AI Summary
Do you want to add hCaptcha to WordPress forms so that you can fight spammers and protect your website from hackers?
You’ll be pleased to hear that WPForms supports hCaptcha to safeguard websites against spam submissions, stopping bots before they can submit.
In this article, I’ll walk you through adding hCaptcha to WordPress forms from scratch, including the dashboard settings that decide how often your visitors actually see a puzzle.
Add hCaptcha to Your WordPress Form
How to Add hCaptcha to WordPress Forms
WPForms has hCaptcha built in alongside reCAPTCHA and Cloudflare Turnstile, so you pick a service, paste in two keys, and switch it on per form.
Have a look at the full range of spam protection features if you want to layer more than one defense on the same form. Follow the steps below for adding hCaptcha.
Step 1: Install the WPForms Plugin
The WPForms plugin is widely regarded as the top choice for building forms on WordPress. It provides a range of spam protection features that make the process of creating forms for your website incredibly easy.
These features prioritize the security and privacy of both your website and its users. If you upgrade to a Pro license, you can also take advantage of other more powerful security features, addons, and premium templates.
So, the first thing you’ll need to do is to install and activate the WPForms plugin. If you’re new to WordPress or facing any difficulty during the plugin installation process, you can check this guide on how to install a WordPress plugin.
Add Spam Protection to Your Forms Now
Step 2: Select hCaptcha Type
The first job inside WordPress is telling WPForms which CAPTCHA service you’re using. Go to WPForms » Settings, then click the CAPTCHA tab.
On the captcha page, you will see 3 popular captcha services, hCaptcha, reCAPTCHA, and Turnstile. You’ll need to click on the hCaptcha icon.
When you click on the icon, you’ll see settings for hCaptcha on the bottom. You can see fields to add a Site key and a Secret Key here.
Basically, you need these keys to connect your hCaptcha account to WPForms. So, leave this browser tab open and proceed to the next step.
Step 3: Generate hCaptcha Keys
Your keys come from the hCaptcha dashboard, which has been reorganised since a lot of tutorials were written. There’s no longer a welcome screen that hands you a sitekey on signup, so you create a site entry first and copy the key out of it afterwards.
Add Your Site to hCaptcha
Open the hCaptcha site in a new tab and keep WPForms open in the other. If you don’t have an account yet, create one from the signup page, which asks for little more than an email address and a password.
Once you’re logged in, click the Add Site button in the upper right corner of the dashboard.
Under Basic Info, you can put a label in the Name field. Only you ever see it, so name it after the site you’re protecting rather than something generic you’ll have to decode later.
Next, list every domain this key will run on in the Domains section. If your site answers on both the www and non-www version, add both, because the challenge fails on whichever one you leave out.
The hCaptcha Behavior setting decides what your visitors actually experience.
Always Challenge is the default and shows a challenge before every submission, while Passive and 99% Passive hide the challenge and score the visitor quietly instead.
Both passive modes need a paid hCaptcha plan, so leave this on Always Challenge if you’re on the free tier.
Below that, Passing Threshold controls how hard the challenges get. I’d leave it on Auto, which varies the difficulty based on how a visitor behaves on your site rather than treating everyone the same.
Choosing Difficult serves harder puzzles across the board, and that cuts spam at the cost of some real submissions.
Click Save at the bottom of the screen when you’re happy with it.
Copy Your Sitekey Into WPForms
Saving lands you on the Sites page with your new key listed. Click the Copy icon beside the sitekey, or open the row and copy it from the Sitekey section of the detail view.
Switch back to the WPForms tab and paste it into the Site Key field.
Generate Your Secret Key
The secret key doesn’t sit alongside the sitekey, which is where most people lose the thread. It lives in your account settings instead, because a single secret covers every site on the account.
In the hCaptcha tab, click your avatar in the top right corner and choose Settings.
Find the Secret section, click Generate New Secret, then confirm with Generate in the popup that appears.
Click Copy Secret straight away, because hCaptcha doesn’t keep the value in a readable form once you leave the screen.
