Using hCaptcha on a WordPress contact form

Setting it up

1. Create an account at hCaptcha and add a site with your domain.
2. Copy the site key for that site, and the secret from your account settings.
3. Paste both into your form plugin's CAPTCHA settings.

How the check runs

The hCaptcha script, loaded from js.hcaptcha.com, shows the checkbox and produces a token. When the form is sent, your server passes the token and your secret to api.hcaptcha.com, which answers whether it was solved. Like every CAPTCHA, it means a third party sees your visitors' browsers — mention it in your privacy policy.

In Mailbag Contact Form

Choose hCaptcha under Mailbag → Settings → Spam and paste your keys; the secret is masked once saved. The script loads only on pages with a form.

If the visitor hasn't solved the challenge, Mailbag asks them to confirm they're human and press Send again, keeping what they typed. If hCaptcha can't be reached, the entry is accepted and marked unverified rather than lost. If hCaptcha rejects your secret, Mailbag doesn't blame the visitor: entries are taken in without the check, and a notice tells you to correct the key. The honeypot, time trap and per-address limit run throughout.

hCaptcha, Turnstile or reCAPTCHA?

• hCaptcha — a visible checkbox, sometimes a puzzle; independent of the big ad companies.
• Turnstile — usually no puzzle at all; run by Cloudflare. See Turnstile.
• reCAPTCHA v3 — invisible, gives a score instead of a yes or no. See reCAPTCHA v3.

All three are optional in Mailbag. Many sites need none of them: the built-in checks stop the everyday bots on their own.