What Is hCaptcha? How It Works, What It Costs and How It Compares (2026) - DEUTSCH

hCaptcha is a CAPTCHA service from Intuition Machines that tells people from bots, and Cloudflare chose it over Google’s reCAPTCHA in April 2020. Staying with Google, Cloudflare wrote at the time, “would have added millions of dollars in annual costs.”

Sechs Jahre später, that cheap-alternative story needs a correction. Zwischen 4 Juni und 2 Juli 2026, hCaptcha cut its free plan from 100,000 zu 10,000 Anfragen ein Monat, the same allowance Google gives. We priced hCaptcha, reCAPTCHA and Cloudflare Turnstile at three real traffic levels, using each vendor’s current rate card.

Schnelle Antwort: hCaptcha is a drop-in replacement for Google’s reCAPTCHA that makes visitors prove they’re human before a form goes through. The free Basic plan covers 10,000 requests a month and runs in what hCaptcha calls “Always Challenge” Modus. Pro costs USD 99/mo on annual billing, and its passive mode challenges fewer than 0.1% of real users. Use hCaptcha on a small WordPress form, or when visitor data has to stay away from Google. For a busy store that wants zero cost and no image puzzles, Cloudflare Turnstile wins: it’s free with no request cap.

Zuletzt überprüft: September 2026. Preise und Ausstattung überprüft.

How We Checked the Facts in This Guide

Every figure below comes from a vendor’s own rate card, policy page or changelog, weiterlesen 11 September 2026. For hCaptcha, that meant its plans, pricing and Pro pages, developer docs, Datenschutzrichtlinie (zuletzt aktualisiert 7 Oktober 2025), and GDPR and accessibility pages. For Google, we used the reCAPTCHA billing documentation and release notes. For Cloudflare, we used the Turnstile plan docs plus Cloudflare’s own blog posts from 2020 und 2023.

Plugin install counts and ratings come straight from the WordPress.org plugin directory. To date hCaptcha’s free-tier cut, we compared 11 archived copies of its plans page on the Internet Archive, ab April 2025 bis Juli 2026.

We compared hCaptcha with the two services its own WordPress plugin offers to migrate you from: Google reCAPTCHA and Cloudflare Turnstile. Each has a free tier and a WordPress plugin updated within 30 days of our check. Cost at real traffic volumes carried the most weight. After that came what data leaves your site, how much friction real visitors face, and how easy the WordPress setup is. Vendor claims without a published method appear here as claims, with the source named.

Two limits apply. We didn’t run bot attacks against any of the three, so we can’t rank how many bots each one stops. Any effectiveness figure below is the vendor grading itself. Ebenfalls, hCaptcha’s own pages disagree. The plans page states the 10,000-request cap, but the pricing page lists Basic at USD 0 with no limit shown. Neither says what happens when a free site goes over.

What hCaptcha Is, and Who Runs It

hCaptcha belongs to Intuition Machines, Inc., a Delaware corporation whose privacy policy gives an address in Miami, Florida. The company says the service dates from 2017. It does the same job as Google’s reCAPTCHA. A small widget sits on a login, Melden Sie sich an, comment or checkout form, and the form only goes through once the visitor passes.

Until mid-2023, hCaptcha also paid site owners. Its earnings program paid out quarterly, on a 60-day trailing basis, for hCaptcha traffic on their sites. That program ended on 15 Juni 2023. hCaptcha’s explanation was that its paid Pro and Enterprise tiers “have become our primary focus.” Tutorials that still sell hCaptcha as a way to earn from your visitors are describing something that no longer exists.

Cloudflare is the reason many people met hCaptcha in the first place. It swapped reCAPTCHA for hCaptcha on 8 April 2020. The reasons given were cost, Google services being “intermittently blocked” in China, and customers “concerned about feeding more data to Google.” Then Cloudflare built its own replacement, Turnstile. Auf 29 September 2023, it said it “will never issue another visual puzzle to anyone, for any reason.”