Navigating away before you copy it means generating a replacement, and free accounts can only rotate the secret once a day.
Back in WPForms, paste it into the Secret Key field.
Finish Your hCaptcha Settings in WPForms
Two more settings sit under the key fields, and both are worth a look before you save. The Fail Message is the error a visitor sees when verification doesn’t pass.
The default wording works, though writing something plainer tends to cut down the confused emails.
No-Conflict Mode is the setting most worth remembering here, because when your theme or another plugin also loads a CAPTCHA script the two collide and hCaptcha quietly stops working.
Turning it on strips out any CAPTCHA code that WPForms didn’t load itself. Now click Save Settings.
If your keys check out, WPForms saves them and renders a live Preview of the widget on the same screen. An error at this point almost always means a key got truncated somewhere between copy and paste.
Click the I am human checkbox in the preview to see exactly what your visitors will get, which on a free account is usually an image challenge.
hCaptcha is connected to your site at this point, and our hCaptcha documentation is where to go for the field-by-field reference. You can also watch traffic against your key from the hCaptcha dashboard once submissions start arriving.
Step 4: Create a Simple Contact Form
Now that we’re done with the settings, it’s time to enable hCaptcha on your form. To do that, go to WPForms » Add New to create a new form.
On the setup screen, name your form and select the template you want to use. WPForms offers a number of pre-built form templates.
You can choose any form template depending on your requirements and use it on your website. We’ll choose the Simple Contact Form Template.
Once you click on Use Template, you can see a simple contact form on the right and a drag-and-drop builder on the left.
From this builder, you can add additional fields. A simple contact form includes all the basic form requirements, i.e., Name, Email, and Comment or Message.
Now that we have our form ready, we just need to add the hCaptcha field. The process is incredibly simple and only takes a few seconds.
Step 5: Add the hCaptcha Field to Your Form
On the left, look under the Standard Fields section and click on the hCaptcha field to add it to your simple contact form.
As soon as you click the hCaptcha field, a message will be displayed to confirm that you’ve turned on hCaptcha for this form. Click OK.
Now, to confirm, you’ll see the hCaptcha logo on the top-right of your form. This means the hCaptcha is working!
The other route is Settings » Spam Protection and Security in the form builder, which is also where the rest of your anti-spam controls live.
Scroll down to the CAPTCHA section and toggle Enable hCaptcha on. This is the same setting the field click toggles, so use whichever you find quicker.
Under Protection, switching on Store spam entries in the database keeps blocked submissions instead of discarding them, so you can check whether hCaptcha caught something it shouldn’t have.
Enable minimum time to submit sits nearby and rejects anything completed faster than a human plausibly could.
Storing and reviewing those entries depends on entry management, which starts at the Basic license, so a Lite site can run hCaptcha happily but has nowhere to review what got blocked.
On a paid license, our guide to viewing and managing spam entries covers restoring anything that was flagged by mistake.
Step 6: Publish Your Form and Test hCaptcha
Now, let’s add your contact form with hCaptcha to your site. Using WPForms, you can add your form in multiple locations, including a page, post, or sidebar.
We’ll walk you through how you can embed your form on a WordPress page. To add your form, click on the Embed button at the top of your page.
This will open a popup window with 2 form embedding options: Select Existing Page or Create New Page. Choose your option and click on the Let’s Go button.
This will take you to the block editor, where you can customize the form further and hit Publish or Update to take the form live.
Now, open the contact form on your site’s front-end, fill your form entries and submit to check. For more details on how to test out your forms, please look at our complete testing checklist.
Note: Test the contact form in another browser or incognito window where you haven’t logged in as an admin on your site.
If you want to adopt a few more techniques to limit spam form submissions, make sure to also check out these CAPTCHA accessibility options & alternatives in WPForms.
FAQs about Adding hCaptcha to WordPress Forms
hCaptcha comes up constantly in questions from readers setting up spam protection on their WordPress forms. Here are the ones I’m asked most often.
