Best CAPTCHA Plugin for WordPress (2026)

Search the wordpress.org plugin directory for a way to stop form spam and you get pages of CAPTCHA recommendations. None of them are Google's. Google publishes no reCAPTCHA plugin for WordPress, and a directory check on 11 August 2026 says so plainly: every reCAPTCHA deployment on WordPress runs through a third-party wrapper written and maintained by somebody else.

That changes what you are really choosing. On WordPress the plugin is the thing you deploy, and it sets how much of your site the CAPTCHA reaches, what it does in the browser, and whether any of it survives the next WordPress release.

Why WordPress Changes the CAPTCHA Decision

Three things about WordPress make this decision different from dropping a widget into a custom-built site.

The plugin layer adds a second maintainer. A service with a 99.95% uptime commitment sitting behind a plugin that stopped receiving updates fifteen months ago gives you the reliability of the plugin, not the service.

WordPress has no single form API. Coverage gets built one integration at a time. Support for Contact Form 7 does not imply support for Gravity Forms, and support for the WooCommerce login form does not imply support for WooCommerce checkout. "Supports the popular form plugins" is a dozen separate claims wearing one sentence.

The core attack surface exists before you install anything. A default install exposes three public endpoints that bots find without any help from you: login, password reset and comments. Registration becomes the fourth the moment you tick Anyone can register. Those absorb brute-force attempts and fake account creation traffic whether or not you have ever added a contact form. Page builders widen the surface further, since Elementor, Divi, Avada and Kadence each ship their own form implementation.

Which leaves a narrower question than "which CAPTCHA detects best": which plugin reaches every form you actually run, and whether it will still reach them next year.

How to Evaluate a WordPress CAPTCHA Plugin

Six criteria. Each one is answerable from a plugin's directory page or its readme in about five minutes, before you install anything.

1. Official plugin and who maintains it. Check whether the plugin comes from the CAPTCHA vendor or from a third party wrapping the vendor's API. Vendor-maintained means one release cycle and one support channel. A wrapper can fall behind the service, or be abandoned while the service itself keeps running perfectly.

2. Maintenance status and WordPress compatibility. Two public fields answer this: the last-updated date and the "tested up to" WordPress version. More than one major release behind on "tested up to" is a standing risk. Core changes break form hooks.

3. Form-plugin coverage. Read coverage at the integration level: WordPress core login, registration, password reset and comments, then whichever of Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Fluent Forms, Forminator and Ninja Forms you actually use. WooCommerce deserves its own line, because login, registration, password reset and checkout are four separate integrations. Checkout matters most: it is where carding attempts land OWASP OAT-001. In several reCAPTCHA plugins it is a paid-tier feature.

4. Setup without code. Site key, secret key, tick the forms you want protected. Anything requiring a shortcode on every form, a theme file edit, or a snippet in functions.php is a maintenance cost that returns every time you rebuild a form or change themes.

5. Page speed and Core Web Vitals impact. Plenty of plugins enqueue the CAPTCHA script sitewide instead of only where a protected form exists. Your homepage then pays for a widget it never renders, in Largest Contentful Paint and Interaction to Next Paint. Look for deferred or interaction-triggered loading, footer enqueueing, or conditional per-page loading.

6. Data handling and consent for EU site owners. Four questions: where is verification processed, does the widget set cookies, is data retained after the verdict is returned, and is it used for anything beyond bot detection? Non-essential cookies require prior consent under the ePrivacy rules Directive 2002/58/EC, Article 5(3), EDPB Guidelines 2/2023, which on WordPress usually means declaring the CAPTCHA in your consent management platform and accepting a consent gate in front of your contact form. Whether your setup meets your obligations is a question for your counsel; the widget's browser behaviour you can check yourself in thirty seconds. If EU processing is a firm requirement, our comparison of European CAPTCHA providers goes deeper.

WordPress CAPTCHA Plugins Compared

Every figure below comes from the public wordpress.org plugin information API, retrieved on 11 August 2026. Coverage claims come from each plugin's own readme. Plugin data changes, so re-check the directory page before you install.

[1] hCaptcha is operated by Intuition Machines, Inc. of Miami, Florida, self-certified under the EU-US, UK-US and Swiss-US Data Privacy Frameworks and [listed as active on all three](https://www.dataprivacyframework.gov/participant/6388), and it states it is [certified under ISO 27001 and 27701](https://www.hcaptcha.com/certifications). Its readme states that in the default configuration the plugin sets no cookies and sends no data to external servers.
[2] The most widely used Turnstile plugin is published by an independent developer. Its readme states it is not affiliated with, endorsed or sponsored by Cloudflare.
[3] Turnstile sets no tracking cookies. A functional cf_clearance cookie is issued only where the site operator enables Cloudflare's [Pre-Clearance mode](https://developers.cloudflare.com/turnstile/concepts/pre-clearance-support/), which is off by default.
[4] Support for Contact Form 7, WPForms, Gravity Forms, Elementor Pro, Ninja Forms, Formidable, Forminator and WooCommerce is listed as a Pro feature.
[5] Covers WordPress core forms, BuddyPress, WooCommerce and Easy Digital Downloads. The readme lists a generic "WooCommerce Form" without naming checkout, and there are no dedicated integrations for Contact Form 7, WPForms, Gravity Forms or Elementor.
[6] Last updated 11 June 2025 and, as of 11 August 2026, still tested only against a WordPress release several versions old. Its readme lists one-click integration with WooCommerce, Contact Form 7, Gravity Forms, WPForms and BuddyPress under premium features; the free plugin covers WordPress native forms.