Scale is harder to pin down. Im Januar 2022, hCaptcha claimed it ran on “Über 15% des Internets” and said it took most of that share “directly from Google reCAPTCHA.” It didn’t explain how it measured either figure.

How Does hCaptcha Work?

There are two halves: a widget in the visitor’s browser and a check on your server. Skip the server half and the widget is decoration. A bot can post straight to your form handler without ever loading the page.

What the visitor sees

The page loads hCaptcha’s script, which draws a checkbox. While the visitor works through the form, the script gathers signals. hCaptcha’s privacy policy lists them: IP Adresse, browser and device type, Betriebssystem, internet provider, mouse movements, scroll position, keypresses and touch events. Combined with the difficulty level the site owner picked, those signals decide what the visitor is shown.

How often a real person meets a puzzle depends on the plan:

• Basic (kostenlos): runs in “Always Challenge” Modus, with four difficulty levels to pick from: Einfach, Mittel, Difficult and Auto.
• Profi: fügt a hinzu “99.9% Passiv” Modus, in which fewer than 0.1% of legitimate users get a challenge. It also adapts difficulty to risk, from no CAPTCHA at all up to visual tasks.
• Unternehmen: adds a fully passive No-CAPTCHA mode and risk scores your own code can act on.

What happens on your server

When the visitor passes, the widget adds a hidden token to the form, in a field called h-captcha-response. Your server sends that token, with your secret key, to hCaptcha’s verification endpoint at api.hcaptcha.com/siteverify. The reply is a short JSON message (a structured text format): success true or false, a timestamp, the hostname, and error codes if something failed.

Two rules in hCaptcha’s docs catch out hand-built setups. Each token works once, and it has to be verified shortly after it’s issued. hCaptcha also recommends sending the visitor’s IP address and your sitekey (the public ID of your widget) with every check. Including it stops a token issued for one widget from being reused on another.

hCaptcha Pricing in 2026: The Free Plan Shrank by 90%

hCaptcha cut its free Basic plan from 100,000 zu 10,000 requests per month between 4 Juni und 2 Juli 2026. Archived copies of its plans page show the change. Das 4 Juni 2026 Schnappschuss still reads “Kostenlos bis zu 100,000 requests per month.” Durch 2 Juli, the same line said 10,000, and it still did when we checked on 11 September.

Here’s the irony. Im Januar 2024, hCaptcha attacked Google for cutting reCAPTCHA’s free tier “von 1,000,000 requests per month to just 10,000 requests.” (It called the move “developer-hostile,” which reads differently now.) In the same post, it said its own free tier “remains at 100,000 requests per month.” Two and a half years later, the two free tiers are the same size.

The three plans, as listed on 11 September 2026:

• Basic: US Dollar 0, begrenzt auf 10,000 requests a month. hCaptcha doesn’t say what happens past the cap.
• Profi: USD 99/mo on annual billing (US Dollar 1,188 ein Jahr) oder USD 139 Monat für Monat. Es enthält 100,000 evaluations a month, then charges USD 0.99 pro 1,000 extra. A 14-day trial needs no payment, and the account drops back to Basic if you don’t keep Pro.
• Unternehmen: Nur Zitat. It adds risk scores, the passive No-CAPTCHA mode, Unternehmens-SLAs (uptime and support guarantees), SAML single sign-on and reporting APIs.

Month-to-month billing adds USD 480 a year to the same Pro plan. hCaptcha’s pricing page also claims Enterprise is “bis zu 50% more cost-effective than reCAPTCHA.” A footnote says that estimate is “based on customer-reported comparison data,” and it sits on the Enterprise card, not Pro. At list prices, as the comparison below shows, Pro can cost more than Google.

hCaptcha vs reCAPTCHA vs Cloudflare Turnstile

All three do the same basic job. They differ in who receives the data, what the free tier covers, and whether a suspicious visitor ever sees a puzzle.

