Louis

<p>Brute-force attacks are common on your WordPress login page if not dealt with properly. Googles reCaptcha is a great candidate for handling this issue.</p>
<p>Major features in WP reCaptcha Login include:</p>
<ul>
<li>Utilizes reCaptcha V3 (no checking on boxes to prove you’re not a robot).</li>
<li>Quick Setup. Just add your reCaptcha Site Key and Secret key by going to Settings > Recaptcha Settings. </li>
</ul>
<p>Note:<br />
You’re reCaptcha keys can be obtained from https://www.google.com/recaptcha/</p>


WP reCaptcha Login

License: GPLv2 or later This plugin uses reCaptcha V3 to add an extra layer of security at your login screen, preventing brute-force attacks.

captchaapi

<p>Protects WooCommerce (login, registration, lost password, checkout), Contact Form 7, WPForms, Fluent Forms, Formidable Forms, Forminator, Gravity Forms and Elementor Forms – cookieless, EU-hosted, no cookie banner required.</p>
<p>A privacy-first alternative to reCAPTCHA: captchaapi.eu stops form spam without making your visitors click traffic lights. A free tier with commercial use allowed gets you started. The work happens in the background: the visitor’s browser solves a small proof-of-work puzzle while they fill in the form, and a token rides along with the submission. There is nothing to solve and nothing to see.</p>
<p>When a form is submitted, your server confirms that token with captchaapi.eu over a single request, secured by your secret key. It is the same model every hosted CAPTCHA uses, and it keeps the secret on your server, never in the browser.</p>
<h4>Privacy by design</h4>
<ul>
<li>No cookies, and nothing to add to a cookie banner.</li>
<li>No tracking and no visitor profile. The IP address is used only for rate limiting and abuse detection, then dropped; it is never written to a database.</li>
<li>Hosted only in the EU, in Nuremberg, Germany. No data leaves the EU.</li>
<li>No images and no puzzles to solve. The check runs in the background, so it works the same for every visitor, including people who find image challenges difficult or browse with a screen reader.</li>
<li>A free tier, with commercial use allowed.</li>
</ul>
<h4>Forms and plugins it protects</h4>
<p>WordPress core:</p>
<ul>
<li>Login (wp-login.php)</li>
<li>Registration</li>
<li>Lost password</li>
<li>Comments</li>
</ul>
<p>WooCommerce:</p>
<ul>
<li>Login</li>
<li>Registration</li>
<li>Lost password</li>
<li>Checkout</li>
</ul>
<p>Form plugins:</p>
<ul>
<li>Contact Form 7</li>
<li>WPForms</li>
<li>Fluent Forms</li>
<li>Formidable Forms</li>
<li>Forminator</li>
<li>Gravity Forms</li>
<li>Elementor Forms</li>
</ul>
<p>Each form can be turned on or off from the settings screen. The WooCommerce and form-plugin options appear only when that plugin is active.</p>
<h4>How it works</h4>
<ol>
<li>The widget loads on the pages with a protected form and solves a proof-of-work puzzle in a Web Worker.</li>
<li>On submit, it attaches the resulting token to the form.</li>
<li>The plugin confirms the token with captchaapi.eu using your secret key and rejects the submission if the service does not accept it.</li>
</ol>
<p>Each token verifies exactly once – the service enforces single use – so the plugin keeps no local replay table and nothing to clean up on a schedule.</p>
<h4>You need an account</h4>
<p>This plugin connects to the captchaapi.eu service. Create a project at https://captchaapi.eu to get a site key and a secret key. A free tier is available.</p>
<h3>External services</h3>
<p>This plugin connects to captchaapi.eu, a third-party CAPTCHA service, to protect your forms from spam. It is required for the plugin to function.</p>
<p>On any public page that contains a protected form, the plugin loads the service’s widget script (captcha.js) from your configured captchaapi.eu endpoint. The visitor’s browser then communicates with the captchaapi.eu API to perform a proof-of-work challenge and obtain a token that is attached to the form on submit. This happens for every visitor who loads a protected form.</p>
<p>To issue and validate a token the service receives your public site key, the proof-of-work result, and – as with any HTTP request – the visitor’s IP address. The IP address is used for rate limiting and abuse/bot detection (including a coarse, IP-derived country) and is processed transiently: a hashed form and aggregate counters are held briefly in a cache. No raw IP address and no per-visitor record are written to a database. The service sets no cookies. Data is processed on servers in the EU (Nuremberg, Germany).</p>
<p>When a protected form is submitted, your server sends the token to the captchaapi.eu /verify endpoint, authenticated with your secret key, and trusts the service’s accept-or-reject answer. The secret key stays on your server and is never sent to the browser.</p>
<ul>
<li>Service provider: captchaapi.eu</li>
<li>Terms of Service: https://captchaapi.eu/legal/terms</li>
<li>Privacy Policy: https://captchaapi.eu/legal/privacy</li>
</ul>


GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu

Cookieless, EU-hosted reCAPTCHA alternative for WooCommerce, WPForms, Fluent Forms & CF7. GDPR-clean, no cookie banner.

WP reCaptcha Login vs GDPR Cookieless CAPTCHA for WooCommerce & Forms – captchaapi.eu