Free WordPress plugin replaces CAPTCHAs with invisible adaptive proof-of-work

An anti-spam check visitors never see

A WordPress plugin that replaces CAPTCHAs with an invisible, adaptive proof-of-work challenge has been showcased in a Show HN post on Hacker News. According to the plugin's directory listing, when a visitor submits a form, their browser quietly solves a small cryptographic puzzle within milliseconds. There is no checkbox to tick, no image grid to decode and nothing to click — legitimate users simply press Send, while spam bots either fail the challenge or must spend enough processing power on every message that mass-posting stops paying off.

One plugin for every form

The plugin covers WordPress core forms — login, registration, password reset and comments — plus WooCommerce checkout and product reviews, and it ships pre-configured for a long list of builders: Contact Form 7, WPForms, Elementor Pro Forms, Gravity Forms, Ninja Forms, Fluent Forms, Formidable and dozens of others.

The claimed difference from typical anti-spam tools is that it does not rely on integrations with specific form plugins. Instead, it recognizes submissions by a signature — the recognizable pattern of fields and actions in the request. For unrecognized forms, including hand-coded ones and legacy themes, a "direct analysis mode" lets an administrator submit the form once and save the detected signature, with no code required. Because nothing hooks into a builder's internals, the developer argues, form plugin updates cannot break the protection.

Difficulty that scales with attacks

The challenge is adaptive. While a spam wave is running, an under-attack mode automatically makes the puzzle harder for everyone and eases off afterwards. Site owners can choose what happens to flagged submissions: block them, deliver them marked as spam, or park them in a spam inbox for review. Login forms also get brute-force protection, with optional Fail2Ban log support.

Self-contained, no third-party service

Everything runs on the site's own server. There is no account to create, no API key to paste in and no external call for the spam check, which the listing frames as both an operational and a privacy advantage: no outside service can suffer an outage, rate limit or latency spike that silently breaks forms, and no remote scripts are loaded, leaving page-speed metrics untouched. The client-side code is a few kilobytes and, per the developer, the plugin uses no cookies, no sessions and no tracking, storing IP addresses only as hashes — a setup described as GDPR-friendly without a consent banner.

The listing also positions the plugin against existing tools: reCAPTCHA, hCaptcha and Cloudflare Turnstile need accounts, load external scripts and still occasionally challenge real users; Akismet sends submission content to an external service and requires a subscription for commercial sites; honeypot fields and time checks are routinely bypassed by modern bots. Proof-of-work, by contrast, targets the cost side of spamming rather than trying to tell humans and bots apart. These comparisons come from the developer's own description and are not independently verified.

Known limits

The listing is candid about one boundary: forms hosted elsewhere and merely embedded on a WordPress page — Typeform, Jotform, Zoho Forms, HubSpot and similar — send their data directly to those services, so the submission never reaches WordPress and no plugin can inspect it. Certain checkout and registration forms are recognized and logged, but blocking them is a separate switch that ships off by default. The plugin is free and the current release is version 6.2.0.

Why it matters

Every CAPTCHA interaction taxes real people, and each abandoned puzzle is a lost contact or sale. Proof-of-work inverts the arrangement: instead of humans proving their humanity, the device pays a moment of computation that is trivial for a single visitor but expensive at bot scale. The approach also sidesteps the privacy plumbing that cloud CAPTCHAs drag along — third-party scripts, consent banners and data flows to external processors. The open question is durability: a bot running a full browser can execute JavaScript and solve the challenge too, so the defense is fundamentally economic rather than absolute, and real-world effectiveness against well-funded automation will only become clear in production. For WordPress sites juggling several form builders, the signature-based model — one tool protecting the whole site, with custom forms added in under a minute — is a pragmatic answer to plugin sprawl on its own.