What Is hCaptcha? How It Works, What It Costs and How It Compares (2026) - ES

hCaptcha is a CAPTCHA service from Intuition Machines that tells people from bots, and Cloudflare chose it over Google’s reCAPTCHA in April 2020. Staying with Google, Cloudflare wrote at the time, “would have added millions of dollars in annual costs.”

Seis años después, that cheap-alternative story needs a correction. Entre 4 June and 2 julio 2026, hCaptcha cut its free plan from 100,000 a 10,000 peticiones un mes, the same allowance Google gives. We priced hCaptcha, reCAPTCHA and Cloudflare Turnstile at three real traffic levels, using each vendor’s current rate card.

respuesta rapida: hCaptcha is a drop-in replacement for Google’s reCAPTCHA that makes visitors prove they’re human before a form goes through. The free Basic plan covers 10,000 requests a month and runs in what hCaptcha calls “Always Challenge” modo. Pro costs USD 99/mo on annual billing, and its passive mode challenges fewer than 0.1% of real users. Use hCaptcha on a small WordPress form, or when visitor data has to stay away from Google. For a busy store that wants zero cost and no image puzzles, Cloudflare Turnstile wins: it’s free with no request cap.

Última revisión: septiembre 2026. Precios y características verificadas..

How We Checked the Facts in This Guide

Every figure below comes from a vendor’s own rate card, policy page or changelog, sigue leyendo 11 septiembre 2026. For hCaptcha, that meant its plans, pricing and Pro pages, developer docs, política de privacidad (última actualización 7 octubre 2025), and GDPR and accessibility pages. For Google, we used the reCAPTCHA billing documentation and release notes. For Cloudflare, we used the Turnstile plan docs plus Cloudflare’s own blog posts from 2020 y 2023.

Plugin install counts and ratings come straight from the WordPress.org plugin directory. To date hCaptcha’s free-tier cut, we compared 11 archived copies of its plans page on the Internet Archive, desde abril 2025 a julio 2026.

We compared hCaptcha with the two services its own WordPress plugin offers to migrate you from: Google reCAPTCHA and Cloudflare Turnstile. Each has a free tier and a WordPress plugin updated within 30 days of our check. Cost at real traffic volumes carried the most weight. After that came what data leaves your site, how much friction real visitors face, and how easy the WordPress setup is. Vendor claims without a published method appear here as claims, with the source named.

Two limits apply. We didn’t run bot attacks against any of the three, so we can’t rank how many bots each one stops. Any effectiveness figure below is the vendor grading itself. también, hCaptcha’s own pages disagree. The plans page states the 10,000-request cap, but the pricing page lists Basic at USD 0 with no limit shown. Neither says what happens when a free site goes over.

What hCaptcha Is, and Who Runs It

hCaptcha belongs to Intuition Machines, Cª, a Delaware corporation whose privacy policy gives an address in Miami, Florida. The company says the service dates from 2017. It does the same job as Google’s reCAPTCHA. A small widget sits on a login, inscribirse, comment or checkout form, and the form only goes through once the visitor passes.

Until mid-2023, hCaptcha also paid site owners. Its earnings program paid out quarterly, on a 60-day trailing basis, for hCaptcha traffic on their sites. That program ended on 15 junio 2023. hCaptcha’s explanation was that its paid Pro and Enterprise tiers “have become our primary focus.” Tutorials that still sell hCaptcha as a way to earn from your visitors are describing something that no longer exists.

Cloudflare is the reason many people met hCaptcha in the first place. It swapped reCAPTCHA for hCaptcha on 8 abril 2020. The reasons given were cost, Google services being “intermittently blocked” in China, and customers “concerned about feeding more data to Google.” Then Cloudflare built its own replacement, Turnstile. En 29 septiembre 2023, it said it “will never issue another visual puzzle to anyone, for any reason.”