Google reCAPTCHA: cheap past the free tier, but Google gets the data

reCAPTCHA is now billed through Google Cloud. Google’s release notes record three usage-based tiers launching on 1 Juni 2024. Auf 22 April 2026, Google made reCAPTCHA part of a product family called Google Cloud Fraud Defense, and said existing features didn’t change.

The free Essentials tier covers 10,000 assessments a month per organization, and agencies should read that twice. Google’s billing doc says the limit “aggregates use across all accounts and all sites.” Damit 20 client sites under one Google Cloud organization share a single 10,000 pool. Past it, an Essentials project gets a 429 “Resource Exhausted” error until the first of the next month.

Find out whether your form plugin fails open or closed on that error. Failing open lets every bot through; failing closed blocks every real visitor. Neither is what you signed up for.

With billing switched on, the Premium tier charges a USD 8 flat fee for assessments 10,001 durch 100,000, dann USD 1 pro 1,000. Beim 50,000 checks a month, das sind USD 8 gegenüber USD 99 for hCaptcha Pro, a 12.4x gap. Skip reCAPTCHA if your privacy policy can’t list Google as a processor, or if you’d rather not open a Google Cloud billing account. hCaptcha fixes the first problem. Turnstile fixes both.

Cloudflare Turnstile: free and uncapped, with no image puzzles

Turnstile’s free plan allows unlimited challenges, bis zu 20 widgets per account and 10 hostnames per widget. That’s room for up to 200 hostnames before you’d need Enterprise. Enterprise raises the cap to 200 hostnames per widget and stretches analytics from 7 Tage bis 30. You also don’t need to put your site behind Cloudflare. Its docs say Turnstile “can be used independently without requiring other Cloudflare services.”

Der Kompromiss ist Kontrolle. Turnstile doesn’t use image puzzles, so there’s nothing harder to fall back on when a visitor looks suspicious. hCaptcha Pro can step up from a checkbox to a visual task as risk rises. On WordPress, the Simple CAPTCHA with Cloudflare Turnstile plugin has 200,000+ aktive Installationen und a 4.7/5 Bewertung von 256 Bewertungen. hCaptcha’s own plugin, hCaptcha for WP, hat 70,000+ installiert und 4.6/5 von 86.

What each one costs at three traffic levels

These numbers assume one check per protected form submission, at each vendor’s list price. The vendors name their billing units differently (hCaptcha says “evaluations” oder “Anfragen”, Google says “Einschätzungen”), so read them as close estimates rather than invoices.

• 8,000 checks a month, such as a small business contact form: hCaptcha Basic USD 0, reCAPTCHA Essentials USD 0, Turnstile USD 0.
• 50,000 checks a month, like a busy WooCommerce store: hCaptcha Pro USD 99 (US Dollar 139 Monat für Monat), reCAPTCHA USD 8, Turnstile USD 0. Before June 2026, this site fit inside hCaptcha’s free plan.
• 500,000 checks a month, such as a large membership site: hCaptcha Pro USD 99 plus USD 396 Überschuss, damit US Dollar 495 ein Monat. reCAPTCHA USD 8 plus USD 400, also USD 408. Turnstile USD 0.

At the top level, hCaptcha Pro costs 21% more than reCAPTCHA at list price. Turnstile costs nothing at all three.

What Data Does hCaptcha Collect?

More than the privacy branding suggests. hCaptcha’s privacy policy says it collects mouse movements, scroll position, keypresses and touch events because they’re “required to determine whether they are human.” Data from cookies and similar tools is “discarded as soon as practical.” It may still be kept for up to a year after the cookie expires, usually in de-identified, aggregated form.

The real difference from Google is purpose, not volume. hCaptcha’s policy says it hasn’t “sold” personal information in the preceding twelve months and hasn’t shared it for “cross-context behavioral advertising.” Google, im Gegensatz dazu, runs an advertising business.