The Plugins in Detail

CaptchaFox

CaptchaFox is published by Scoria Labs GmbH, the German company that operates the service, so there is one release cycle and one support channel. The latest version shipped in Augst 2026, is tested against the current WordPress release, and its plugin directory listing shows compatibility updates going back to 2023.

Coverage is its strongest argument on WordPress: 21 integration points spanning WordPress core login, registration, password reset and comments; Contact Form 7, WPForms, Gravity Forms, Elementor Forms, Ninja Forms, Fluent Forms, Forminator, Avada Forms and Otter Blocks; Mailchimp for WordPress; bbPress; and four WooCommerce endpoints including checkout. Checkout sitting in the base plugin rather than behind a licence upgrade matters if you run a store.

Setup is two keys and a page of toggles. No shortcodes, no theme file edits. A status page checks setup, integrations and connectivity, so you can confirm the widget is actually firing. A Script Loading option holds the script back until the visitor first interacts with the page, with a matching capf_delay filter if you would rather set it in code.

Detection combines signal analysis, behavioral analysis and proof-of-work, so no single challenge type carries the verdict on its own. Most legitimate visitors are through in about a second. The Security tab adds layers in front of the CAPTCHA entirely: a honeypot field, a minimum submission time, IP allowlists and denylists, and failed-login throttling.

Verification runs exclusively in EU data centres, with no transfers to third countries. Browser signals and the visitor's IP address are evaluated to reach a verdict, because that is how bot detection works. No cookies are set, and nothing about the visitor persists once the verdict is returned, which usually means one fewer entry in your consent management platform. The default challenge is an invisible check or a single click rather than distorted text, built for WCAG conformance and working with screen readers.

The free plan covers 1,000 requests a month. Paid tiers are a fixed monthly fee against a request quota rather than a per-request meter, starting at EUR 15 per month on annual billing for 10,000 requests, so traffic spikes do not trigger a shutdown. The step-by-step WordPress setup guide walks through installation and enabling your first form.

hCaptcha for WP

hCaptcha's plugin is published under the vendor's own wordpress.org account, tested against the current WordPress release and updated in August 2026 according to its plugin directory listing, which by release date makes it the most actively maintained plugin here. One caveat the listing does not show: the readme itself describes it as a community-developed plugin.

The readme claims support for more than 60 plugins and themes, the broadest integration surface in the directory, including five WooCommerce endpoints. There is a migration wizard for moving over from reCAPTCHA or Turnstile, and multisite settings sync. For a large or unusual form stack, it will probably have your integration when nothing else does.

The trade-off is jurisdictional rather than technical. The readme states that in the default configuration the plugin sets no cookies and sends no data to external servers. What remains is where the processing happens: the service is US-based and relies on the EU-US Data Privacy Framework, which survived its first annulment action at the EU General Court in September 2025, while its two predecessors were struck down in 2015 and 2020. The visible challenge on the free tier is also image-based, which slows every visitor down and puts a real barrier in front of anyone with a visual impairment. The passive modes that fix that sit behind the Pro and Enterprise tiers.

Cloudflare Turnstile

On cost and on user experience, Turnstile is hard to argue with. The service is free with no request limit at all, capped instead at 20 widgets, the challenge is usually non-interactive, and it sets no tracking cookies. Coverage through the most popular WordPress plugin is genuinely wide, from WordPress core forms and WooCommerce checkout through WPForms, Contact Form 7, Gravity Forms, Elementor Pro and bbPress, with multisite support and a failsafe mode for when the service is unreachable.

Criterion 1 is where it lands differently. The most widely used Turnstile plugin is published by an independent developer, and its own readme states that it is not affiliated with, endorsed or sponsored by Cloudflare. It is well maintained today. Even so, an independent maintainer stands between your forms and a service you think you installed directly. On criterion 6, Turnstile runs across Cloudflare's global edge network, which includes European points of presence without being EU-only.

Google reCAPTCHA

There is no Google-authored reCAPTCHA plugin on wordpress.org. Criterion 1 cannot be satisfied at all, and criterion 2 has to be assessed separately for whichever wrapper you choose.

