CaptchaCore

CaptchaCore protects WordPress forms against bots and spam without showing image puzzles and without tracking your visitors.

Instead of asking people to identify traffic lights, the browser solves a small cryptographic computation in the background while the plugin observes whether the interaction looks human. A single visitor never notices it. A bot farm sending millions of requests pays for every single one.

• Proof of work (SHA-256) in a web worker, so the interface never blocks
• Behavioural and environment signals: mouse movement, typing rhythm, scrolling, canvas timing, WebGL renderer
• No cookies and no image puzzles in normal operation
• Processing on our own servers in Germany, no transfer to the United States
• Widget of 16 KB gzip with no external dependencies
• Keyboard operable and marked up for screen readers

Integrations

WordPress core:

• Login form (also custom login forms rendered by wp_login_form)
• Registration
• Lost password
• Comments and WooCommerce product reviews

WooCommerce (each one switchable):

• Login and registration on the My Account page
• Lost password on the My Account page
• Checkout, on the classic checkout page ([woocommerce_checkout] shortcode). The block-based checkout is not supported yet; the settings page tells you if your shop uses it.

Form builders and page builders:

• Formidable Forms — a native field type you drag into any form
• Elementor — a CaptchaCore widget for the page builder and a field for Elementor Pro forms
• Contact Form 7 — the form tag [captchacore], or added automatically in front of the submit button of every form

Beyond WordPress, the same service has packages for Laravel and Symfony, a plugin for WoltLab Suite and a REST API for everything else: https://captchacore.eu/docs/integrationen

The plugin ships with English source strings and is ready for translation on translate.wordpress.org.

CaptchaCore is a hosted service. The plugin does nothing until you enter your own credentials, which you can create free of charge for private websites.

External services

This plugin connects your site to CaptchaCore, a service operated by SpeedIT Solutions UG (haftungsbeschränkt), Isernhagen, Germany. Without that service the plugin cannot verify anything. It stays inactive until you enter your own credentials in the settings.

1. Form verification — https://api.captchacore.eu

When: every time one of the forms you protect is submitted (login, registration, comment, lost password, WooCommerce account forms and checkout, Formidable, Elementor, Contact Form 7).
What is sent: the token created by the widget, the type of the form, the IP address of the visitor, the page URL without its query string, and the visitor’s Accept-Language and Sec-Fetch-Site request headers (forwarded as X-Forwarded-Accept-Language and X-Forwarded-Sec-Fetch-Site).
Why: to decide whether the request comes from a human or from a bot.
The service never stores IP addresses in plain text: only truncated (IPv4 /24, IPv6 /48) and as a hash with a random salt that changes every 6 hours. These IP-related fields are cleared after 30 days; the remaining statistics without personal data are kept for 7 to 365 days depending on your plan.

2. Delivery of the widget script — https://src-eu.captchacore.eu (default) or https://src.captchacore.eu (optional, worldwide)

When: on every page that contains a protected form.
What is sent: the usual connection data of a file request, meaning the IP address and the browser identification.
Why: to deliver the JavaScript file of the widget. The default endpoint uses servers in the EU only. Enable the worldwide endpoint only if you need it.
If the file cannot be loaded from there, the plugin loads it once from https://captchacore.eu instead (same data). If you run the service yourself, enter your own address under “Widget source”; the widget is then loaded from there only.

3. Requests from the visitor’s browser — https://api.captchacore.eu/api/v2/challenge and /api/v2/precheck

When: on pages with a protected form, when the widget starts its check and before the form is submitted.
What is sent: the challenge request carries your public site key and the form type; the pre-check sends the widget token directly to CaptchaCore. The token contains the proof-of-work solution, condensed behaviour metrics (counters, timings and entropy values — no raw mouse paths, no key values, no form content), the user agent and technical environment characteristics used for bot detection (for example the webdriver flag, number of plugins and languages, screen size, number of CPU cores, whether software rendering is used). As with any request, the IP address of the visitor is visible to the service.
Why: to issue the proof-of-work task and to check the token early. The widget sends these requests without cookies and stores nothing in the browser.

4. Availability check

When: only inside the WordPress admin area, when you open the settings page — the plugin asks the CaptchaCore service whether your credentials work.
What is sent: your secret key for authentication. No visitor data.
Current availability of the service and past incidents: https://captchacore.eu/status

Nothing else is transmitted. The plugin sets no cookies, sends no usage statistics and reports no data about your website to us.

Terms of use: https://captchacore.eu/seite/nutzungsbedingungen
Privacy policy: https://captchacore.eu/seite/datenschutz
Data processing agreement under Art. 28 GDPR: https://captchacore.eu/seite/dsgvo