Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress
wordpress.orgWhen I founded my business a whistle-blowing-service for enterprises, I’ve seeked for a working solution to block spam bots on that home page. The solution was intended to comply with EU data privacy law, no cookies, no sniffing, light-weight-size, on my webserver only, beeing invisible for my site visitors and no running costs at all.
I came across Hashcash, a proof-of-work approach, to block spam. When I implemented it, it worked immediately and blocked 100 percent without blocking any incoming real posts.
I was astonished, that no solution existed in the ecosystem allready that covered all forms and was for free. Therefore I‘ve turned it into a free wordpress-plugin.
It is not only a technical solution, but starts with the business model of spam (mass spamming at low cost), by producing a calculation effort for every single post, that unavoidable. And therefore is not exactly unbreakable but becomes very expensive for the spammer and therefore alows only for targeted high quality approaches that need other treatment. Up to now my own page remains spam free and users report the same.
Now, running since 2022 on 4000+ active installations, it is working with almost every webform and plugin combination that is running on any wordpress instance, using pattern recognition on http-post-level instead of specific proprietary integration for single specific form builders. It ships with 80+ starting patterns for the most relevant form builders and themes, but can be enhanced with any pattern by the user.
The plugin can be previewed directly and immediately on wordpress.org. It ships with14 KB compressed under a GPL-2.0 license.
I’m looking forward to discuss about the proof-of-work approach, form detection, privacy implications, and tradeoffs.
Interesting to note that the original invention of Proof Of Work was motivated by anti-spam in particular ("Pricing via Processing or Combatting Junk Mail" Dwork & Naor, Advances in Cryptology — CRYPTO' 92).
Hmmmm. Is this the compute economy that Altman was going on about.
https://trycap.dev/ existed the whole time, and does not need wordpress.
Yes it is an piece that you can integrate on every form by hand if you are a coder. The plugin is addressed to people who aren't coding and thus are using Wordpress. It secures all forms of your page at once even for third party form builders and themes.
Since June 2026 there exists a WordPress integration, but it covers only a few forms and requires for an additional service.
But yes, if you don't use Wordpress and develop your page on your own, Cap may be a good choice.