Six challenges in one plugin, and the checks that run before them
The five plugins below are the most-installed CAPTCHA plugins on WordPress.org. They are mature, well rated and, between them, running on more than half a million sites. This is where CaptchaFlow is different — not where they are bad.
How to read this. Every figure about another plugin was taken from its own WordPress.org listing on 15 August 2026. A dash means the capability is not mentioned on their listing — not that it is missing. We do not have their source code, so we do not get to say what they cannot do.
| Capability | CaptchaFlow | Advanced reCAPTCHA | Simple Turnstile | BestWebSoft reCaptcha | CAPTCHA 4WP | hCaptcha for WP |
|---|---|---|---|---|---|---|
| Challenge types | ||||||
| Cloudflare Turnstile | — | |||||
| Google reCAPTCHA v2 | ||||||
| Google reCAPTCHA v3 Scored, invisible, no click | ||||||
| hCaptcha | — | |||||
| Self-hosted Math challenge No account, no third party, nothing leaves the site | — | — | — | — | ||
| Self-hosted Question challenge Your own question and answers | — | — | — | — | ||
| Switch provider without reinstalling All six live in one plugin, changed from a dropdown | — | — | ||||
| Spam checks that are not a CAPTCHA | ||||||
| Honeypot field Name rotates per page load, so it cannot be learned once | — | — | — | — | — | |
| Timing trap Submissions faster than a person could read the form | — | — | — | — | — | |
| Runs before the provider is contacted Obvious bots cost you no API call | — | — | — | — | — | |
| Still protects if the provider is down Honeypot and timing keep running either way | — | — | — | — | — | |
| Privacy and data | ||||||
| Works with no third-party service at all Choose a self-hosted challenge and nothing is called | ||||||
| IP addresses shortened before they are logged | — | — | — | — | — | |
| Export and erase wired into WordPress privacy tools | — | — | — | — | — | |
| Privacy-policy text generated from your own settings | — | — | — | — | — | |
| Running it | ||||||
| Cache-safe No visitor-specific data written into page HTML | — | — | — | — | — | |
| Log of what was blocked, and why | — | — | — | — | ||
| Setup wizard and one-click diagnostics | — | — | — | — | — | |
| Protects forms added to the page after it loads Popups, modals, AJAX tabs | — | — | — | — | — | |
| Currency of the plugin | ||||||
| Last updated | 15 Aug 2026 | 18 Jul 2026 | 27 Jul 2026 | 24 Apr 2026 | 11 Jun 2025 | 6 Aug 2026 |
| Tested up to WordPress | 7.0 | 7.0.4 | 7.0.4 | 7.0.4 | 6.8.8 | 7.1 |
| Rating on WordPress.org CaptchaFlow was published on 14 August 2026 and has no reviews yet | No reviews yet | 4.8 / 5 (430) | 4.7 / 5 (251) | 3.9 / 5 (391) | 3.2 / 5 (269) | 4.6 / 5 (86) |
Figures read from WordPress.org on 15 August 2026. Plugin names and trade marks belong to their owners; they are used here to identify the plugins being compared and nothing more. Spotted something out of date or wrong? Tell us and we will correct it.
The short version
Every plugin above is built around one challenge. Pick it and you have picked your provider — changing your mind later means swapping plugins and reconfiguring every form.
CaptchaFlow carries all six and switches between them from a dropdown, including two that need no account and call nobody: useful if you are in a market where Google is slow or blocked, or you simply do not want a third party watching your visitors.
And underneath whichever you choose, a honeypot and a timing trap run on every submission before the provider is contacted — so obvious bots never cost you an API call, and your forms stay protected on the day the provider has an outage.