captchaapi

<p>Protects WooCommerce (login, registration, lost password, checkout), Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Forminator, Gravity Forms and Elementor Forms – cookieless, EU-hosted, no cookie banner required.</p>
<p>A privacy-first alternative to reCAPTCHA: captchaapi.eu stops form spam without making your visitors click traffic lights. A free tier with commercial use allowed gets you started. The work happens in the background: the visitor’s browser solves a small proof-of-work puzzle while they fill in the form, and a token rides along with the submission. There is nothing to solve and nothing to see.</p>
<p>When a form is submitted, your server confirms that token with captchaapi.eu over a single request, secured by your secret key. It is the same model every hosted CAPTCHA uses, and it keeps the secret on your server, never in the browser.</p>
<h4>Privacy by design</h4>
<ul>
<li>No cookies, and nothing to add to a cookie banner.</li>
<li>No tracking and no visitor profile. The IP address is used only for rate limiting and abuse detection, then dropped; it is never written to a database.</li>
<li>Hosted only in the EU, in Nuremberg, Germany. No data leaves the EU.</li>
<li>No images and no puzzles to solve. The check runs in the background, so it works the same for every visitor, including people who find image challenges difficult or browse with a screen reader.</li>
<li>A free tier, with commercial use allowed.</li>
</ul>
<h4>Forms and plugins it protects</h4>
<p>WordPress core:</p>
<ul>
<li>Login (wp-login.php)</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Checkout</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Fluent Forms</li>
<li>Formidable Forms</li>
<li>Forminator</li>
<li>Gravity Forms</li>
<li>Elementor Forms</li>
</ul>
<p>Each form can be turned on or off from the settings screen. The WooCommerce and form-plugin options appear only when that plugin is active.</p>
<h4>How it works</h4>
<ol>
<li>The widget loads on the pages with a protected form and solves a proof-of-work puzzle in a Web Worker.</li>
<li>On submit, it attaches the resulting token to the form.</li>
<li>The plugin confirms the token with captchaapi.eu using your secret key and rejects the submission if the service does not accept it.</li>
</ol>
<p>Each token verifies exactly once – the service enforces single use – so the plugin keeps no local replay table and nothing to clean up on a schedule.</p>
<h4>You need an account</h4>
<p>This plugin connects to the captchaapi.eu service. Create a project at https://captchaapi.eu to get a site key and a secret key. A free tier is available.</p>
<h3>External services</h3>
<p>This plugin connects to captchaapi.eu, a third-party CAPTCHA service, to protect your forms from spam. It is required for the plugin to function.</p>
<p>On any public page that contains a protected form, the plugin loads the service’s widget script (captcha.js) from your configured captchaapi.eu endpoint. The visitor’s browser then communicates with the captchaapi.eu API to perform a proof-of-work challenge and obtain a token that is attached to the form on submit. This happens for every visitor who loads a protected form.</p>
<p>To issue and validate a token the service receives your public site key, the proof-of-work result, and – as with any HTTP request – the visitor’s IP address. The IP address is used for rate limiting and abuse/bot detection (including a coarse, IP-derived country) and is processed transiently: a hashed form and aggregate counters are held briefly in a cache. No raw IP address and no per-visitor record are written to a database. The service sets no cookies. Data is processed on servers in the EU (Nuremberg, Germany).</p>
<p>When a protected form is submitted, your server sends the token to the captchaapi.eu /verify endpoint, authenticated with your secret key, and trusts the service’s accept-or-reject answer. The secret key stays on your server and is never sent to the browser.</p>
<ul>
<li>Service provider: captchaapi.eu</li>
<li>Terms of Service: https://captchaapi.eu/legal/terms</li>
<li>Privacy Policy: https://captchaapi.eu/legal/privacy</li>
</ul>


GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu

Cookieless, EU-hosted reCAPTCHA alternative for WooCommerce, WPForms, Fluent Forms & CF7. GDPR-clean, no cookie banner.

Matthias Nordwig

<p>Protect all your forms and logins against spam and brute-force attacks. The plugin is invisible and compliant to GDPR (RGPD, DSGVO).<br />
It has a lot of options on the one hand and comes with a well balanced default configuration. Thus it starts working very well, as soon as it is activated.</p>
<h3>Setup Guide</h3>
<div class="embed-vimeo" style="text-align: center;"><iframe loading="lazy" src="https://player.vimeo.com/video/905897718" width="750" height="422" frameborder="0" webkitallowfullscreen mozallowfullscreen allowfullscreen></iframe></div>
<h3>Key features</h3>
<ul>
<li>Blocks spam on all(!) public forms, comments and logins</li>
<li>Invisible. No user-input required</li>
<li>Still receive 100 percent of the real requests</li>
<li>Compliant to GDPR (respectively DSGVO, RGPD)</li>
<li>The Plugin is for free</li>
<li>No tracking, no cookies, no sessions</li>
<li>No external ressources</li>
<li>Easy to use</li>
<li>SEO-friendly</li>
<li>Only necessary code</li>
<li>Optionally messages can be flagged instead of blocking them</li>
</ul>
<h3>Examples WordPress</h3>
<ul>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Comments Form</li>
</ul>
<h3>Examples WooCommerce</h3>
<ul>
<li>Checkout</li>
<li>Login Form</li>
<li>Registration Form</li>
<li>Password Reset Form</li>
<li>Comments form</li>
<li>Product Evaluation Form</li>
</ul>
<h3>Examples other Plugins</h3>
<ul>
<li>Elementor Pro Forms, Contact Form 7, Fluent Forms, Jetpack Forms, Divi Forms, WPForms, Forminator, Thrive Architect & Thrive Apprentice, Gravity Forms, Formidable Forms, Mailchimp for WordPress Forms, BuddyPress Registration Form, bbPress Create Topic & Reply Forms, Ultimate Member Forms, wpDiscuz Custom Comments Form, Easy Digital Downloads Forms, Paid Memberships Pro Forms, MemberPress Forms, WP-Members Forms, WP User Frontend Forms, CheckoutWC & Flux Checkout, Ninja Forms, Everest Forms, Formidable Forms, WS Forms, Quform, Otter Blocks, Typeform, NEX-Forms, Bit Form, Form Maker, Funnelforms, Mailjet, Jotform, Page Builder, Metform, Calculated Fields Form, JetFormBuilder, weForms, Responsive Contact Form Builder, Zoho Forms, Smart Forms, Kali Forms, Happyforms, ApplyOnline, Subscribe Forms, FormCraft, Advanced Forms, CRM Perks Forms, Tripetto, Formstack, BuddyForms, vcita, Easy Form Builder, SimpleForm</li>
</ul>
<h3>Thank you!</h3>
<p>I hope you enjoy using the CAPTCHA plugin! If you are happy with it, I would be glad to get your review and probably a coffee too.</p>


Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant


Blocked hundreds of spam WooCommerce orders, and the plugin continues to be actively monitored and improved. I'm sure it will continue to get even better. Great work.


Excellent


The developer is really motivated to get this plugin going. Nice guy.



And the plugin helps catching spam without violating GDPR. Great for german or EU-sites.



Thanks a lot for this plugin.


Works like a charm and great developer-support

Anti-spam - CAPTCHA that protects all forms against spam and brute-force. Invisible and GDPR-compliant.

GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu vs Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant