Captchas punish the wrong people
A captcha makes a real person prove they are human, usually by picking out traffic lights. The popular ones also need an account and site keys. They load scripts from another company that slow the page down, and they send each visitor's IP address and device details to that company. We wanted something for our clients' sites that stopped bots and left people alone.
How it works
A hidden puzzle for the browser. When someone starts filling in a form, their browser quietly solves a small proof-of-work puzzle, which takes about a second while they type. The server signs each puzzle, accepts its answer once and lets it expire after ten minutes. A bot that posts straight to the form has no answer to give.
Nothing to slow the page. Nothing loads until a visitor uses a form, and each puzzle comes fresh from the server, so cached pages keep working.
Backup checks. A honeypot field, a minimum time on the form, a spam score, and automatic blocks for IP addresses that keep failing. Admins can never lock themselves out.
Real people get through. If the check can't run in someone's browser, the form still goes through on the other checks, with limits so bots can't use that as a way in.
No setup. It protects WordPress login, registration, password reset and comments, WooCommerce, Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Ninja Forms, Formidable and Elementor Pro, and a shortcode covers anything else.
Private by design. No cookies, no requests to anyone else and no API keys. The log keeps 30 days by default, and the plugin suggests wording for the site's privacy policy.
How it is built
The plugin is PHP 7.4 and up with no third-party libraries. The puzzle uses the hashing built into PHP and the browser's own WebCrypto, solved across up to four Web Workers so the page stays smooth. 179 unit tests and 26 browser tests run on WordPress Playground, and every release goes from GitHub Actions straight to WordPress.org. The plugin's own site is a static Next.js build served from a Cloudflare Worker.
Where it is now
WordPress.org approved the plugin on 20 October 2026, and it went live two days later. Version 1.3.0 added a welcome tour in November. It already guards one of our client sites, where it replaced Google reCAPTCHA. It is free, with no paid version holding features back.