Scale is harder to pin down. en enero 2022, hCaptcha claimed it ran on “acerca de 15% de internet” and said it took most of that share “directly from Google reCAPTCHA.” It didn’t explain how it measured either figure.

How Does hCaptcha Work?

There are two halves: a widget in the visitor’s browser and a check on your server. Skip the server half and the widget is decoration. A bot can post straight to your form handler without ever loading the page.

What the visitor sees

The page loads hCaptcha’s script, which draws a checkbox. While the visitor works through the form, the script gathers signals. hCaptcha’s privacy policy lists them: dirección IP, browser and device type, Sistema operativo, internet provider, mouse movements, scroll position, keypresses and touch events. Combined with the difficulty level the site owner picked, those signals decide what the visitor is shown.

How often a real person meets a puzzle depends on the plan:

• Básico (gratis): runs in “Always Challenge” modo, with four difficulty levels to pick from: Fácil, Medio, Difficult and Auto.
• Pro: agrega un “99.9% Pasivo” modo, in which fewer than 0.1% of legitimate users get a challenge. It also adapts difficulty to risk, from no CAPTCHA at all up to visual tasks.
• Empresa: adds a fully passive No-CAPTCHA mode and risk scores your own code can act on.

What happens on your server

When the visitor passes, the widget adds a hidden token to the form, in a field called h-captcha-response. Your server sends that token, with your secret key, to hCaptcha’s verification endpoint at api.hcaptcha.com/siteverify. The reply is a short JSON message (a structured text format): success true or false, a timestamp, the hostname, and error codes if something failed.

Two rules in hCaptcha’s docs catch out hand-built setups. Each token works once, and it has to be verified shortly after it’s issued. hCaptcha also recommends sending the visitor’s IP address and your sitekey (the public ID of your widget) with every check. Including it stops a token issued for one widget from being reused on another.

hCaptcha Pricing in 2026: The Free Plan Shrank by 90%

hCaptcha cut its free Basic plan from 100,000 a 10,000 requests per month between 4 June and 2 julio 2026. Archived copies of its plans page show the change. los 4 junio 2026 instantánea still reads “Gratis hasta 100,000 requests per month.” Por 2 julio, the same line said 10,000, and it still did when we checked on 11 septiembre.

Here’s the irony. en enero 2024, hCaptcha attacked Google for cutting reCAPTCHA’s free tier “desde 1,000,000 requests per month to just 10,000 requests.” (It called the move “developer-hostile,” which reads differently now.) In the same post, it said its own free tier “remains at 100,000 requests per month.” Two and a half years later, the two free tiers are the same size.

The three plans, as listed on 11 septiembre 2026:

• Básico: Dólar estadounidense 0, limitado a 10,000 requests a month. hCaptcha doesn’t say what happens past the cap.
• Pro: USD 99/mo on annual billing (Dólar estadounidense 1,188 un año) o USD 139 mes a mes. Incluye 100,000 evaluations a month, then charges USD 0.99 por 1,000 extra. A 14-day trial needs no payment, and the account drops back to Basic if you don’t keep Pro.
• Empresa: cita solamente. It adds risk scores, the passive No-CAPTCHA mode, SLA empresariales (uptime and support guarantees), SAML single sign-on and reporting APIs.

Month-to-month billing adds USD 480 a year to the same Pro plan. hCaptcha’s pricing page also claims Enterprise is “hasta 50% more cost-effective than reCAPTCHA.” A footnote says that estimate is “based on customer-reported comparison data,” and it sits on the Enterprise card, not Pro. At list prices, as the comparison below shows, Pro can cost more than Google.

hCaptcha vs reCAPTCHA vs Cloudflare Turnstile

All three do the same basic job. They differ in who receives the data, what the free tier covers, and whether a suspicious visitor ever sees a puzzle.

Google reCAPTCHA: cheap past the free tier, but Google gets the data

reCAPTCHA is now billed through Google Cloud. Google’s release notes record three usage-based tiers launching on 1 junio 2024. En 22 abril 2026, Google made reCAPTCHA part of a product family called Google Cloud Fraud Defense, and said existing features didn’t change.