Where the data goes is murkier. The privacy policy says personal data “will be transferred to, processed, and stored in the United States.” hCaptcha’s GDPR page says sessions run on equipment “within close proximity to End Users.” Metadata is processed in its main data centers in Europe and, gegebenenfalls, die USA. It’s enrolled in the EU-US, UK-US and Swiss-US Data Privacy Framework and uses Standard Contractual Clauses. Both are legal mechanisms for sending European personal data to the US. It also holds ISO 27001, ISO 27701 und SOC 2 Typ-II-Zertifizierungen.

For site owners in the EU, hCaptcha’s docs say it acts as a “data processor,” so your own privacy policy applies. Add hCaptcha to that policy and to your cookie notice. The stricter “Zero PII” Kontrollen (PII is personally identifiable information) strip personal data before it reaches hCaptcha. They’re Enterprise-only.

Barrierefreiheit: Switch On the Text Challenge

Image puzzles lock out blind and low-vision visitors unless there’s another route. hCaptcha offers two. Visitors can register on its accessibility page and get an encrypted cookie. hCaptcha says the cookie “can be used several times per day, but must be refreshed periodically via login.” There’s also a text-based challenge, but hCaptcha describes it as one “that some services may choose to enable.”

That second option stays off unless the site owner turns it on. Ohne es, a screen-reader user who skipped the cookie sign-up is left with image puzzles. hCaptcha says it believes the service meets WCAG 2.2 AA, a level of the W3C’s Web Content Accessibility Guidelines. It bases that on “our own testing and external accessibility reviews.” It also says plainly that “this is not legal advice.” Public-sector and education sites should test with a screen reader before launch, or use Turnstile, which skips visual puzzles entirely.

How to Add hCaptcha to WordPress

hCaptcha’s own plugin, hCaptcha for WP, is the easiest route. It was last updated on 11 September 2026 (Ausführung 5.3.0), needs WordPress 6.0 und PHP 7.4 oder später, and is tested up to WordPress 7.1.

• Schritt 1: Create a free hCaptcha account, add your site, and copy two values: the sitekey and your account secret.
• Schritt 2: In Ihrem WordPress-Dashboard, open Plugins, add a new plugin, suchen nach “hCaptcha for WP” and install it.
• Schritt 3: Paste both keys under Settings > hCaptcha. The plugin can check the configuration before you save.
• Schritt 4: Tick the forms to protect. The plugin covers WordPress core forms, WooCommerce, Kontakt Formular 7, Elementor and “Über 60 other plugins and themes.”
• Schritt 5: Turn on the honeypot (a hidden field only bots fill in) and the minimum submit time. Both stop simple bots before hCaptcha has to show anything.
• Schritt 6: Set the API to load on user interaction, so the script stays out of the first page load. You can also hide hCaptcha from logged-in users.
• Schritt 7: Ausloggen, open a private window, and submit every protected form once to confirm it works.

Moving from reCAPTCHA or Turnstile? The plugin’s Migration Wizard does the switch in a few clicks. Does a security plugin set a Content Security Policy (a header that limits which outside scripts can run)? Then allow https://hcaptcha.com and https://*.hcaptcha.com for scripts, Frames, styles and connections. Otherwise the widget won’t load. A CAPTCHA only covers forms, so work through the rest of our WordPress security testing checklist zu.

Not on WordPress? The front end needs just two pieces: the script from js.hcaptcha.com/1/api.js and a div with the class h-captcha and your data-sitekey. Then verify each token on the server, as described above. hCaptcha also publishes test keys for development, including the sitekey 10000000-ffff-ffff-ffff-000000000001.

How to Choose Between hCaptcha, reCAPTCHA and Turnstile

Decide by volume first, then by where you’re willing to send visitor data.

