Fail closed, or fail open
If the provider is unreachable, choose whether the submission is blocked or let through. It ships open, so a provider outage never locks your users out until you decide it should.
WordPress · Free · Spam protection
One CAPTCHA setting for every form on the site.
Most sites end up with a CAPTCHA plugin per form plugin, each with its own keys and its own idea of what to protect. This puts all of it behind one screen: pick a provider once, then switch protection on per form.
Needs WordPress. Version 2.1.0. ALTCHA needs no account and no keys.
- reCAPTCHA v2
- reCAPTCHA v3
- Cloudflare Turnstile
- hCaptcha
- ALTCHA no keys, self-hosted
Every protected form follows the provider you pick.
Fourteen integrations
Every form a spam bot actually finds.
Each group appears only when that plugin is active, so the screen stays short.
- WordPress core 4
- LoginRegistrationLost passwordComments
- WooCommerce 8
- Customer loginRegistrationLost passwordProduct reviewsGuest checkoutLogin at checkoutOrder trackingPay for order
- Community 4
- BuddyPress registrationBuddyPress group creationbbPress new topicsbbPress replies
- Form builders 7
- Contact Form 7WPFormsGravity FormsNinja FormsForminatorElementor ProDivi Builder
- Commerce and membership 3
- Easy Digital DownloadsMemberPressUltimate Member
Beyond on and off
The settings you need on the day something breaks.
IP whitelist
Skip the CAPTCHA for addresses you trust. Single IPs, ranges and CIDR notation.
Score threshold for v3
reCAPTCHA v3 returns a score rather than a pass. You set how strict the cut-off is.
No-conflict mode
Dequeue CAPTCHA scripts other plugins and themes load on the same page, which is usually why two captchas appear or neither works.
Developers can register a provider of their own with the
wbc_register_captcha_services action and it appears in
the picker beside the built-in five.
Pricing
Free, with all five providers.
There is no paid edition. Every provider, every integration and every control is in the free download.
- Five providers: reCAPTCHA v2 and v3, Turnstile, hCaptcha, ALTCHA
- ALTCHA is self-hosted, with no account and no API keys
- Fourteen integrations, from WordPress core to Ultimate Member
- Seven form builders covered, including Elementor Pro and Divi
- Per-form toggles, so you protect only what needs it
- Fail-closed mode, IP whitelist and a v3 score threshold
- No-conflict mode for pages loading a rival captcha
- Register your own provider with one action hook
Questions before you install.
- 01
Which CAPTCHA providers can I use?
Five: reCAPTCHA v2, reCAPTCHA v3, Cloudflare Turnstile, hCaptcha and ALTCHA. One is active at a time, chosen from a single dropdown, and every protected form follows that choice.
- 02
Can I run a CAPTCHA without a Google account?
Yes. Turnstile and hCaptcha are the usual alternatives, and ALTCHA goes further: it is self-hosted proof-of-work, needs no third-party account and no API keys, and generates its own HMAC key when you select it.
- 03
Which forms does it protect?
Fourteen integrations. WordPress login, registration, lost password and comments; WooCommerce login, registration, lost password, reviews, guest checkout, login at checkout, order tracking and pay for order; BuddyPress registration and group creation; bbPress topics and replies; Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Forminator, Elementor Pro and Divi; and Easy Digital Downloads, MemberPress and Ultimate Member.
- 04
Do I have to protect all of them?
No. Each form is its own toggle. A settings group only appears when the plugin it belongs to is active, so the screen shows what is relevant to your site.
- 05
What happens if the CAPTCHA provider goes down?
By default the submission is allowed through, so an outage at the provider does not lock your users out. If you would rather block on failure, fail-closed mode is a setting.
- 06
Can I skip the CAPTCHA for my own team?
Yes, with the IP whitelist. It takes single addresses, ranges and CIDR notation.
- 07
Two captchas appear on one page, or the widget will not load. Why?
Usually another plugin or the theme is loading its own CAPTCHA script on the same page. No-conflict mode dequeues those so only yours runs.
- 08
Can I add a provider that is not on the list?
Yes. Implement the service interface and register it with the wbc_register_captcha_services action, and it appears in the picker beside the built-in five.
- 09
Is it really free?
Yes, and there is no paid edition. Four of the five providers need free API keys from the provider itself; ALTCHA needs nothing.
Free download
Put every form behind one CAPTCHA setting.
Pick a provider, tick the forms that need protecting, and stop maintaining a captcha plugin per form plugin.