captchaapi.eu stops form spam without making your visitors click traffic lights. The work happens in the background: the visitor's browser solves a small proof-of-work puzzle while they fill in the form, and a signed token rides along with the submission. There is nothing to solve and nothing to see.<\/p>\n\n
Your server checks that token locally with your secret key. No request is sent back to captchaapi.eu when a form is submitted, so the check adds no network latency and keeps working even if our service is briefly unreachable.<\/p>\n\n
The service runs on hardware in the EU (Nuremberg, Germany). It sets no cookies and writes no per-visitor record to a database; the visitor's IP address is used only transiently for rate limiting and abuse detection.<\/p>\n\n
Each surface can be turned on or off from the settings screen. Contact Form 7 support appears only when that plugin is active.<\/p>\n\n
Reuse is blocked with a single-use record per token. If your site has a persistent object cache (Redis or Memcached), that record lives there. Otherwise the plugin keeps a small table and clears expired rows on a schedule.<\/p>\n\n
This plugin connects to the captchaapi.eu service. Create a project at https:\/\/captchaapi.eu to get a site key and a secret key. A free tier is available.<\/p>\n\n
This plugin connects to captchaapi.eu, a third-party CAPTCHA service, to protect your forms from spam. It is required for the plugin to function.<\/p>\n\n
On any public page that contains a protected form, the plugin loads the service's widget script (captcha.js) from your configured captchaapi.eu endpoint. The visitor's browser then communicates with the captchaapi.eu API to perform a proof-of-work challenge and obtain a signed attestation that is attached to the form on submit. This happens for every visitor who loads a protected form.<\/p>\n\n
To issue and validate an attestation the service receives your public site key, the proof-of-work result, and - as with any HTTP request - the visitor's IP address. The IP address is used for rate limiting and abuse\/bot detection (including a coarse, IP-derived country) and is processed transiently: a hashed form and aggregate counters are held briefly in a cache. No raw IP address and no per-visitor record are written to a database. The service sets no cookies. Data is processed on servers in the EU (Nuremberg, Germany).<\/p>\n\n
Verification of the attestation on submit is performed locally on your server with your secret key; no request is sent back to captchaapi.eu at that point.<\/p>\n\n
wp-content\/plugins\/captchaapi<\/code>, or install it from the Plugins screen.<\/li>\n- Activate it.<\/li>\n
- Open Settings -> captchaapi.eu.<\/li>\n
- Enter your site key and secret key from your project dashboard.<\/li>\n
- Choose which forms to protect and save.<\/li>\n<\/ol>\n\n
For a stricter setup, keep the secret key out of the database by defining it in wp-config.php<\/code>:<\/p>\n\ndefine( 'CAPTCHAAPI_SECRET_KEYS', 'your_secret_key' );\n<\/code><\/pre>\n\nDuring a key rotation, list the current and the new key together, separated by a comma:<\/p>\n\n
define( 'CAPTCHAAPI_SECRET_KEYS', 'current_key,new_key' );\n<\/code><\/pre>\n\n\n\nDo my visitors have to solve anything?<\/h3><\/dt>\nNo. There is no image challenge and no checkbox. The proof-of-work runs in the browser while the form is being filled in.<\/p><\/dd>\n
Does form submission slow down?<\/h3><\/dt>\nThe verification is a local HMAC check, so it adds no network round trip on submit. The browser does its proof-of-work in the background before the submit, usually in well under a second.<\/p><\/dd>\n
What happens if captchaapi.eu is unreachable?<\/h3><\/dt>\nThe widget will not produce an attestation, so a protected form will not submit. The plugin fails closed by design: a submission without a valid attestation is rejected rather than waved through.<\/p><\/dd>\n
Does it work with Contact Form 7?<\/h3><\/dt>\nYes. Enable Contact Form 7 in the settings. The plugin acquires an attestation before Contact Form 7 sends the form and verifies it on the server.<\/p><\/dd>\n