• Budget: null, with under 10,000 form checks a month. All three cost nothing here. Choose hCaptcha if you want Google out of the loop and a real puzzle as a backstop. Choose Turnstile if traffic could pass 10,000 innerhalb eines Jahres, because its free plan has no request cap.
• Arbeitsbelastung: a WooCommerce store handling about 50,000 Anmeldungen, registrations and checkouts a month. Use Turnstile at USD 0, or reCAPTCHA Premium at USD 8/mo if you already pay for Google Cloud. hCaptcha Pro would cost USD 91 a month more than Google here. If the store is outgrowing its server as well, Sehen Sie sich unseren Leitfaden an WordPress-E-Commerce-Hosting.
• Privacy rule: your policy bars Google, you run 500,000 checks a month, and suspicious traffic needs a real puzzle. Pick hCaptcha Pro at USD 495/mo, because it escalates to visual tasks as risk rises. If a pass-or-fail check is enough, Turnstile handles the same volume for USD 0.
• Agentur: 15 client sites under one Google Cloud organization. Skip reCAPTCHA’s free tier, since every site draws from the same 10,000 Einschätzungen. Turnstile’s free plan allows 20 Widgets, one per site with five to spare.
• Publikum: a real share of visitors in mainland China. hCaptcha documents regional endpoints and first-party hosting for China, but only on Enterprise. Don’t lean on reCAPTCHA there. Cloudflare dropped it in 2020 partly because Google services were intermittently blocked in China.

Häufig gestellte Fragen

Is hCaptcha still free in 2026?

Ja, but for less traffic than before. hCaptcha’s plans page now lists Basic as free up to 10,000 requests a month, down from 100,000 until June 2026. Pro costs USD 99/mo on annual billing and comes with a 14-day trial that needs no payment.

Is hCaptcha better than reCAPTCHA for a WordPress contact form?

For a typical contact form, Ja. Both are free under 10,000 checks a month, and hCaptcha says it doesn’t share visitor data for behavioral advertising. Once you pass 10,000, obwohl, reCAPTCHA’s USD 8 Premium tier is far cheaper than hCaptcha Pro at USD 99.

Why do I keep getting hCaptcha challenges?

The site you’re on installed hCaptcha, and it can’t yet tell you from a bot. hCaptcha’s own help text suggests two fixes: register for its accessibility cookie, and try turning off your ad blocker. Sites on the free plan run in “Always Challenge” Modus, so frequent puzzles often come down to the site’s plan and settings.

Is hCaptcha safe, or does it track me?

It’s a legitimate bot-check service from Intuition Machines. To judge whether you’re human, it collects your IP address, device details, mouse movements and keypresses. Cookie and analytics data can be kept for up to a year after the cookie expires, usually de-identified. It says it doesn’t sell your data or share it for behavioral advertising.

Does hCaptcha still pay website owners?

Nein. hCaptcha ended its earnings program on 15 Juni 2023, and its dashboard switched from earnings to request counts that day. Any tutorial promising payouts for hCaptcha traffic describes a program that’s gone.

Can AI bots solve hCaptcha?

Some get through, as they do with every CAPTCHA. hCaptcha itself says AI solving methods “have continued to improve over the past decade.” Its February 2026 figures claim 70-90% drops in attack volume after Enterprise rollouts, but those numbers come from hCaptcha alone. Treat hCaptcha as one layer, next to login rate limits and a firewall.

Does hCaptcha work for visitors in China?

hCaptcha’s China options are Enterprise-only. Its docs list regional endpoints and a First-Party Hosting feature for low-latency delivery across China. Basic and Pro sites get neither, so test from inside China before relying on them.

Endgültiges Urteil

hCaptcha is the right pick when you want a visible, tunable human check and need visitor data kept away from Google. It’s the wrong pick if price was the reason. Since mid-2026 its free plan stops at 10,000 Anfragen, und bei 50,000 checks a month Pro costs 12.4x what reCaptcha Gebühren.

Cloudflare Turnstile should be the default for most WordPress sites in 2026. Es ist kostenlos, it has no request cap, it shows no image puzzles, and it doesn’t need Cloudflare’s proxy. Choose reCAPTCHA only if you already pay Google Cloud and don’t mind Google processing the data. Es ist USD 8 tier is the cheapest paid option of the three.

A CAPTCHA only guards forms. Floods aimed at the server itself need a host with proper DDoS-Schutz. And if comment spam is your whole problem, it can be simpler to turn WordPress comments off entirely.