plugin needs a hostily Captcha service (default: https://captcha.hostily.de,
privacy information at https://captcha.hostily.de). It loads the script `/widget/hostily-captcha.js` on pages with protected forms and calls `/
api/v1/pruefen` from your server on every submission of a protected form.
**Widget license**
The browser widget is not part of this plugin. It is loaded from the service and
is licensed under the Apache License 2.0 (it contains parts of Cap, Copyright 2025
Tiago, Apache-2.0).
**Limits**
* WooCommerce: only the classic checkout (shortcode `[woocommerce_checkout]`).
The block based checkout is not covered.
* Ninja Forms: add the field “hostily Captcha” (section Miscellaneous) to every
form that should be protected.
* Forms sent by JavaScript work best in the visible mode.
* Logged-in users are not checked on comments.
**Lock-out rescue**
Add `define( 'HOSTILY_CAPTCHA_DISABLE', true );` to wp-config.php to switch all
checks off.
### External services
This plugin connects to the hostily Captcha service at https://captcha.hostily.de,
operated by connect – Media & Teledienst (Germany). Without it, the forms cannot
be protected.
* In the visitor’s browser, the widget script is loaded from captcha.hostily.de
and requests a proof-of-work task (challenge) and redeems the solution for a
one-time token. This sends the site key, the page origin and the visitor’s IP
address (as part of the HTTP request; the service stores it only as a daily-salted
hash).
* When a protected form is submitted, your server sends the token, your secret,
the visitor’s IP address and the content fields of the form (no passwords, payment
data or hidden technical fields) to https://captcha.hostily.de/api/v1/pruefen,
so that minimum time, honeypot, duplicate submissions and your content rules
can be checked. Submissions are not stored; events are deleted after 14 days.
Terms of service: https://captcha.hostily.de/agb.html – Privacy policy: https://
captcha.hostily.de/datenschutz-dienst.html – Data processing agreement: https://
captcha.hostily.de/avv.html
## Screenshots
[⌊Comment form: the visitor ticks the box, the browser solves a small task in the
background.⌉⌊Comment form: the visitor ticks the box, the browser solves a small
task in the background.⌉[
Comment form: the visitor ticks the box, the browser solves a small task in the
background.
[⌊Login without the check is rejected with a clear message.⌉⌊Login without the check
is rejected with a clear message.⌉[
Login without the check is rejected with a clear message.
[⌊WooCommerce classic checkout: the widget sits directly above "Place order".⌉⌊WooCommerce
classic checkout: the widget sits directly above "Place order".⌉[
WooCommerce classic checkout: the widget sits directly above “Place order”.
[⌊Contact Form 7 form, confirmed.⌉⌊Contact Form 7 form, confirmed.⌉[
Contact Form 7 form, confirmed.
[⌊Settings: keys, mode, language, protected forms and behaviour when the service
is not reachable.⌉⌊Settings: keys, mode, language, protected forms and behaviour
when the service is not reachable.⌉[
Settings: keys, mode, language, protected forms and behaviour when the service is
not reachable.
## Installation
1. Upload the plugin folder to `/wp-content/plugins/` or install the ZIP via Plugins-
> Add New.
2. Activate the plugin.
3. Go to Settings -> hostily Captcha, enter site key and secret of your project, save.
4. Press “Test connection”. Choose the forms you want to protect.
The domain of your site must be on the project’s list of allowed domains in the
service.
## FAQ
### Where do I get site key and secret?
From your project in the hostily Captcha administration (https://captcha.hostily.
de/verwaltung/).
### Why does the widget show “Protected by hostily”?
The notice is part of the service’s widget (like the badge of other captcha services)
and links to the service’s website. No link or credit is added by the plugin itself.
On plans that include it, the notice can be switched off per project in the service’s
administration.
### What happens if the service is down?
By default submissions pass and the problem is logged (shown on the settings page,
and in the PHP error log when WP_DEBUG_LOG is on). You can choose to block instead.
### My site is behind a proxy or CDN.
Enter the proxy’s address under “Trusted proxies”. Only then X-Forwarded-For is
used for the visitor’s address.
### How do I protect a form of my theme or my own plugin?
Inside the form: `do_action( 'hostily_captcha_widget' );`. When the form is sent:
$error = apply_filters( ‘hostily_captcha_check’, null, $fields ); – `null` means
passed, otherwise show `$error` to the visitor. `$fields` (name => value) is optional
and enables the content rules. Without the plugin both calls do nothing. Enable “
Own forms” in the settings.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“hostily Captcha” is open source software. The following people have contributed
to this plugin.
Contributors
* [ connect – Media & Teledienst ](https://profiles.wordpress.org/connectdeutschland/)
[Translate “hostily Captcha” into your language.](https://translate.wordpress.org/projects/wp-plugins/hostily-captcha)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/hostily-captcha/),
check out the [SVN repository](https://plugins.svn.wordpress.org/hostily-captcha/),
or subscribe to the [development log](https://plugins.trac.wordpress.org/log/hostily-captcha/)
by [RSS](https://plugins.trac.wordpress.org/log/hostily-captcha/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 0.2.5
* New: the form for setting a new password (link from the lost password mail, WordPress
and WooCommerce).
* New: multisite sign-up on wp-signup.php (new user and new site). Both are switched
on after the update, like on a new installation.
#### 0.2.4
* WooCommerce checkout: the widget now sits directly above the “Place order” button
instead of below the order notes.
#### 0.2.3
* Widget script for own forms is always enqueued (wp_print_scripts on pages without
wp_head).
* Field names sent for content checks are sanitized.
* Translations come from translate.wordpress.org; no bundled language files.
#### 0.2.2
* Readme: requirements (free account at captcha.hostily.de), notice in the widget,
Gwolle and own forms listed; description corrected.
#### 0.2.1
* Elementor Pro Forms: a failed check now stops the submission (field error, not
only a message).
#### 0.2.0
* Gwolle Guestbook.
* Own forms: action hostily_captcha_widget, filter hostily_captcha_check.
* Gravity Forms: no check for page changes, GravityView edits, back end and WooCommerce
product add-ons.
#### 0.1.0
* First release.
## Meta
* Version **0.2.5**
* Last updated **5 hours ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.4**
* PHP version ** 7.4 or higher **
* Tags
* [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[captcha](https://wordpress.org/plugins/tags/captcha/)
[contact form 7](https://wordpress.org/plugins/tags/contact-form-7/)[spam](https://wordpress.org/plugins/tags/spam/)
[woocommerce](https://wordpress.org/plugins/tags/woocommerce/)
* [Advanced View](https://wordpress.org/plugins/hostily-captcha/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/hostily-captcha/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/hostily-captcha/reviews/)
## Contributors
* [ connect – Media & Teledienst ](https://profiles.wordpress.org/connectdeutschland/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/hostily-captcha/)