What is hCaptcha?
hCaptcha is a privacy-focused CAPTCHA service that stops bots from submitting your forms. The name borrows from CAPTCHA, which stands for Completely Automated Public Turing test to tell Computers and Humans Apart, with the h standing for human.
It works much like Google’s reCAPTCHA, asking visitors to prove they’re human before a submission goes through.
What differs is what happens to the data behind it, since hCaptcha’s privacy policy is written to line up with regulations like GDPR and CCPA and the service collects only what it needs to score a request.
Why add hCaptcha to your WordPress forms?
A few reasons come up repeatedly.
- Privacy: If sending your visitors’ behavioural data to Google sits badly with you or your legal team, hCaptcha is the direct replacement.
- Setup time: Creating an account and generating keys takes a couple of minutes, and WPForms handles everything after that.
- Cost: The free tier has no verification limit, so a busy contact form won’t push you onto a paid plan.
- Control over friction: The passing threshold lets you dial difficulty up or down instead of accepting one fixed level for every visitor.
If you’re weighing it against Google’s service specifically, we’ve broken down how hCaptcha and reCAPTCHA compare in more detail.
Is hCaptcha free to use on WordPress?
Yes on both counts, since hCaptcha’s free tier covers unlimited verifications and WPForms includes hCaptcha support in every version including the free Lite plugin.
hCaptcha’s paid plans exist mainly for the passive modes that skip the visible challenge, and the paid WPForms licenses add the surrounding tools like Custom CAPTCHA and entry management.
Where do I find my hCaptcha site key and secret key?
They live in two different places, which is what trips up most people. Your sitekey sits on the Sites page of the hCaptcha dashboard, either behind the copy icon in the list or in the Sitekey section when you open a site.
Your secret key comes from your account settings instead, under your avatar » Settings » Secret » Generate New Secret. hCaptcha won’t show you an existing secret again, so if you’ve lost yours, generate a fresh one and copy it immediately.
Why is hCaptcha showing an image challenge to every visitor?
That’s the free tier working as designed, because Always Challenge is the default behaviour and the Passive and 99% Passive modes that verify people quietly are paid features on hCaptcha’s side.
Setting the passing threshold to Auto softens things by varying difficulty, but it won’t remove the challenge altogether.
When a visible challenge is a dealbreaker, Cloudflare Turnstile does invisible verification for free and WPForms supports it from the same CAPTCHA tab.
hCaptcha isn’t showing up on my form. What should I check?
Start with the keys, since a truncated paste is the most common cause and the Preview on the WPForms CAPTCHA settings screen flags an error when they’re wrong.
Then confirm the domain you’re testing on is listed in the Domains field of your hCaptcha sitekey, including the www variant if your site uses one. If both look right, turn on No-Conflict Mode in the WPForms CAPTCHA settings to clear out CAPTCHA scripts loaded by your theme or another plugin.
Safari deserves its own mention, because its cross-site tracking protection can block the requests hCaptcha needs to draw a challenge, and moving that site to Turnstile is usually less painful than fighting it.
Can I test hCaptcha before going live?
Yes, and it’s worth doing in two passes. The Preview in your WPForms CAPTCHA settings renders the real widget using your real keys, so clicking I am human there confirms the connection works before a single visitor sees your form.
After that, submit the published form from an incognito window, since testing while logged in as an admin doesn’t reflect what a visitor gets.
Next, Learn How to Secure Your Online Forms
hCaptcha takes care of the bot traffic, and it’s one layer among several worth having. Our guide to proven strategies for creating secure WordPress forms covers the settings and habits that matter beyond a CAPTCHA.
Spam that slips past a challenge usually calls for a different tool, which is what our walkthrough on how to build spam-free contact forms is for.
You can also use the same WPForms builder to add CAPTCHA in the WordPress login and registration form if bots are hammering those pages instead.
Block Form Spam With WPForms Now
Ready to build your form? Get started today with the easiest WordPress form builder plugin. WPForms Pro includes lots of free templates and offers a 14-day money-back guarantee.
If this article helped you out, please follow us on Facebook and Twitter for more free WordPress tutorials and guides.
