About this plugin
HashCash stops spam by making the visitor’s browser do the work — not the visitor.
While your user fills out a form, HashCash runs a cryptographic proof-of-work calculation silently in the background. By the time they hit Submit, the work is done. No checkbox to click.
No images to identify. No third-party service watching over their shoulder.
This is the WordPress port of a Joomla plugin with a 12-year track record — originally released three years before Google launched reCAPTCHA v3. The core idea hasn’t changed: spam protection should be invisible to real users and brutal to bots.
What makes HashCash different:
- No third-party services. No reCAPTCHA, no hCaptcha, no Cloudflare Turnstile. Nothing phones home.
- No tracking, no cookies. GDPR and CCPA friendly by design, not by policy.
- Nothing for users to solve. A brief “Securing this form…” indicator appears while the calculation runs — that’s it. No puzzles, no clicks, no friction.
- Logged-in users are exempt. Trusted users never see the indicator at all.
- Adjustable difficulty. SHA-256 at level 1 by default for maximum compatibility. Argon2id available for sites that need state-of-the-art memory-hard hashing.
- Bot punishment mode. Suspicious behavior triggers difficulty so high the proof-of-work becomes computationally unsolvable. The bot spins forever. Legitimate users never notice.
- Automatic protection. Works out of the box on WordPress comments, login, registration, lost password, and Contact Form 7. No configuration required.
Supported hash algorithms:
* SHA-256 (default — fast, broadly compatible)
* SHA-384 / SHA-512
* PBKDF2
* PBKDF2 (64KB)
* Argon2id (recommended for maximum security — requires PHP sodium extension)
Works automatically with:
* WordPress comment forms
* WordPress login form
* WordPress registration form
* WordPress lost password form
* Contact Form 7
Add to any other form:
Use the shortcode [hashcash] to add protection to any form on your site.
Support
For support, feature requests, or custom integrations:
com/
HashCash for WordPress is maintained by Michael Richey — author of the original Joomla HashCash plugin, with over 12 years of proof-of-work CAPTCHA development.