How to Set Up hCaptcha on WordPress Forms

Are bots filling your WordPress forms with junk? hCaptcha can block most of them before they reach your inbox.

hCaptcha is a popular alternative to Google reCAPTCHA, and it has a free plan. WPForms supports it out of the box, even in the free version. But setup spans 2 dashboards, and one wrong key can block every entry.

In this guide, I’ll show you how to set up hCaptcha on WordPress forms.

What Is hCaptcha?

hCaptcha is a CAPTCHA service that helps stop bots and spammers from submitting your forms. Most visitors check an “I am human” box and then solve a short image challenge.

hCaptcha says it’s built with privacy in mind and doesn’t sell personal data. Its privacy policy covers rules like GDPR and CCPA.

So it’s a good fit if your site’s privacy matters to you.

hCaptcha has a free plan, and that’s all you need for this tutorial. The paid Pro plan adds a “99.9% passive” mode and custom themes.

hCaptcha vs reCAPTCHA vs Cloudflare Turnstile

WPForms supports 3 CAPTCHA services. You can only use one at a time across your whole site. Here’s how they compare:

	hCaptcha	Google reCAPTCHA	Cloudflare Turnstile
Free plan	Yes	Yes, up to 10,000 checks a month	Yes, up to 20 widgets
What visitors see in WPForms	Checkbox, usually followed by an image challenge (free plan)	Checkbox (v2), or nothing (Invisible v2 and v3)	A small widget, usually with no puzzle
Invisible option in WPForms	No	Yes	Widget mode is set in Cloudflare
Best for	Privacy-focused sites that are fine with a checkbox	Sites already using Google services	Sites that want the least friction

Limits are from Google’s reCAPTCHA tiers and Cloudflare’s Turnstile plans.

For a deeper look, see our hCaptcha vs reCAPTCHA comparison. We also have a guide to Cloudflare Turnstile on WordPress forms.

How To Set Up hCaptcha on WordPress Forms

To set up hCaptcha in WordPress, install WPForms. Then choose hCaptcha under WPForms » Settings » CAPTCHA.

Paste in the Site Key and Secret Key from your hCaptcha dashboard and save. Then add the hCaptcha field to your form in the form builder.

Here’s each step in detail:

Step 1: Install and Activate WPForms

First, install and activate the WPForms plugin. hCaptcha works with both WPForms Lite and WPForms Pro. You don’t need a paid license for this.

New to WordPress? Here’s a step-by-step guide on how to install a WordPress plugin.

Next, open the CAPTCHA settings. Go to WPForms » Settings in your dashboard and click the CAPTCHA tab.

You’ll see 4 options: hCaptcha, reCAPTCHA, Turnstile, and None. Select hCaptcha.

As soon as you do, fields for your Site Key and Secret Key appear. You’ll get both from hCaptcha in the next step.

You may also see a box called Prefer no CAPTCHAs? on this page. That’s ActiveLayer, an invisible spam filter from the WPForms team.

It’s optional, and you can skip it for this tutorial.

Step 2: Set Up hCaptcha Sitekey

Now open the hCaptcha website in a new tab. Keep your WPForms settings open in the first tab.

Sign up for a free account, or log in if you have one.

hCaptcha gives you 2 keys. The Site Key is public and loads the CAPTCHA on your form. The Secret Key is private and lets your site check each answer with hCaptcha.

In your hCaptcha dashboard, open the Sites tab. Your account may already list a sitekey. To keep this site separate, add a new one.

Give the sitekey a name. It’s only for your reference, so something like “My Contact Form” is fine.

Then add your site’s domain to the sitekey’s domain list, like example.com. Add every domain that will show the form, including any staging site.

Save the sitekey when you’re done.

Step 3: Add Sitekey to WPForms

Now connect hCaptcha to WPForms. Back in the Sites tab, copy the sitekey for your new site.

Switch to your WPForms tab and paste it into the Site Key field.

Next, get your secret key. In hCaptcha, click your profile icon at the top right and choose Settings.

Copy the secret key shown there.

If you need a new one, click Generate New Secret. Copy the secret right away and store it safely.

Paste it into the Secret Key field in WPForms.

You can also change the Fail Message. Visitors see it if they don’t pass the check.

The default is “hCaptcha verification failed, please try again later.”

Click Save Settings. WPForms then shows a Preview of your CAPTCHA, built from your site key.

If the preview loads, your Site Key is working.

Step 4: Create a New Form

Now it’s time to add hCaptcha to a form. Open an existing form, or create a new form under WPForms » Add New Form.

Give your form a name. Then pick a template from the form template library, or start from a blank form.

Templates save you from building every field by hand.

For this example, I’ll use the Simple Contact Form template.

