{"id":310257,"date":"2026-06-15T17:08:18","date_gmt":"2026-06-15T17:08:18","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/hashcash-proof-of-work-captcha\/"},"modified":"2026-06-15T17:07:50","modified_gmt":"2026-06-15T17:07:50","slug":"captcha-hashcash","status":"publish","type":"plugin","link":"https:\/\/mya.wordpress.org\/plugins\/captcha-hashcash\/","author":23492111,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.10","stable_tag":"1.0.10","tested":"7.0","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"HashCash - Proof of Work CAPTCHA","header_author":"Michael Richey \/ RicheyWeb","header_description":"Invisible Proof-of-Work anti-spam protection. No tracking, no cookies, no third parties.","assets_banners_color":"","last_updated":"2026-06-15 17:07:50","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/www.paypal.com\/donate\/?hosted_button_id=BTL9WZ8NU56RC","header_plugin_uri":"https:\/\/www.richeyweb.com\/software\/wordpress\/plugins\/captcha-hashcash","header_author_uri":"https:\/\/www.richeyweb.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":36,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.10":{"tag":"1.0.10","author":"richeyweb","date":"2026-06-15 17:07:50"}},"upgrade_notice":{"1.0.2":"<p>Adds Argon2id support and smart proof-of-work refresh. Recommended for all users.<\/p>"},"ratings":[],"assets_icons":[],"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.10"],"block_files":[],"assets_screenshots":[],"screenshots":{"1":"Settings page \u2014 adjust difficulty, algorithm, and behavior options","2":"Form protection in action \u2014 brief indicator, no user interaction required"}},"plugin_section":[],"plugin_tags":[2656,109,362,1152,34331],"plugin_category":[44,54],"plugin_contributors":[267276],"plugin_business_model":[],"class_list":["post-310257","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-antispam","plugin_tags-captcha","plugin_tags-contact-form-7","plugin_tags-proof-of-work","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-richeyweb","plugin_committers-richeyweb"],"banners":[],"icons":{"svg":false,"icon":"https:\/\/s.w.org\/plugins\/geopattern-icon\/captcha-hashcash.svg","icon_2x":false,"generated":true},"screenshots":[],"raw_content":"<!--section=description-->\n<p>https:\/\/www.youtube.com\/watch?v=HbzP1NsaiwI<\/p>\n\n<p><strong>HashCash<\/strong> stops spam by making the visitor's browser do the work \u2014 not the visitor.<\/p>\n\n<p>While your user fills out a form, HashCash runs a cryptographic proof-of-work calculation silently in the background. By the time they hit Submit, the work is done. No checkbox to click. No images to identify. No third-party service watching over their shoulder.<\/p>\n\n<p>This is the WordPress port of a Joomla plugin with a 12-year track record \u2014 originally released three years before Google launched reCAPTCHA v3. The core idea hasn't changed: spam protection should be invisible to real users and brutal to bots.<\/p>\n\n<p><strong>What makes HashCash different:<\/strong><\/p>\n\n<ul>\n<li><strong>No third-party services.<\/strong> No reCAPTCHA, no hCaptcha, no Cloudflare Turnstile. Nothing phones home.<\/li>\n<li><strong>No tracking, no cookies.<\/strong> GDPR and CCPA friendly by design, not by policy.<\/li>\n<li><strong>Nothing for users to solve.<\/strong> A brief \"Securing this form...\" indicator appears while the calculation runs \u2014 that's it. No puzzles, no clicks, no friction.<\/li>\n<li><strong>Logged-in users are exempt.<\/strong> Trusted users never see the indicator at all.<\/li>\n<li><strong>Adjustable difficulty.<\/strong> SHA-256 at level 1 by default for maximum compatibility. Argon2id available for sites that need state-of-the-art memory-hard hashing.<\/li>\n<li><strong>Bot punishment mode.<\/strong> Suspicious behavior triggers difficulty so high the proof-of-work becomes computationally unsolvable. The bot spins forever. Legitimate users never notice.<\/li>\n<li><strong>Automatic protection.<\/strong> Works out of the box on WordPress comments, login, registration, lost password, and Contact Form 7. No configuration required.<\/li>\n<\/ul>\n\n<p><strong>Supported hash algorithms:<\/strong>\n* SHA-256 (default \u2014 fast, broadly compatible)\n* SHA-384 \/ SHA-512\n* PBKDF2\n* PBKDF2 (64KB)\n* Argon2id (recommended for maximum security \u2014 requires PHP sodium extension)<\/p>\n\n<p><strong>Works automatically with:<\/strong>\n* WordPress comment forms\n* WordPress login form\n* WordPress registration form\n* WordPress lost password form\n* Contact Form 7<\/p>\n\n<p><strong>Add to any other form:<\/strong><\/p>\n\n<p>Use the shortcode <code>[hashcash]<\/code> to add protection to any form on your site.<\/p>\n\n<h3>Support<\/h3>\n\n<p>For support, feature requests, or custom integrations:\nhttps:\/\/www.richeyweb.com\/<\/p>\n\n<p>HashCash for WordPress is maintained by Michael Richey \u2014 author of the original Joomla HashCash plugin, with over 12 years of proof-of-work CAPTCHA development.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the <code>captcha-hashcash<\/code> folder to <code>\/wp-content\/plugins\/<\/code><\/li>\n<li>Activate through the <strong>Plugins<\/strong> menu in WordPress<\/li>\n<li>Go to <strong>Settings \u2192 HashCash<\/strong> to review defaults<\/li>\n<li>Done. All supported forms are protected automatically.<\/li>\n<\/ol>\n\n<p>No API keys. No account required. No third-party setup.<\/p>\n\n<!--section=faq-->\n<dl>\n<dt id=\"does%20this%20replace%20recaptcha%20%2F%20hcaptcha%3F\"><h3>Does this replace reCAPTCHA \/ hCaptcha?