The free Essentials tier covers 10,000 assessments a month per organization, and agencies should read that twice. Google’s billing doc says the limit “aggregates use across all accounts and all sites.” Entonces 20 client sites under one Google Cloud organization share a single 10,000 pool. Past it, an Essentials project gets a 429 “Resource Exhausted” error until the first of the next month.

Find out whether your form plugin fails open or closed on that error. Failing open lets every bot through; failing closed blocks every real visitor. Neither is what you signed up for.

With billing switched on, the Premium tier charges a USD 8 flat fee for assessments 10,001 a través de 100,000, luego USD 1 por 1,000. A 50,000 checks a month, eso es USD 8 contra USD 99 for hCaptcha Pro, a 12.4x gap. Skip reCAPTCHA if your privacy policy can’t list Google as a processor, or if you’d rather not open a Google Cloud billing account. hCaptcha fixes the first problem. Turnstile fixes both.

Cloudflare Turnstile: free and uncapped, with no image puzzles

Turnstile’s free plan allows unlimited challenges, hasta 20 widgets per account and 10 hostnames per widget. That’s room for up to 200 hostnames before you’d need Enterprise. Enterprise raises the cap to 200 hostnames per widget and stretches analytics from 7 días para 30. You also don’t need to put your site behind Cloudflare. Its docs say Turnstile “can be used independently without requiring other Cloudflare services.”

La compensación es el control.. Turnstile doesn’t use image puzzles, so there’s nothing harder to fall back on when a visitor looks suspicious. hCaptcha Pro can step up from a checkbox to a visual task as risk rises. On WordPress, the Simple CAPTCHA with Cloudflare Turnstile plugin has 200,000+ instalaciones activas y un 4.7/5 calificación de 256 calificaciones. hCaptcha’s own plugin, hCaptcha for WP, tiene 70,000+ instala y 4.6/5 desde 86.

What each one costs at three traffic levels

These numbers assume one check per protected form submission, at each vendor’s list price. The vendors name their billing units differently (hCaptcha says “evaluations” o “peticiones”, Google says “evaluaciones”), so read them as close estimates rather than invoices.

• 8,000 checks a month, such as a small business contact form: hCaptcha Basic USD 0, reCAPTCHA Essentials USD 0, Turnstile USD 0.
• 50,000 checks a month, like a busy WooCommerce store: hCaptcha Pro USD 99 (Dólar estadounidense 139 mes a mes), reCAPTCHA USD 8, Turnstile USD 0. Before June 2026, this site fit inside hCaptcha’s free plan.
• 500,000 checks a month, such as a large membership site: hCaptcha Pro USD 99 más USD 396 exceso, entonces Dólar estadounidense 495 un mes. reCAPTCHA USD 8 más USD 400, entonces USD 408. Turnstile USD 0.

At the top level, hCaptcha Pro costs 21% more than reCAPTCHA at list price. Turnstile costs nothing at all three.

What Data Does hCaptcha Collect?

More than the privacy branding suggests. hCaptcha’s privacy policy says it collects mouse movements, scroll position, keypresses and touch events because they’re “required to determine whether they are human.” Data from cookies and similar tools is “discarded as soon as practical.” It may still be kept for up to a year after the cookie expires, usually in de-identified, aggregated form.

The real difference from Google is purpose, not volume. hCaptcha’s policy says it hasn’t “sold” personal information in the preceding twelve months and hasn’t shared it for “cross-context behavioral advertising.” Google, por el contrario, runs an advertising business.

Where the data goes is murkier. The privacy policy says personal data “will be transferred to, processed, and stored in the United States.” hCaptcha’s GDPR page says sessions run on equipment “within close proximity to End Users.” Metadata is processed in its main data centers in Europe and, Si corresponde, los Estados Unidos. It’s enrolled in the EU-US, UK-US and Swiss-US Data Privacy Framework and uses Standard Contractual Clauses. Both are legal mechanisms for sending European personal data to the US. It also holds ISO 27001, YO ASI 27701 y SOC 2 Certificaciones tipo II.

