crovly

Crovly is a privacy-first captcha service powered by Proof of Work. Unlike traditional captchas that rely on image puzzles (easily solved by AI) or invasive tracking, Crovly makes the visitor’s browser do computational work to prove it’s not a bot.
How it works:
<ol>
<li>Your visitor’s browser solves a small cryptographic puzzle (Proof of Work)</li>
<li>Browser fingerprint and environment signals are collected (as a hash — no personal data stored)</li>
<li>Behavioral analysis detects automated patterns (mouse, keyboard, scroll)</li>
<li>A composite score determines if the visitor is human</li>
</ol>
Key features:
<ul>
<li>Privacy-friendly — No cookies, no cross-site tracking</li>
<li>No image puzzles — Invisible to legitimate users</li>
<li>Resistant to AI vision attacks — Proof of Work cannot be solved by image recognition</li>
<li>IP binding — Tokens are bound to the solver’s IP address</li>
<li>Adaptive difficulty — Suspicious visitors receive harder challenges</li>
<li>22+ integrations — Works with major WordPress form plugins</li>
<li>Lightweight — Widget is under 25KB gzipped, zero dependencies, 42 languages</li>
</ul>
Supported integrations:
<ul>
<li>WordPress login, registration, lost password, comments</li>
<li>WooCommerce (checkout, login, register, lost password, pay for order)</li>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Gravity Forms</li>
<li>Elementor Pro Forms</li>
<li>Ninja Forms</li>
<li>Fluent Forms</li>
<li>Formidable Forms</li>
<li>Forminator</li>
<li>Jetpack Contact Form</li>
<li>Divi (contact form, login)</li>
<li>BuddyPress (registration, activity)</li>
<li>bbPress (topics, replies)</li>
<li>Ultimate Member (login, register, password reset)</li>
<li>MemberPress (checkout, login)</li>
<li>Paid Memberships Pro</li>
<li>Easy Digital Downloads</li>
<li>Mailchimp for WordPress</li>
<li>GiveWP</li>
<li>wpDiscuz</li>
<li>wpForo</li>
<li>WordPress Multisite signup</li>
</ul>
Shortcode & PHP support:
Use <code>[crovly]</code> shortcode in any page or post, or call <code>crovly_render()</code> and <code>crovly_verify()</code> in your theme templates.
<h3>External services</h3>
This plugin relies on the Crovly captcha service to function. It connects to two external endpoints:
1. Crovly Widget CDN (get.crovly.com)
The plugin loads the JavaScript widget from <code>https://get.crovly.com/widget.js</code> on any page that contains a protected form. The widget runs Proof of Work in the visitor’s browser and collects a hashed browser fingerprint.
<ul>
<li>When: Loaded on frontend pages that display a protected form (login, register, comment, checkout, etc.)</li>
<li>What is sent: Standard HTTP request headers (IP address, user agent). No personal data.</li>
<li>Terms of Service: <a href="https://crovly.com/terms" rel="nofollow ugc">https://crovly.com/terms</a></li>
<li>Privacy Policy: <a href="https://crovly.com/privacy" rel="nofollow ugc">https://crovly.com/privacy</a></li>
</ul>
2. Crovly Verification API (api.crovly.com)
When a visitor submits a protected form, the plugin sends the generated captcha token to <code>https://api.crovly.com/verify-token</code> for server-side verification.
<ul>
<li>When: On form submission of any form protected by Crovly.</li>
<li>What is sent: The captcha token (opaque string), the visitor’s IP address (for IP binding), and your Secret Key (for authentication).</li>
<li>What is received: A success/failure response indicating whether the token is valid.</li>
<li>Terms of Service: <a href="https://crovly.com/terms" rel="nofollow ugc">https://crovly.com/terms</a></li>
<li>Privacy Policy: <a href="https://crovly.com/privacy" rel="nofollow ugc">https://crovly.com/privacy</a></li>
</ul>
Both services are operated by Crovly. No data is shared with third parties. The plugin does not set cookies or track visitors across sites.

Crovly – Proof of Work Captcha & Spam Protection

Privacy-first, Proof of Work captcha for WordPress. No image puzzles, no tracking. 22+ integrations included.

RicheyWeb

HashCash – Proof of Work CAPTCHA

Invisible Proof-of-Work CAPTCHA. No checkboxes, no image grids, no Google, no tracking. Just spam protection that gets out of the way.

Crovly – Proof of Work Captcha & Spam Protection vs HashCash – Proof of Work CAPTCHA