Free WordPress CAPTCHA Plugin
If your WordPress site is sending spam emails, your contact form is filling with junk submissions, or your comments are disabled and you're still getting spam — the fix is to stop the bot before it submits. Prosopo Procaptcha is a free WordPress CAPTCHA plugin that blocks bot form submissions across 16 popular form plugins — Contact Form 7, Gravity Forms, WPForms, Ninja Forms and more.
10,000 verifications a month free, GDPR-compliant by design, no cookies, no tracking, and a drop-in replacement for reCAPTCHA. See pricing →
Already using Akismet? Procaptcha is the upgrade.
Akismet (the WordPress anti-spam plugin from Automattic) is a content classifier — it reads the text of a submission and guesses whether it's spam. That worked for blog comments selling watches in 2008. In 2026, it fails three ways:
- AI-written spam slips through. Modern bots write contact-form messages that read like real enquiries — no keyword filter catches them.
- It can't help non-comment forms. Signup forms, newsletter forms and contact forms have no "content" to classify — Akismet has nothing to score.
- It's reactive. By the time Akismet runs, the bot has already submitted, your server has already processed, and your downstream tools (autoresponders, CRM, Slack) have already fired.
Procaptcha blocks the bot, not the text — so it works on every form, against every spam pattern, before any of your tools see the submission. The free tier covers 10,000 verifications per month, which is more than most WordPress sites will ever need.
WordPress plugin integrations
Step-by-step install guides for stopping spam on every major WordPress form plugin:
How to add CAPTCHA to MemberPress
How to add CAPTCHA to Beaver Builder
How to add a free CAPTCHA to WPForms
How to add CAPTCHA to User Registration Plugin
How to add CAPTCHA to Ninja Forms
How to add CAPTCHA to Jetpack
Gravity Forms Spam Protection: How to Stop Spam Submissions
How to add CAPTCHA to Formidable Forms
How to add CAPTCHA to Fluent Forms
How to add CAPTCHA to Everest Forms
How to Add a CAPTCHA to Contact Form 7 in 2026 (Free reCAPTCHA Alternative)
How to add CAPTCHA to bbPress
Why your WordPress site is sending spam emails
If your WordPress site is suddenly sending spam emails, even with comments disabled, Akismet running and a fresh admin password, the cause is almost always one of:
- A vulnerable contact form being abused by a bot to send spam through your site's mail server.
- A compromised plugin or theme with a known security vulnerability.
- An exposed signup endpoint bots use to register accounts and then post spam.
Procaptcha addresses the first and third. By putting an invisible CAPTCHA between the bot and your form, the spam stops at the door. For the second, audit your installed plugins and keep them updated.
How to prevent spam on a WordPress contact form
Every WordPress form is a potential spam target. Contact Form 7 alone sits on more than five million sites, so scraper bots specifically probe for its markup and submit thousands of forms per hour looking for a way through. Stopping that traffic in WordPress usually means one of three approaches:
- Honeypot fields. Add a hidden input a human never fills in. Bots that submit everything fill it and get blocked. Works against unsophisticated spam but misses anything that reads the form structure first, which most modern spam frameworks do.
- Math CAPTCHAs. Ask the visitor to solve What is 3 + 5? before the form will submit. Plugins like Really Simple CAPTCHA and CF7's built-in math field take this approach. Free and simple to add, but modern solvers handle basic arithmetic in milliseconds, and the friction lands on the human user rather than the bot.
- Behavioural CAPTCHA like Procaptcha. Verifies the visitor is human on invisible signals (cursor movement, timing, TLS fingerprint) and only shows a visible challenge when something looks off. Real users see nothing; bots get stopped at the door. Free tier covers 10,000 submissions a month.
The per-plugin how-to guides above cover installing Procaptcha on each of the major WordPress form plugins. If Contact Form 7 is what you use, the CF7 guide replaces the built-in math CAPTCHA with the Procaptcha widget in about five minutes.
Free WordPress spam protection compared
Most WordPress sites don't need to pay for spam protection. The comparison is really between the free options:
| Free option | What it does | Where it falls short |
|---|---|---|
| Akismet (free tier) | Comment-content classifier | AI-written contact-form spam slips through; nothing to score on non-comment forms |
| Honeypot plugins | Hidden field trap | Any bot that inspects the DOM first (most of them) skips the hidden input |
| Math CAPTCHA / Really Simple CAPTCHA | Arithmetic challenge on every submit | Friction lands on humans; solvers get past the arithmetic |
| reCAPTCHA v3 (free) | Google behavioural scoring | Third-party cookies, US data processing, needs a cookie-banner entry under the ePrivacy Directive |
| Procaptcha (free tier) | Invisible behavioural CAPTCHA | 10,000 verifications a month; enough for most WordPress sites |
If you already run reCAPTCHA on the site and want to move off it for GDPR reasons, our guide on choosing a GDPR-friendly WordPress CAPTCHA walks through the switch.
What about "hidden" CAPTCHAs?
Google's reCAPTCHA v3 is often called a "hidden" or "invisible" CAPTCHA because there is no visible challenge for the user. It runs behavioural analysis in the background and returns a risk score to your server. Procaptcha does the same job on the client side, without the Google tracking cookies. See how invisible CAPTCHAs work for the mechanics, and the Contact Form 7 install guide for a walk-through of setting Procaptcha up in "invisible" mode on WordPress.
Free bot protection for WordPress forms
The official Procaptcha WordPress plugin gives you free bot protection for any form on your site: 10,000 verifications per month, no cookies, no tracking, full GDPR compliance. That stops the automated form submissions behind most WordPress comment spam, contact-form junk and fake registrations, before they ever reach your database.
It does not include email spam domain filtering, which sits at a different layer (the address the user enters, rather than whether a human is submitting the form). That is on the Professional plan under Advanced spam email protection, alongside device and IP reputation rules, higher verification limits and 99.9% uptime. If you are having trouble getting Procaptcha working on a specific WordPress form, use Prosopo Support and include the URL where the issue is happening.
For the full picture see our spam bot protection use case.