For site owners in the EU, hCaptcha’s docs say it acts as a “data processor,” so your own privacy policy applies. Add hCaptcha to that policy and to your cookie notice. The stricter “Zero PII” control S (PII is personally identifiable information) strip personal data before it reaches hCaptcha. They’re Enterprise-only.

Accesibilidad: Switch On the Text Challenge

Image puzzles lock out blind and low-vision visitors unless there’s another route. hCaptcha offers two. Visitors can register on its accessibility page and get an encrypted cookie. hCaptcha says the cookie “can be used several times per day, but must be refreshed periodically via login.” There’s also a text-based challenge, but hCaptcha describes it as one “that some services may choose to enable.”

That second option stays off unless the site owner turns it on. Sin ello, a screen-reader user who skipped the cookie sign-up is left with image puzzles. hCaptcha says it believes the service meets WCAG 2.2 Automóvil club británico, a level of the W3C’s Web Content Accessibility Guidelines. It bases that on “our own testing and external accessibility reviews.” It also says plainly that “this is not legal advice.” Public-sector and education sites should test with a screen reader before launch, or use Turnstile, which skips visual puzzles entirely.

How to Add hCaptcha to WordPress

hCaptcha’s own plugin, hCaptcha for WP, is the easiest route. It was last updated on 11 septiembre 2026 (versión 5.3.0), needs WordPress 6.0 y PHP 7.4 o más tarde, and is tested up to WordPress 7.1.

• Paso 1: Create a free hCaptcha account, add your site, and copy two values: the sitekey and your account secret.
• Paso 2: En tu panel de WordPress, open Plugins, add a new plugin, buscar “hCaptcha for WP” and install it.
• Paso 3: Paste both keys under Settings > hCaptcha. The plugin can check the configuration before you save.
• Paso 4: Tick the forms to protect. The plugin covers WordPress core forms, WooCommerce, Formulario de contacto 7, Elementor and “terminado 60 other plugins and themes.”
• Paso 5: Turn on the honeypot (a hidden field only bots fill in) and the minimum submit time. Both stop simple bots before hCaptcha has to show anything.
• Paso 6: Set the API to load on user interaction, so the script stays out of the first page load. You can also hide hCaptcha from logged-in users.
• Paso 7: Cerrar sesión, open a private window, and submit every protected form once to confirm it works.

Moving from reCAPTCHA or Turnstile? The plugin’s Migration Wizard does the switch in a few clicks. Does a security plugin set a Content Security Policy (a header that limits which outside scripts can run)? Then allow https://hcaptcha.com and https://*.hcaptcha.com for scripts, marcos, styles and connections. Otherwise the widget won’t load. A CAPTCHA only covers forms, so work through the rest of our WordPress security testing checklist también.

Not on WordPress? The front end needs just two pieces: the script from js.hcaptcha.com/1/api.js and a div with the class h-captcha and your data-sitekey. Then verify each token on the server, as described above. hCaptcha also publishes test keys for development, including the sitekey 10000000-ffff-ffff-ffff-000000000001.

How to Choose Between hCaptcha, reCAPTCHA and Turnstile

Decide by volume first, then by where you’re willing to send visitor data.