Three widely used wrappers diverge sharply, which makes "add reCAPTCHA to WordPress" a much vaguer instruction than it sounds. One, last updated in April 2026, puts the major form builders and all WooCommerce coverage behind a Pro licence. Another, updated in July 2026, has no dedicated integrations for the four biggest form builders at all. A third was last updated in June 2025, is tested only against a WordPress release several versions old, and gates WooCommerce and the form builders behind its premium edition. Three coverage maps, three paywalls, and only some still tested against current WordPress.

On data handling, reCAPTCHA sets a cookie named _GRECAPTCHA and processes on US infrastructure. Since 2 April 2026 Google operates as a data processor rather than a controller for reCAPTCHA data, with the site operator as sole controller Google reCAPTCHA FAQ. The Austrian Federal Administrative Court ruled in September 2024 that reCAPTCHA is not technically necessary for operating a website, so its cookies cannot rest on legitimate interest and the visitor's consent has to be obtained W298 2274626-1/8E. What those facts mean for your site is an assessment you make with your own counsel, but the practical consequence arrives sooner than the legal one: a cookie-setting CAPTCHA typically has to be declared in your consent management platform, and a consent gate in front of your contact form is a conversion cost as well as a compliance question. We covered how reCAPTCHA pricing and its GDPR position have evolved in more detail.

Akismet and Honeypot-Only Plugins

Akismet is effective at filtering form spam and comment spam by scoring submitted content against a shared network, and if comment spam is your entire problem it may be all you need. The structural limit is what it acts on: it checks submissions against its global database of spam after they arrive, based on their content, which does nothing about credential stuffing against wp-login.php, automated account creation, or checkout probing. A content filter asks whether a submission looks like spam, while a login form only cares whether there is a person on the other end.

Honeypot-only plugins sit in the same place. A hidden field costs nothing and catches naive form-fillers reliably, then stops working the moment the automation reads the DOM. Treat both as complements, which is why CaptchaFox ships a honeypot and a time trap alongside its CAPTCHA.

Four Mistakes That Undo a WordPress CAPTCHA

Picking the right plugin is half the job. These four setup decisions cancel out the protection, and all four are common.

Protecting comments and nothing else. The comment form is the one people remember to protect. It is also the one bots care least about now. Login, registration and WooCommerce checkout are where account takeover attempts and card testing land, so enable every form your site runs.

Running a plugin that is no longer maintained. When a CAPTCHA plugin breaks against a core change, nothing breaks visibly: the form keeps submitting, the protection quietly stops, and you find out from your spam volume weeks later. Check the last-updated date and the "tested up to" version before you install, then again after every major WordPress release.

Loading the script on every page. A CAPTCHA script enqueued sitewide costs Largest Contentful Paint and Interaction to Next Paint on pages with no form at all, which for most sites is nearly all of them. Choose a plugin that defers loading until interaction or loads conditionally per page.

Not knowing what the widget does in the browser. A CAPTCHA that sets cookies or sends data to a third country generally belongs in your consent management platform, and a consent gate in front of a contact form has a measurable effect on how many people submit it. The same check should cover accessibility, since an image puzzle is a barrier for anyone relying on assistive technology, which our piece on balancing security with inclusivity covers in practice.

Choosing the Right CAPTCHA for Your WordPress Site

The right answer depends on what you are actually running.

If you run WooCommerce: you need coverage on checkout, login, registration and password reset, and checkout is the one gated behind a Pro licence in some reCAPTCHA wrappers. CaptchaFox covers all four endpoints in the base plugin and adds failed-login throttling for the account pages.

If you are migrating off reCAPTCHA: CaptchaFox's verification call has the same shape as reCAPTCHA's, though the endpoint, container class and response field name change. On WordPress the plugin handles all of that, so the switch comes down to swapping keys and re-ticking your forms.

If you manage client sites: fixed pricing from EUR 15 per month keeps the cost line simple, and coverage across a mixed estate of form builders means you are not researching a new plugin per client. CaptchaFox is configured per site, so a multisite network means configuring each site individually.

If accessibility is on your roadmap: avoid image challenges and distorted text. CaptchaFox verifies most visitors invisibly or with a single click and works with screen readers.

If cost is the binding constraint: volume decides between two free routes. Cloudflare Turnstile is free at any volume, and what you take on is a third-party plugin maintainer and global edge processing. CaptchaFox's free plan covers 1,000 requests a month and brings the vendor-published plugin, WooCommerce checkout in the base version and EU-only processing with it.

If EU processing is a firm requirement: CaptchaFox verifies in EU data centres, with a plugin tested against current WordPress, 21 integration points, and detection that layers several signals instead of resting on one.

The deciding question is whether a single plugin covers your whole form surface, stays maintained, and handles data in a way you can explain. Get started for free, or follow our WordPress setup guide for the click-by-click version. Agencies running larger estates can get in touch.