About this plugin
InfoPeak Captcha stops bots without bothering your visitors and without sending their data to the US.
Instead of tracking visitors or making them click traffic lights, it uses proof-of-work: the visitor’s browser solves a small computational challenge in the background, the moment they start filling in a form. Bots pay a CPU cost that makes mass abuse expensive; humans wait a fraction of a second and never see a puzzle.
Why site owners choose it
- No personal data leaves the EU. The service is hosted entirely in the EU. No US transfer, no CLOUD Act exposure.
- No cookies, no tracking. Nothing to declare in your cookie banner for the captcha.
- Nothing to solve. No image grids, no distorted text, nothing to click. Fully accessible by design.
- Free plan. 10,000 verifications per month at no cost.
What this plugin protects
- Login form
- Registration form
- Lost-password form
- Comment form (with an option to skip logged-in users)
- Contact Form 7 forms
- WPForms forms
- Jetpack Forms (the contact form built into Jetpack)
- WooCommerce checkout (classic checkout)
Each can be toggled individually on the settings page. The widget is added to your forms automatically, so there is nothing to edit in Contact Form 7, WPForms, Jetpack Forms or WooCommerce.
Setup takes two minutes
- Create a free sitekey and secret at infopeak.io/captcha
- Paste them into Settings → InfoPeak Captcha
- Done – the widget appears on your forms and verification happens automatically
You can try the plugin first with the public test credentials ipk_test_sitekey / ipk_test_secret – they work on any domain and never count against a quota.
External services
This plugin relies on the InfoPeak Captcha service to do its job. The service is operated by InfoPeak and hosted entirely in the EU.
It is used for two things:
- Loading the captcha widget. The script https://captcha.infopeak.io/infopeak-captcha.js is loaded in the visitor’s browser on the pages where a protected form appears. The browser then requests a challenge and submits the solved proof of work. This sends the site’s public sitekey and the computed solution. No cookies are set and no visitor is tracked.
- Verifying submissions. When a protected form is submitted, your server sends the captcha token together with your sitekey and secret to https://captcha.infopeak.io/api/v1/pow/siteverify and receives back whether the token is valid. Nothing about the visitor is included.
No personal data about your visitors is stored by the service. See the privacy policy and the terms of service.