hCaptchaとは? 仕組み, 費用とその比較 (2026) - JA

hCaptcha は、ボットから人々に情報を伝える Intuition Machines の CAPTCHA サービスです, そしてCloudflareは4月にGoogleのreCAPTCHAではなくこれを選択した 2020. Google を使い続ける, Cloudflareは当時こう書いている, “年間コストが数百万ドルも追加されていたでしょう。”

6年後, that cheap-alternative story needs a correction. 間 4 6月と 2 7月 2026, hCaptcha cut its free plan from 100,000 に 10,000 リクエスト 月, the same allowance Google gives. We priced hCaptcha, reCAPTCHA and Cloudflare Turnstile at three real traffic levels, using each vendor’s current rate card.

簡単な回答: hCaptcha is a drop-in replacement for Google’s reCAPTCHA that makes visitors prove they’re human before a form goes through. The free Basic plan covers 10,000 requests a month and runs in what hCaptcha calls “Always Challenge” モード. Pro costs USD 99/mo on annual billing, and its passive mode challenges fewer than 0.1% of real users. Use hCaptcha on a small WordPress form, or when visitor data has to stay away from Google. For a busy store that wants zero cost and no image puzzles, Cloudflare Turnstile wins: it’s free with no request cap.

最終レビュー済み: 9月 2026. 価格と機能を検証しました.

How We Checked the Facts in This Guide

Every figure below comes from a vendor’s own rate card, policy page or changelog, read on 11 9月 2026. For hCaptcha, that meant its plans, pricing and Pro pages, developer docs, プライバシーポリシー (最終更新日 7 10月 2025), and GDPR and accessibility pages. For Google, we used the reCAPTCHA billing documentation and release notes. For Cloudflare, we used the Turnstile plan docs plus Cloudflare’s own blog posts from 2020 と 2023.

Plugin install counts and ratings come straight from the WordPress.org plugin directory. To date hCaptcha’s free-tier cut, we compared 11 archived copies of its plans page on the Internet Archive, 4月から 2025 7月まで 2026.

We compared hCaptcha with the two services its own WordPress plugin offers to migrate you from: Google reCAPTCHA and Cloudflare Turnstile. Each has a free tier and a WordPress plugin updated within 30 days of our check. Cost at real traffic volumes carried the most weight. After that came what data leaves your site, how much friction real visitors face, and how easy the WordPress setup is. Vendor claims without a published method appear here as claims, with the source named.

Two limits apply. We didn’t run bot attacks against any of the three, so we can’t rank how many bots each one stops. Any effectiveness figure below is the vendor grading itself. また, hCaptcha’s own pages disagree. The plans page states the 10,000-request cap, but the pricing page lists Basic at USD 0 with no limit shown. Neither says what happens when a free site goes over.

What hCaptcha Is, and Who Runs It

hCaptcha belongs to Intuition Machines, 株式会社, a Delaware corporation whose privacy policy gives an address in Miami, フロリダ. The company says the service dates from 2017. It does the same job as Google’s reCAPTCHA. A small widget sits on a login, サインアップ, comment or checkout form, and the form only goes through once the visitor passes.

Until mid-2023, hCaptcha also paid site owners. Its earnings program paid out quarterly, on a 60-day trailing basis, for hCaptcha traffic on their sites. That program ended on 15 六月 2023. hCaptcha’s explanation was that its paid Pro and Enterprise tiers “have become our primary focus.” Tutorials that still sell hCaptcha as a way to earn from your visitors are describing something that no longer exists.

Cloudflare is the reason many people met hCaptcha in the first place. It swapped reCAPTCHA for hCaptcha on 8 4月 2020. The reasons given were cost, Google services being “intermittently blocked” in China, and customers “concerned about feeding more data to Google.” Then Cloudflare built its own replacement, Turnstile. の上 29 9月 2023, it said it “will never issue another visual puzzle to anyone, for any reason.”

