wenstondev

<ul>
<li>Image CAPTCHA rendered with PHP GD (same character set and drawing approach as common self-hosted implementations).</li>
<li>Stores the challenge using WordPress transients and a form token; does not rely on PHP sessions.</li>
<li>Shortcode <code>[wenstoncaptcha]</code> for pages and custom forms.</li>
<li>Contact Form 7: add a <code>wenstoncaptcha</code> form tag (for example <code>[wenstoncaptcha your-captcha]</code>).</li>
<li>Translations included: Bulgarian, Czech, Danish, German, Spanish, Finnish, French, Greek, Italian, Polish, Russian, Swedish, Ukrainian (see <code>languages/</code>).</li>
</ul>


wenstonCaptcha

Self-hosted image CAPTCHA for WordPress. No third-party services or external requests. Privacy-first CAPTCHA. GDPR compliant.

captchaapi

<p>Protects WooCommerce (login, registration, lost password, checkout), Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Forminator, Gravity Forms and Elementor Forms – cookieless, EU-hosted, no cookie banner required.</p>
<p>A privacy-first alternative to reCAPTCHA: captchaapi.eu stops form spam without making your visitors click traffic lights. A free tier with commercial use allowed gets you started. The work happens in the background: the visitor’s browser solves a small proof-of-work puzzle while they fill in the form, and a token rides along with the submission. There is nothing to solve and nothing to see.</p>
<p>When a form is submitted, your server confirms that token with captchaapi.eu over a single request, secured by your secret key. It is the same model every hosted CAPTCHA uses, and it keeps the secret on your server, never in the browser.</p>
<h4>Privacy by design</h4>
<ul>
<li>No cookies, and nothing to add to a cookie banner.</li>
<li>No tracking and no visitor profile. The IP address is used only for rate limiting and abuse detection, then dropped; it is never written to a database.</li>
<li>Hosted only in the EU, in Nuremberg, Germany. No data leaves the EU.</li>
<li>No images and no puzzles to solve. The check runs in the background, so it works the same for every visitor, including people who find image challenges difficult or browse with a screen reader.</li>
<li>A free tier, with commercial use allowed.</li>
</ul>
<h4>Forms and plugins it protects</h4>
<p>WordPress core:</p>
<ul>
<li>Login (wp-login.php)</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Checkout</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Fluent Forms</li>
<li>Formidable Forms</li>
<li>Forminator</li>
<li>Gravity Forms</li>
<li>Elementor Forms</li>
</ul>
<p>Each form can be turned on or off from the settings screen. The WooCommerce and form-plugin options appear only when that plugin is active.</p>
<h4>How it works</h4>
<ol>
<li>The widget loads on the pages with a protected form and solves a proof-of-work puzzle in a Web Worker.</li>
<li>On submit, it attaches the resulting token to the form.</li>
<li>The plugin confirms the token with captchaapi.eu using your secret key and rejects the submission if the service does not accept it.</li>
</ol>
<p>Each token verifies exactly once – the service enforces single use – so the plugin keeps no local replay table and nothing to clean up on a schedule.</p>
<h4>You need an account</h4>
<p>This plugin connects to the captchaapi.eu service. Create a project at https://captchaapi.eu to get a site key and a secret key. A free tier is available.</p>
<h3>External services</h3>
<p>This plugin connects to captchaapi.eu, a third-party CAPTCHA service, to protect your forms from spam. It is required for the plugin to function.</p>
<p>On any public page that contains a protected form, the plugin loads the service’s widget script (captcha.js) from your configured captchaapi.eu endpoint. The visitor’s browser then communicates with the captchaapi.eu API to perform a proof-of-work challenge and obtain a token that is attached to the form on submit. This happens for every visitor who loads a protected form.</p>
<p>To issue and validate a token the service receives your public site key, the proof-of-work result, and – as with any HTTP request – the visitor’s IP address. The IP address is used for rate limiting and abuse/bot detection (including a coarse, IP-derived country) and is processed transiently: a hashed form and aggregate counters are held briefly in a cache. No raw IP address and no per-visitor record are written to a database. The service sets no cookies. Data is processed on servers in the EU (Nuremberg, Germany).</p>
<p>When a protected form is submitted, your server sends the token to the captchaapi.eu /verify endpoint, authenticated with your secret key, and trusts the service’s accept-or-reject answer. The secret key stays on your server and is never sent to the browser.</p>
<ul>
<li>Service provider: captchaapi.eu</li>
<li>Terms of Service: https://captchaapi.eu/legal/terms</li>
<li>Privacy Policy: https://captchaapi.eu/legal/privacy</li>
</ul>


GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu

Cookieless, EU-hosted reCAPTCHA alternative for WooCommerce, WPForms, Fluent Forms & CF7. GDPR-clean, no cookie banner.

wenstonCaptcha vs GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu