Use hCaptcha for WordPress to Block Bots on the Login Page

Spambots and other automated scripts constantly probe the internet looking for weaknesses in WordPress websites. hCaptcha for WordPress is designed to identify these bots and prevent them from accessing your site.

In this post you'll learn all about hCaptcha for WordPress and see how it fits into the overall strategy for securing the login area on your website.

What is a Turning Test, CAPTCHA and hCaptcha?

Before we begin, let's define a few things.

The Turing test

The Turing test was first proposed by English mathematician and computer scientist Alan Turing in 1950 to determine if machines could think. In this test, a human evaluator judges whether answers to natural-language questions are from a human or a machine.

CAPTCHA

CAPTCHA is an acronym for Completely Automated Public Turing test to tell Computers and Humans Apart. A typical CAPTCHA is a distorted image of a word. Correctly deciphering the word is the challenge for the user.

In this case, a computer administers the CAPTCHA to a human. This is called a reverse Turing test.

reCAPTCHA is a popular CAPTCHA implementation where challenge words originally came from digitized books. Assembling the solved challenges helped digitize books until it was

Google acquired reCAPTCHA in 2009 and repurposed it to identify images.

hCaptcha

Developed in 2017, hCaptcha is a privacy-focused alternative to reCAPTCHA. Like its predecessors, hCaptcha protects websites from spambots and other automated tools.

In this case, the Turing test requires site visitors to read a phrase and select specific images from a set of similar imagines. For example, the test may begin with a gallery of nine images of random vehicles. A successful Turing test would require the user to select only the trains from the other vehicles.

Notably, websites that use hCaptcha can earn revenue online by solving CAPTCHAs.

hCaptcha for WordPress

hCaptcha for WordPress is a free plugin that has been available on the WordPress repository since 2019. Once installed and configured, the plugin will present the hCaptcha Turing test on the the WordPress login page.

Obtaining the hCaptcha keys

Before proceeding, be sure you have created a free hCaptcha account and logged into the hCaptcha website. Once logged in:

1. Click the Sites link in the top menu then click the New Site button.
2. Add a Name and Domain for the site. The remaining defaults should be fine as shown below.
3. Click the Save button to complete the site addition and return to the Sites area where your new site should be listed.
4. Click the Settings button for the new site. Copy the Sitekey for use below.
5. At the top-right, click your profile icon and then click Settings. Copy the Secret key for use below.

Installing the plugin

To install the plugin:

1. Login to your WordPress backend using an account with administrator privileges.
2. One the left sidebar choose Plugins > Add new.
3. Search the available plugins for hCaptcha for WordPress.
4. Once located in the search results, click the Install and then the Activate buttons.

Configuring the plugin

To configure the plugin:

1. One the left sidebar choose Settings > hCaptcha.
2. Enter the Sitekey and Secret key you saved from the hCaptcha website (above).
3. Select Enable hCaptcha on Login Form.
4. Scroll to the bottom and click the Save button.

Using the hCaptcha for WordPress plugin

If everything is set up correctly, you should now see the hCaptcha challenge similar to that shown below. Clicking the I am human select box triggers the Turing test.

If you are getting a lot of failed login attempts or a lot of traffic on your login page, consider using the hCaptcha plugin. Be sure to warn any administrators of the change as some legitimate users may be surprised and confused by the extra login steps required.