Scale is harder to pin down. 1月に 2022, hCaptcha claimed it ran on “約 15% インターネットの” and said it took most of that share “directly from Google reCAPTCHA.” It didn’t explain how it measured either figure.

How Does hCaptcha Work?

There are two halves: a widget in the visitor’s browser and a check on your server. Skip the server half and the widget is decoration. A bot can post straight to your form handler without ever loading the page.

What the visitor sees

The page loads hCaptcha’s script, which draws a checkbox. While the visitor works through the form, the script gathers signals. hCaptcha’s privacy policy lists them: IPアドレス, browser and device type, オペレーティング·システム, internet provider, mouse movements, scroll position, keypresses and touch events. Combined with the difficulty level the site owner picked, those signals decide what the visitor is shown.

How often a real person meets a puzzle depends on the plan:

• 基本 (自由): runs in “Always Challenge” モード, with four difficulty levels to pick from: 簡単, 中くらい, Difficult and Auto.
• プロ: を追加します “99.9% 受け身” モード, in which fewer than 0.1% of legitimate users get a challenge. It also adapts difficulty to risk, from no CAPTCHA at all up to visual tasks.
• 企業: adds a fully passive No-CAPTCHA mode and risk scores your own code can act on.

What happens on your server

When the visitor passes, the widget adds a hidden token to the form, in a field called h-captcha-response. Your server sends that token, with your secret key, to hCaptcha’s verification endpoint at api.hcaptcha.com/siteverify. The reply is a short JSON message (a structured text format): success true or false, a timestamp, the hostname, and error codes if something failed.

Two rules in hCaptcha’s docs catch out hand-built setups. Each token works once, and it has to be verified shortly after it’s issued. hCaptcha also recommends sending the visitor’s IP address and your sitekey (the public ID of your widget) with every check. Including it stops a token issued for one widget from being reused on another.

hCaptcha Pricing in 2026: The Free Plan Shrank by 90%

hCaptcha cut its free Basic plan from 100,000 に 10,000 requests per month between 4 6月と 2 7月 2026. Archived copies of its plans page show the change. The 4 六月 2026 スナップショット still reads “まで無料 100,000 requests per month.” に 2 7月, the same line said 10,000, and it still did when we checked on 11 9月.

Here’s the irony. 1月に 2024, hCaptcha attacked Google for cutting reCAPTCHA’s free tier “から 1,000,000 requests per month to just 10,000 requests.” (It called the move “developer-hostile,” which reads differently now.) In the same post, it said its own free tier “remains at 100,000 requests per month.” Two and a half years later, the two free tiers are the same size.

The three plans, as listed on 11 9月 2026:

• 基本: 米ドル 0, 上限 10,000 requests a month. hCaptcha doesn’t say what happens past the cap.
• プロ: USD 99/mo on annual billing (米ドル 1,188 1年) または米ドル 139 月ごとに. 含まれています 100,000 evaluations a month, then charges USD 0.99 あたり 1,000 追加. A 14-day trial needs no payment, and the account drops back to Basic if you don’t keep Pro.
• 企業: 引用のみ. It adds risk scores, the passive No-CAPTCHA mode, エンタープライズSLA (uptime and support guarantees), SAML single sign-on and reporting APIs.

Month-to-month billing adds USD 480 a year to the same Pro plan. hCaptcha’s pricing page also claims Enterprise is “まで 50% more cost-effective than reCAPTCHA.” A footnote says that estimate is “based on customer-reported comparison data,” and it sits on the Enterprise card, not Pro. At list prices, as the comparison below shows, Pro can cost more than Google.

hCaptcha vs reCAPTCHA vs Cloudflare Turnstile

All three do the same basic job. They differ in who receives the data, what the free tier covers, and whether a suspicious visitor ever sees a puzzle.