• Presupuesto: cero, with under 10,000 form checks a month. All three cost nothing here. Choose hCaptcha if you want Google out of the loop and a real puzzle as a backstop. Choose Turnstile if traffic could pass 10,000 dentro de un año, because its free plan has no request cap.
• Carga de trabajo: a WooCommerce store handling about 50,000 inicios de sesión, registrations and checkouts a month. Use Turnstile at USD 0, or reCAPTCHA Premium at USD 8/mo if you already pay for Google Cloud. hCaptcha Pro would cost USD 91 a month more than Google here. If the store is outgrowing its server as well, vea nuestra guía para Alojamiento de comercio electrónico de WordPress.
• Privacy rule: your policy bars Google, you run 500,000 checks a month, and suspicious traffic needs a real puzzle. Pick hCaptcha Pro at USD 495/mo, because it escalates to visual tasks as risk rises. If a pass-or-fail check is enough, Turnstile handles the same volume for USD 0.
• Agencia: 15 client sites under one Google Cloud organization. Skip reCAPTCHA’s free tier, since every site draws from the same 10,000 evaluaciones. Turnstile’s free plan allows 20 widgets, one per site with five to spare.
• Audiencia: a real share of visitors in mainland China. hCaptcha documents regional endpoints and first-party hosting for China, but only on Enterprise. Don’t lean on reCAPTCHA there. Cloudflare dropped it in 2020 partly because Google services were intermittently blocked in China.

Preguntas frecuentes

Is hCaptcha still free in 2026?

si, but for less traffic than before. hCaptcha’s plans page now lists Basic as free up to 10,000 requests a month, abajo de 100,000 until June 2026. Pro costs USD 99/mo on annual billing and comes with a 14-day trial that needs no payment.

Is hCaptcha better than reCAPTCHA for a WordPress contact form?

For a typical contact form, si. Both are free under 10,000 checks a month, and hCaptcha says it doesn’t share visitor data for behavioral advertising. Once you pass 10,000, aunque, reCAPTCHA’s USD 8 Premium tier is far cheaper than hCaptcha Pro at USD 99.

Why do I keep getting hCaptcha challenges?

The site you’re on installed hCaptcha, and it can’t yet tell you from a bot. hCaptcha’s own help text suggests two fixes: register for its accessibility cookie, and try turning off your ad blocker. Sites on the free plan run in “Always Challenge” modo, so frequent puzzles often come down to the site’s plan and settings.

Is hCaptcha safe, or does it track me?

It’s a legitimate bot-check service from Intuition Machines. To judge whether you’re human, it collects your IP address, device details, mouse movements and keypresses. Cookie and analytics data can be kept for up to a year after the cookie expires, usually de-identified. It says it doesn’t sell your data or share it for behavioral advertising.

Does hCaptcha still pay website owners?

No. hCaptcha ended its earnings program on 15 junio 2023, and its dashboard switched from earnings to request counts that day. Any tutorial promising payouts for hCaptcha traffic describes a program that’s gone.

Can AI bots solve hCaptcha?

Some get through, as they do with every CAPTCHA. hCaptcha itself says AI solving methods “have continued to improve over the past decade.” Its February 2026 figures claim 70-90% drops in attack volume after Enterprise rollouts, but those numbers come from hCaptcha alone. Treat hCaptcha as one layer, next to login rate limits and a firewall.

Does hCaptcha work for visitors in China?

hCaptcha’s China options are Enterprise-only. Its docs list regional endpoints and a First-Party Hosting feature for low-latency delivery across China. Basic and Pro sites get neither, so test from inside China before relying on them.

Veredicto final

hCaptcha is the right pick when you want a visible, tunable human check and need visitor data kept away from Google. It’s the wrong pick if price was the reason. Since mid-2026 its free plan stops at 10,000 peticiones, y en 50,000 checks a month Pro costs 12.4x what reCAPTCHA cargos.

Cloudflare Turnstile should be the default for most WordPress sites in 2026. Es gratis, it has no request cap, it shows no image puzzles, and it doesn’t need Cloudflare’s proxy. Choose reCAPTCHA only if you already pay Google Cloud and don’t mind Google processing the data. Su USD 8 tier is the cheapest paid option of the three.

A CAPTCHA only guards forms. Floods aimed at the server itself need a host with proper Protección DDoS. And if comment spam is your whole problem, it can be simpler to turn WordPress comments off entirely.