Roundup
Best CAPTCHA for WordPress and WooCommerce checkout in 2026
Short answer
For WordPress and WooCommerce, the main options are CaptchaKit, ALTCHA, Cloudflare Turnstile, hCaptcha, Friendly Captcha and Google reCAPTCHA. CaptchaKit's plugin is on wordpress.org and covers login, registration, comments and WooCommerce checkout (classic and Blocks) with an arcade game. ALTCHA and Turnstile suit sites that want no visible challenge.
Side by side
WordPress CAPTCHA options compared. Prices as of October 2026, from each vendor's own pages.
| Feature | CaptchaKit | ALTCHA | Cloudflare Turnstile | Friendly Captcha |
|---|---|---|---|---|
| Price | Pay what you want, one time | WordPress plugin: free plan; Professional EUR 18.90 a month; lifetime EUR 499; Agency EUR 119.90 a month | Free: 20 widgets, 10 hostnames per widget | EUR 9, 39 or 200 a month; free tier is non-commercial only |
| Visible to visitors | Yes, a short arcade game | No, proof of work in the background | Managed, non-interactive or invisible | No, proof of work |
| Login and registration | Yes Yes | Free plan covers login, registration and comments | Check the plugin you use | Check the plugin you use |
| WooCommerce checkout | Yes Yes, classic and Blocks | See ALTCHA's plugin plans | Check the plugin you use | Check the plugin you use |
| Comments | Yes Yes | Yes Yes on the free plan | Check the plugin you use | Check the plugin you use |
| Cookies | Privacy policy: no advertising or tracking cookies | Vendor states no cookies | Vendor states it processes only strictly necessary data | Vendor describes privacy-friendly proof of work |
| Accessible fallback | Yes In-widget question link and keyboard play | Vendor states WCAG 2.2 AA | Vendor states WCAG 2.2 AA | Check vendor accessibility page |
| Trial | Demo page for every game | 14-day trial on Professional | Free plan | 30-day free trial |
What to compare on a WordPress site
WordPress sites attack in predictable places: wp-login.php for brute force and credential stuffing, registration for fake accounts, comments for spam, and WooCommerce checkout for fake orders. A CAPTCHA plugin should cover the forms you actually have, and it should verify tokens on the server, not just in the browser.
Prices below come from vendor pages in October 2026. We cover what each vendor says about itself and mark what you should check in a plugin listing before installing.
CaptchaKit
The CaptchaKit plugin is on wordpress.org, version 1.0.1, and protects login, registration, comments and WooCommerce checkout (classic and Blocks). Install it from Plugins, Add New, search for CaptchaKit, then go to Settings, CaptchaKit, paste your site key and API key, and choose the forms and the game. Verification runs on your server through the plugin, so there is no code to write. A step-by-step is in how to replace reCAPTCHA on WordPress.
Visitors play a short game. The listed average play time ranges from 6 seconds to 20 seconds. Games such as Fruit Sorter are listed for e-commerce checkouts and Whack-a-Bot for login forms. A "Can't play? Accessible check" link switches to a screen-reader-friendly question, and all games play from the keyboard. Pricing is pay what you want. See pricing.
The others, briefly
ALTCHA lists a WordPress plugin with a free plan covering login, registration and comments, plus Professional at EUR 18.90 a month, a EUR 499 lifetime option and Agency at EUR 119.90 a month. Its core is open source (MIT).
Cloudflare Turnstile is free with unlimited challenges, up to 20 widgets and 10 hostnames per widget, and offers managed, non-interactive and invisible modes. Friendly Captcha is proof of work at EUR 9, EUR 39 and EUR 200 a month, with a free tier for non-commercial sites only. Google reCAPTCHA is free to 10,000 assessments a month per organization and sets a _GRECAPTCHA cookie.
For hCaptcha, Basic is $0 and Pro is $99 a month billed yearly or $139 monthly. Check the plugin listing for the forms each plugin covers before you commit.
How to choose
If you want no visible step on a WooCommerce checkout, choose an invisible option such as Turnstile or ALTCHA. If you want a visible challenge that shows off the brand, such as on a games, ticketing or community site, CaptchaKit is built for that. If your priority is the lowest price, Turnstile's free plan and ALTCHA's free WordPress plan are the starting points.
Whichever you pick, test four things after install: log in, register, post a comment and place a test order. Then check your cookie banner against the vendor's privacy statement. For CaptchaKit that is the privacy policy.
What CaptchaKit supports today
On the integrations page, WordPress is live and a custom-site embed (one script tag, one div, one server call) is live. Use the docs for custom themes and bespoke forms, or the plugin for standard WordPress and WooCommerce forms.