Google reCAPTCHA: cheap past the free tier, but Google gets the data

reCAPTCHA is now billed through Google Cloud. Google’s release notes record three usage-based tiers launching on 1 六月 2024. の上 22 4月 2026, Google made reCAPTCHA part of a product family called Google Cloud Fraud Defense, and said existing features didn’t change.

The free Essentials tier covers 10,000 assessments a month per organization, and agencies should read that twice. Google’s billing doc says the limit “aggregates use across all accounts and all sites.” そう 20 client sites under one Google Cloud organization share a single 10,000 pool. Past it, an Essentials project gets a 429 “Resource Exhausted” error until the first of the next month.

Find out whether your form plugin fails open or closed on that error. Failing open lets every bot through; failing closed blocks every real visitor. Neither is what you signed up for.

With billing switched on, the Premium tier charges a USD 8 flat fee for assessments 10,001 を通して 100,000, 次に米ドル 1 あたり 1,000. で 50,000 checks a month, それは米ドルです 8 対米ドル 99 for hCaptcha Pro, a 12.4x gap. Skip reCAPTCHA if your privacy policy can’t list Google as a processor, or if you’d rather not open a Google Cloud billing account. hCaptcha fixes the first problem. Turnstile fixes both.

Cloudflare Turnstile: free and uncapped, with no image puzzles

Turnstile’s free plan allows unlimited challenges, まで 20 widgets per account and 10 hostnames per widget. That’s room for up to 200 hostnames before you’d need Enterprise. Enterprise raises the cap to 200 hostnames per widget and stretches analytics from 7 までの日数 30. You also don’t need to put your site behind Cloudflare. Its docs say Turnstile “can be used independently without requiring other Cloudflare services.”

トレードオフは制御です. Turnstile doesn’t use image puzzles, so there’s nothing harder to fall back on when a visitor looks suspicious. hCaptcha Pro can step up from a checkbox to a visual task as risk rises. On WordPress, the Simple CAPTCHA with Cloudflare Turnstile plugin has 200,000+ active installs and a 4.7/5 からの評価 256 評価. hCaptcha’s own plugin, hCaptcha for WP, もっている 70,000+ インストールして、 4.6/5 から 86.

What each one costs at three traffic levels

These numbers assume one check per protected form submission, at each vendor’s list price. The vendors name their billing units differently (hCaptcha says “evaluations” また “リクエスト”, Google says “評価”), so read them as close estimates rather than invoices.

• 8,000 checks a month, such as a small business contact form: hCaptcha Basic USD 0, reCAPTCHA Essentials USD 0, Turnstile USD 0.
• 50,000 checks a month, like a busy WooCommerce store: hCaptcha Pro USD 99 (米ドル 139 月ごとに), reCAPTCHA USD 8, Turnstile USD 0. Before June 2026, this site fit inside hCaptcha’s free plan.
• 500,000 checks a month, such as a large membership site: hCaptcha Pro USD 99 プラス米ドル 396 超過額, それで 米ドル 495 月. reCAPTCHA USD 8 プラス米ドル 400, それで米ドル 408. Turnstile USD 0.

At the top level, hCaptcha Pro costs 21% more than reCAPTCHA at list price. Turnstile costs nothing at all three.

What Data Does hCaptcha Collect?

More than the privacy branding suggests. hCaptcha’s privacy policy says it collects mouse movements, scroll position, keypresses and touch events because they’re “required to determine whether they are human.” Data from cookies and similar tools is “discarded as soon as practical.” It may still be kept for up to a year after the cookie expires, usually in de-identified, aggregated form.

The real difference from Google is purpose, not volume. hCaptcha’s policy says it hasn’t “sold” personal information in the preceding twelve months and hasn’t shared it for “cross-context behavioral advertising.” グーグル, 対照的に, runs an advertising business.