<\/h3><\/dt>\n<dd><p>Yes. HashCash requires no third-party service, no API key, and sends no data to external servers. If you're using reCAPTCHA or hCaptcha specifically to avoid tracking your users, HashCash is a direct replacement.<\/p><\/dd>\n<dt id=\"what%20does%20the%20user%20actually%20see%3F\"><h3>What does the user actually see?<\/h3><\/dt>\n<dd><p>While the proof-of-work calculation runs, a brief \"Securing this form...\" message appears and the submit button is temporarily disabled. When the calculation completes \u2014 usually within seconds at default settings \u2014 the button re-enables and the indicator disappears. There is nothing for the user to click, solve, or interact with.<\/p><\/dd>\n<dt id=\"do%20logged-in%20users%20see%20the%20indicator%3F\"><h3>Do logged-in users see the indicator?<\/h3><\/dt>\n<dd><p>No. Logged-in users are exempt from HashCash verification entirely.<\/p><\/dd>\n<dt id=\"will%20it%20slow%20down%20my%20site%3F\"><h3>Will it slow down my site?<\/h3><\/dt>\n<dd><p>No. The proof-of-work calculation runs in a Web Worker (a background browser thread) and only starts when the user interacts with the form. Your page load time is not affected.<\/p><\/dd>\n<dt id=\"what%20is%20argon2id%20and%20should%20i%20use%20it%3F\"><h3>What is Argon2id and should I use it?<\/h3><\/dt>\n<dd><p>Argon2id is the current gold standard for memory-hard cryptographic hashing \u2014 it's specifically designed to be expensive for bots running at scale while remaining fast enough for individual users. It requires the PHP sodium extension (available by default in PHP 7.2+). If your server supports it, it's the strongest option available. SHA-256 remains the default for maximum compatibility.<\/p><\/dd>\n<dt id=\"what%20is%20%22bot%20punishment%20mode%22%3F\"><h3>What is \"bot punishment mode\"?<\/h3><\/dt>\n<dd><p>When suspicious behavior is detected (automated form submission patterns, headless browsers, CDP runtime signatures), HashCash can either silently fail or make the proof-of-work impossible to solve. Punishment mode chooses the latter \u2014 the bot wastes significant compute resources without knowing it was detected, while legitimate users are unaffected.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20contact%20form%207%3F\"><h3>Does it work with Contact Form 7?<\/h3><\/dt>\n<dd><p>Yes, automatically. If the user is not logged in, HashCash is injected into every CF7 form without any configuration. You can also use the <code>[hashcash]<\/code> shortcode for manual placement.<\/p><\/dd>\n<dt id=\"is%20it%20accessible%3F\"><h3>Is it accessible?<\/h3><\/dt>\n<dd><p>Yes. The indicator is visual feedback only \u2014 it does not interfere with screen readers or keyboard navigation. There is no interactive challenge of any kind.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20the%20proof-of-work%20expires%3F\"><h3>What happens if the proof-of-work expires?<\/h3><\/dt>\n<dd><p>Each proof-of-work calculation is timestamped. On submission, the server verifies that timestamp is within 30 minutes of the current time \u2014 this prevents replay attacks, where a bot captures a valid solution and reuses it repeatedly. HashCash automatically refreshes the calculation before it expires, so users who leave a form open for an extended period never encounter a validation failure on submission.<\/p><\/dd>\n<dt id=\"is%20this%20related%20to%20the%20original%20hashcash%20email%20anti-spam%20system%3F\"><h3>Is this related to the original HashCash email anti-spam system?<\/h3><\/dt>\n<dd><p>Yes. HashCash as a concept dates to 1997 \u2014 it was originally designed to combat email spam using proof-of-work. This plugin applies the same principle to web forms, using modern cryptographic algorithms where the original used SHA-1.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Argon2id support added \u2014 state-of-the-art memory-hard hashing via PHP sodium extension<\/li>\n<li>Smart proof-of-work refresh \u2014 automatically re-mines before expiration<\/li>\n<li>Improved bot detection \u2014 CDP runtime detection, headless browser fingerprinting<\/li>\n<li>Contact Form 7 automatic integration<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Bug fix: shortcode name attribute<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial WordPress release<\/li>\n<li>Ported from Joomla HashCash (12-year track record)<\/li>\n<li>SHA-256, SHA-384, SHA-512, PBKDF2 support<\/li>\n<li>Automatic protection for comments, login, registration, lost password<\/li>\n<li>Bot punishment mode<\/li>\n<li>Adjustable difficulty (1\u201312)<\/li>\n<\/ul>","raw_excerpt":"Invisible Proof-of-Work CAPTCHA. No checkboxes, no image grids, no Google, no tracking. Just spam protection that gets out of the way.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/310257","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=310257"}],"author":[{"embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/richeyweb"}],"wp:attachment":[{"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=310257"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=310257"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=310257"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=310257"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=310257"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/mya.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=310257"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}