About this plugin
CAPTCHAs interrupt every visitor to catch a few bots — and modern bots solve them anyway. useHUMA takes the opposite approach: it observes how a visitor behaves (mouse rhythm, typing cadence, scroll patterns, touch physics) and scores the probability that a real human is present. Real visitors feel nothing.
Bots get blocked.
What it protects:
- Comments — spam comments are rejected before they reach your moderation queue
- User registration — fake account signups are stopped at the door
- Contact Form 7 — form spam is invalidated on submission (if CF7 is installed)
Why site owners choose it:
- Invisible — no checkbox, no image puzzles, no friction for real visitors
- Privacy-first — zero PII: no keystroke contents, no names, no fingerprinting databases; only statistical aggregates of interaction patterns
- Fail-open by design — if the verification service is ever unreachable, your forms keep working
- Tells you when it was an AI agent — not just bot or human. Playwright, Puppeteer, browser extensions and computer-use agents come back with their own verdict, on every plan including the free one
- One setting — paste your API key and you’re protected
com. It is free and it stays free: every account starts with 14 days of the Starter plan and then settles on the Free plan, 1,000 verifications a month, for ever, no credit card. Most small sites never need more than that.
External services
com) to score form submissions. On each protected submission, the plugin sends: anonymous behavioral statistics collected on the page (timing variance of mouse/keyboard/scroll/touch interactions — never the contents of what was typed) and a pseudonymous identifier.
When the form provides an email address it is hashed on your server first, with a salt generated once and stored only in your own WordPress database, so the address itself never leaves your site and the hash cannot be reversed or matched against any other site. No other personal data is transmitted.
This service is provided by useHUMA: terms of service, privacy policy.