Where the data goes is murkier. The privacy policy says personal data “will be transferred to, processed, and stored in the United States.” hCaptcha’s GDPR page says sessions run on equipment “within close proximity to End Users.” Metadata is processed in its main data centers in Europe and, 該当する場合, アメリカ. It’s enrolled in the EU-US, UK-US and Swiss-US Data Privacy Framework and uses Standard Contractual Clauses. Both are legal mechanisms for sending European personal data to the US. It also holds ISO 27001, ISO 27701 およびSOC 2 タイプ II 認証.

For site owners in the EU, hCaptcha’s docs say it acts as a “data processor,” so your own privacy policy applies. Add hCaptcha to that policy and to your cookie notice. The stricter “Zero PII” コントロール (PII is personally identifiable information) strip personal data before it reaches hCaptcha. They’re Enterprise-only.

アクセシビリティ: Switch On the Text Challenge

Image puzzles lock out blind and low-vision visitors unless there’s another route. hCaptcha offers two. Visitors can register on its accessibility page and get an encrypted cookie. hCaptcha says the cookie “can be used several times per day, but must be refreshed periodically via login.” There’s also a text-based challenge, but hCaptcha describes it as one “that some services may choose to enable.”

That second option stays off unless the site owner turns it on. それなしで, a screen-reader user who skipped the cookie sign-up is left with image puzzles. hCaptcha says it believes the service meets WCAG 2.2 AA, a level of the W3C’s Web Content Accessibility Guidelines. It bases that on “our own testing and external accessibility reviews.” It also says plainly that “this is not legal advice.” Public-sector and education sites should test with a screen reader before launch, or use Turnstile, which skips visual puzzles entirely.

How to Add hCaptcha to WordPress

hCaptcha’s own plugin, hCaptcha for WP, is the easiest route. It was last updated on 11 9月 2026 (バージョン 5.3.0), needs WordPress 6.0 およびPHP 7.4 以降, and is tested up to WordPress 7.1.

• ステップ 1: Create a free hCaptcha account, add your site, and copy two values: the sitekey and your account secret.
• ステップ 2: WordPressダッシュボードで, open Plugins, add a new plugin, 検索する “hCaptcha for WP” and install it.
• ステップ 3: Paste both keys under Settings > hCaptcha. The plugin can check the configuration before you save.
• ステップ 4: Tick the forms to protect. The plugin covers WordPress core forms, WooCommerce, お問い合わせフォーム 7, Elementor and “以上 60 other plugins and themes.”
• ステップ 5: Turn on the honeypot (a hidden field only bots fill in) and the minimum submit time. Both stop simple bots before hCaptcha has to show anything.
• ステップ 6: Set the API to load on user interaction, so the script stays out of the first page load. You can also hide hCaptcha from logged-in users.
• ステップ 7: ログアウト, open a private window, and submit every protected form once to confirm it works.

Moving from reCAPTCHA or Turnstile? The plugin’s Migration Wizard does the switch in a few clicks. Does a security plugin set a Content Security Policy (a header that limits which outside scripts can run)? Then allow https://hcaptcha.com and https://*.hcaptcha.com for scripts, フレーム, styles and connections. Otherwise the widget won’t load. A CAPTCHA only covers forms, so work through the rest of our WordPress security testing checklist それも.

Not on WordPress? The front end needs just two pieces: the script from js.hcaptcha.com/1/api.js and a div with the class h-captcha and your data-sitekey. Then verify each token on the server, as described above. hCaptcha also publishes test keys for development, including the sitekey 10000000-ffff-ffff-ffff-000000000001.

How to Choose Between hCaptcha, reCAPTCHA and Turnstile

Decide by volume first, then by where you’re willing to send visitor data.