The form builder opens. Your fields are on the right, and the field list is on the left.

Step 5: Add hCaptcha Field on WordPress Form

In the field list on the left, find the Standard Fields section. Click the hCaptcha field.

You don’t drag this one. A single click turns it on.

A popup says “hCaptcha has been enabled for this form. Don’t forget to save your form!” Click OK.

An hCaptcha badge now shows in the form preview.

It’s only a reminder inside the builder. Visitors see the real hCaptcha checkbox instead.

You can also turn hCaptcha on from the form’s settings.

Go to Settings » Spam Protection and Security. Under CAPTCHA, switch on the Enable hCaptcha toggle.

Click Save at the top of the builder. Then add your form to a page in WordPress.

Step 6: Test Your New hCaptcha Field

Now check that hCaptcha works. Open the page with your form on your site’s front end.

Fill in the fields and check the hCaptcha box. You may get an image challenge to solve.

Then submit the form and make sure you see your confirmation message.

That’s it! hCaptcha now protects your WordPress form.

Create Your WordPress Form Now

Troubleshooting hCaptcha Not Working on WordPress Forms

If hCaptcha isn’t working, the cause is usually your keys, domains, or another plugin. Here’s how to fix the most common problems.

The token, localhost, and test-key rules below come from hCaptcha’s developer docs.

The hCaptcha box doesn’t show on the form

First, make sure hCaptcha is on for this form. Open the form in the builder and check Settings » Spam Protection and Security » CAPTCHA.

If it’s on, clear your site and browser cache. Caching and script-optimization plugins can delay or block the hCaptcha script.

Still missing? Another plugin may load its own CAPTCHA.

In WPForms » Settings » CAPTCHA, turn on No-Conflict Mode. It removes other CAPTCHA scripts from your pages.

“hCaptcha verification failed, please try again later”

This is WPForms’ default fail message. The visitor either didn’t finish the check or took too long.

hCaptcha tokens expire after about 2 minutes.

Ask them to check the box again and submit right away. If everyone sees this message, check your Secret Key next.

WPForms says hCaptcha is rejecting your secret key

In WPForms 2.0.2 and later, you’ll see this notice in your WordPress dashboard: “hCaptcha is rejecting your secret key, so form submissions are being blocked.”

Your Secret Key is wrong, or it doesn’t match your Site Key’s account.

Copy a fresh secret from your hCaptcha settings. Paste it in and click Save Settings.

hCaptcha works on your live site but not on staging

First, check that your staging domain is in your sitekey’s domain list. Add it if it’s missing.

hCaptcha doesn’t accept localhost or 127.0.0.1 at all. For a local site, use hCaptcha’s test keys from Step 3.

The form submits, but the email never arrives

That’s an email problem, not an hCaptcha one. By default, WordPress sends form emails through your web host, and many get lost.

Our guide on WPForms not sending email walks through the fix with WP Mail SMTP.

FAQs about hCaptcha

Here are answers to common questions about using hCaptcha with WordPress.

Is hCaptcha free?

Yes. hCaptcha has a free plan that works with WPForms.

Pro starts at $99 a month on annual billing, per hCaptcha’s Pro page. It adds a 99.9% passive mode and custom themes.

Does WPForms Lite support hCaptcha?

es. hCaptcha, reCAPTCHA, and Cloudflare Turnstile are all in the free WPForms Lite plugin. You don’t need a paid WPForms license to use them.

Can I use hCaptcha and reCAPTCHA at the same time?

No. WPForms uses one CAPTCHA service across your whole site.

You pick it in WPForms » Settings » CAPTCHA. You can still turn the CAPTCHA on or off for each form.

Can I make hCaptcha invisible in WPForms?

Not from WPForms. It always shows hCaptcha’s checkbox.

Want no visible CAPTCHA? Pick reCAPTCHA Invisible v2 or v3, or try Cloudflare Turnstile.

Is hCaptcha better than reCAPTCHA?

t depends on what you need. hCaptcha focuses on privacy. reCAPTCHA offers invisible options in WPForms.

The comparison table near the top of this post shows the main differences.

Next, Add a GDPR Agreement to Online Forms

Now that your forms are safe from bots, you may also need a GDPR agreement. Our tutorial shows you how to add a GDPR agreement to your WordPress forms.

Want more ways to stop bots? See our picks for the best WordPress anti-spam plugins.

Fix Your WordPress Emails Now

Ready to fix your emails? Get started today with the best WordPress SMTP plugin. If you don’t have the time to fix your emails, you can get full White Glove Setup assistance as an extra purchase, and there’s a 14-day money-back guarantee for all paid plans.

If this article helped you out, please follow us on Facebook and Twitter for more WordPress tips and tutorials.