Setup checklist for any plugin
Back up the site. Install the plugin on a staging copy. Enter the keys. Enable only the forms you need. Test as a logged-out visitor on a phone and on a desktop. Check that caching plugins exclude the login, registration and checkout pages, because a cached page can serve a stale widget. Keep an admin session open in another browser while you test the login form.
After launch, watch failed logins, spam comments and abandoned checkouts for a week. If checkouts fall, try a shorter challenge or an invisible one on that form only.
WooCommerce specifics
WooCommerce has two checkout types, the classic shortcode checkout and the Blocks checkout. A CAPTCHA plugin should state which it supports. CaptchaKit lists both. Fake orders come in through checkout, so verify the token server side before the order is created, which the plugin does. Pick a short game for checkout, such as Tap in Order at a listed average of 6 seconds, or Fruit Sorter, which the docs list for e-commerce checkouts.
Alternatives
CaptchaKit
Best for: A visible, branded game on WordPress and WooCommerce
Price: Pay what you want, one time
Plugin version 1.0.1 on wordpress.org covers login, registration, comments and WooCommerce checkout, classic and Blocks. Site key and API key go in Settings, CaptchaKit.
- Checkout, login, comments and registration covered
- Accessible question link and keyboard play
- No advertising or tracking cookies per the privacy policy
ALTCHA
Best for: Proof of work with an open-source core
Price: WordPress plugin free plan; Professional EUR 18.90 a month
The free WordPress plan covers login, registration and comments. Paid WordPress plans add features, with a EUR 499 lifetime option and an Agency plan at EUR 119.90 a month.
- MIT core
- Free WordPress plan
- 14-day Professional trial
Cloudflare Turnstile
Best for: A free plan with invisible mode
Price: Free, up to 20 widgets
Managed, non-interactive or invisible widgets with unlimited challenges on the free plan and 7-day analytics.
- Unlimited challenges
- Invisible mode
- Works without proxying through Cloudflare
Friendly Captcha
Best for: EU-based proof of work
Price: EUR 9 to EUR 200 a month
Starter covers 1 protected domain and 1,000 requests a month, and there is a 30-day free trial. The free tier is for non-commercial sites only.
- No image tasks
- 30-day trial
- Tiers by domains and requests
hCaptcha
Best for: A free tier from a privacy-positioned vendor
Price: Basic $0, Pro $99 or $139 a month
Basic is free. Pro adds passive mode, themes and analytics, with a 14-day trial.
- Free Basic plan
- Text accessibility challenge
- Pro trial without payment
Google reCAPTCHA
Best for: Sites already on Google Cloud
Price: Free to 10,000 assessments a month, then $8 flat
Essentials is free up to 10,000 assessments a month per organization. Premium is $8 flat for 10,001 to 100,000, then $1.00 per 1,000.
- iOS and Android SDKs
- Large plugin ecosystem
- Policy engine on higher tiers
Questions
What is the best CAPTCHA for WooCommerce checkout?
It depends on whether you want a visible step. CaptchaKit's plugin protects WooCommerce checkout with a game, classic and Blocks. Turnstile and ALTCHA run with little or no visible step.
Does CaptchaKit work with WooCommerce Blocks checkout?
Yes. The integrations page says WooCommerce checkout is supported, classic and Blocks.
Which WordPress forms does CaptchaKit protect?
Login, registration, comments and WooCommerce checkout.
Do I need to write code?
No for standard WordPress forms. The plugin handles server-side verification. Custom theme forms use the embed from the docs.
Is there a free CAPTCHA plugin for WordPress?
Turnstile has a free plan and ALTCHA's WordPress plugin has a free plan. CaptchaKit is pay what you want.
Will it add cookies?
CaptchaKit's privacy policy says no advertising or tracking cookies are used. Check each vendor's policy for the rest.
Should I protect checkout with a game?
It depends on your audience and attack level. A short game is visible. If checkout conversion is your top concern, test an invisible option against it.
Sources
- CaptchaKit on WordPress.org (checked 2026-10-17)
- CaptchaKit integrations (checked 2026-10-17)
- CaptchaKit documentation (checked 2026-10-17)
- CaptchaKit pricing (checked 2026-10-17)
- CaptchaKit privacy policy (checked 2026-10-17)
- ALTCHA pricing (checked 2026-10-17)
- Cloudflare Turnstile plans (checked 2026-10-17)
- Friendly Captcha plans (checked 2026-10-17)
- hCaptcha pricing (checked 2026-10-17)
- Google reCAPTCHA tier comparison (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.