• バジェット: ゼロ, with under 10,000 form checks a month. All three cost nothing here. Choose hCaptcha if you want Google out of the loop and a real puzzle as a backstop. Choose Turnstile if traffic could pass 10,000 1年以内に, because its free plan has no request cap.
• ワークロード: a WooCommerce store handling about 50,000 ログイン, registrations and checkouts a month. Use Turnstile at USD 0, or reCAPTCHA Premium at USD 8/mo if you already pay for Google Cloud. hCaptcha Pro would cost USD 91 a month more than Google here. If the store is outgrowing its server as well, のガイドを参照してください WordPress eコマースホスティング.
• Privacy rule: your policy bars Google, you run 500,000 checks a month, and suspicious traffic needs a real puzzle. Pick hCaptcha Pro at USD 495/mo, because it escalates to visual tasks as risk rises. If a pass-or-fail check is enough, Turnstile handles the same volume for USD 0.
• エージェンシー: 15 client sites under one Google Cloud organization. Skip reCAPTCHA’s free tier, since every site draws from the same 10,000 評価. Turnstile’s free plan allows 20 ウィジェット, one per site with five to spare.
• 観客: a real share of visitors in mainland China. hCaptcha documents regional endpoints and first-party hosting for China, but only on Enterprise. Don’t lean on reCAPTCHA there. Cloudflare dropped it in 2020 partly because Google services were intermittently blocked in China.

よくある質問

Is hCaptcha still free in 2026?

はい, but for less traffic than before. hCaptcha’s plans page now lists Basic as free up to 10,000 requests a month, から下へ 100,000 until June 2026. Pro costs USD 99/mo on annual billing and comes with a 14-day trial that needs no payment.

Is hCaptcha better than reCAPTCHA for a WordPress contact form?

For a typical contact form, はい. Both are free under 10,000 checks a month, and hCaptcha says it doesn’t share visitor data for behavioral advertising. Once you pass 10,000, けれど, reCAPTCHA’s USD 8 Premium tier is far cheaper than hCaptcha Pro at USD 99.

Why do I keep getting hCaptcha challenges?

The site you’re on installed hCaptcha, and it can’t yet tell you from a bot. hCaptcha’s own help text suggests two fixes: register for its accessibility cookie, and try turning off your ad blocker. Sites on the free plan run in “Always Challenge” モード, so frequent puzzles often come down to the site’s plan and settings.

Is hCaptcha safe, or does it track me?

It’s a legitimate bot-check service from Intuition Machines. To judge whether you’re human, it collects your IP address, device details, mouse movements and keypresses. Cookie and analytics data can be kept for up to a year after the cookie expires, usually de-identified. It says it doesn’t sell your data or share it for behavioral advertising.

Does hCaptcha still pay website owners?

いいえ. hCaptcha ended its earnings program on 15 六月 2023, and its dashboard switched from earnings to request counts that day. Any tutorial promising payouts for hCaptcha traffic describes a program that’s gone.

Can AI bots solve hCaptcha?

Some get through, as they do with every CAPTCHA. hCaptcha itself says AI solving methods “have continued to improve over the past decade.” Its February 2026 figures claim 70-90% drops in attack volume after Enterprise rollouts, but those numbers come from hCaptcha alone. Treat hCaptcha as one layer, next to login rate limits and a firewall.

Does hCaptcha work for visitors in China?

hCaptcha’s China options are Enterprise-only. Its docs list regional endpoints and a First-Party Hosting feature for low-latency delivery across China. Basic and Pro sites get neither, so test from inside China before relying on them.

最終評決

hCaptcha is the right pick when you want a visible, tunable human check and need visitor data kept away from Google. It’s the wrong pick if price was the reason. Since mid-2026 its free plan stops at 10,000 リクエスト, and at 50,000 checks a month Pro costs 12.4x what reCAPTCHA 料金.

Cloudflare Turnstile should be the default for most WordPress sites in 2026. それは無料です, it has no request cap, it shows no image puzzles, and it doesn’t need Cloudflare’s proxy. Choose reCAPTCHA only if you already pay Google Cloud and don’t mind Google processing the data. 米ドルです 8 tier is the cheapest paid option of the three.

A CAPTCHA only guards forms. Floods aimed at the server itself need a host with proper DDoS保護. And if comment spam is your whole problem, it can be simpler to turn WordPress comments off entirely.