Login
Free Trial

WordPress reCAPTCHA Alternative: How to Replace reCAPTCHA on European Websites

Illustration of a WordPress reCAPTCHA alternative for European websites, showing an “I’m not a robot” checkbox replaced by a .eu user verification system with a security shield and EU flag.
captcha.eu

Google reCAPTCHA works on WordPress. But when you look at what it means for GDPR, cookies, and US data transfers, the picture changes. This guide explains why European WordPress operators are switching, which GDPR-compliant alternatives work with the plugins you already use, and how to replace reCAPTCHA without breaking a single form.

Estimated reading time: 13 minutes

Try CAPTCHA.eu free – no credit card
View all integrations

At a Glance

The core problem

reCAPTCHA sets the _grecaptcha cookie, transfers data to US servers, and triggers ePrivacy consent requirements on every WordPress form it protects

What changed in April 2026

Google switched to a processor model but the cookie remains. European operators still need a lawful basis, updated privacy notices, and a consent mechanism

The practical alternative

Proof-of-work CAPTCHA installed via a WordPress plugin: no cookies, no US transfers, no cookie-consent layer for the CAPTCHA itself, and compatible with the form plugins you already run

What this guide covers

Why reCAPTCHA creates compliance problems on WordPress

WordPress powers around 43% of all websites. It also ships with no built-in spam protection, which is why reCAPTCHA became the default choice for contact forms, login pages, registration flows, and comment sections. The integration is easy, the plugin ecosystem is large, and for a long time the privacy implications received little scrutiny.

That scrutiny has arrived. When you install reCAPTCHA on a WordPress site, three things happen that create compliance exposure for European operators:

  • The _grecaptcha cookie is set. Google confirmed this cookie persists after the April 2026 processor role change. Under the ePrivacy Directive, cookies that are not strictly necessary for a service the user explicitly requested require opt-in consent before being set. Whether the _grecaptcha cookie qualifies as strictly necessary is a legal question that national data protection authorities have answered differently, and in several EU cases, unfavorably for website operators.
  • Data transfers to US servers occur. Even after the April 2026 change, reCAPTCHA data is processed on Google’s infrastructure. For EU operators, this means active transfer mechanisms (Standard Contractual Clauses, adequacy decision coverage) must be documented, reviewed periodically, and disclosed in the privacy notice.
  • Behavioral signals are collected. reCAPTCHA v3 collects mouse movements, typing patterns, and browser fingerprint data to assign risk scores. This constitutes personal data processing under GDPR in most interpretations, requiring a lawful basis separate from the cookie question.

The practical result for a WordPress site: reCAPTCHA typically requires a cookie consent banner, a privacy notice update naming Google as a processor, and documentation of the transfer mechanism. None of this is impossible, but it adds overhead to every WordPress site, including small business sites, association websites, and public sector portals where GDPR applies and administrative capacity is often limited.

The consent banner problem specific to WordPress

Many WordPress operators add reCAPTCHA to login and password reset pages, which are flows that users must complete before they can interact with the site at all. Placing a cookie consent requirement on those pages creates a paradox: the user cannot opt out of a cookie that protects the very form they need to use to log in. Several DPA opinions have noted this tension specifically in the context of CAPTCHA on authentication flows.

What the April 2026 reCAPTCHA change means for WordPress sites specifically

Google’s April 2, 2026 shift moved reCAPTCHA from an independent controller model to a processor model. Google now processes reCAPTCHA Customer Data on your behalf under Google Cloud terms, making you the sole data controller. This is a meaningful structural improvement, but it does not resolve the compliance questions for most WordPress operators.

Three things still apply after April 2026. The _grecaptcha cookie remains and still requires assessment under national ePrivacy rules. You now need to update your privacy notice to remove references to Google’s Privacy Policy and Terms of Service, since those no longer reflect the legal roles accurately. And if your WordPress site exceeds 10,000 reCAPTCHA assessments per month, you now need billing configured in Google Cloud Console; otherwise the service returns errors and your forms lose bot protection silently.

For many WordPress site owners, this migration is the natural moment to ask a bigger question: given that you are already touching the privacy layer and potentially the billing layer, does it make more sense to switch to a solution that removes much of this complexity rather than managing it indefinitely?

For a full breakdown of the April 2026 changes, see our analysis: Migrate from Google reCAPTCHA to CAPTCHA.eu.

The main WordPress reCAPTCHA alternatives compared

Several CAPTCHA solutions offer WordPress plugins. They differ significantly in privacy architecture, form plugin compatibility, and the compliance overhead they introduce.

SOLUTION
MECHANISM
SETS COOKIES
DATA LOCATION
GDPR CONSENT NEEDED
CAPTCHA.eu
Proof-of-work + contextual signals
No
Austria (EU)
No, for CAPTCHA layer
Friendly Captcha
Proof-of-work + global risk database
No
Dedicated EU-only endpoint from Advanced plan. Lower tiers may use global infrastructure.
No, for CAPTCHA layer
Cloudflare Turnstile
Behavioral + browser signals
Yes (cf_clearance in some configs)
US-based
Assess per deployment
hCaptcha
Image challenges + behavioral
Yes
US-based
Yes, likely
reCAPTCHA v3
Behavioral risk scoring
Yes (_grecaptcha)
US-based
Yes, likely
ALTCHA
Proof-of-work (self-hosted)
No
Your servers
No
This comparison is written by the CAPTCHA.eu team and includes our own product. We aim to characterise all solutions fairly based on current public documentation. Where configuration changes the answer, we say so explicitly. Check current documentations for the latest position.

Why proof-of-work solutions remove the consent question

Proof-of-work CAPTCHA asks the visitor’s browser to complete a small cryptographic computation in the background. No cookies are set, no behavioral data is stored against user profiles, and no cross-site tracking occurs. The CAPTCHA layer introduces no personal data processing that requires a separate consent mechanism. This is structurally different from cookie-based approaches where compliance is a configuration question rather than an architectural one.

How to choose the right alternative for your WordPress site

The right choice depends on four questions specific to your setup.

Do you need EU data hosting? If your site operates in a regulated sector (healthcare, public sector, financial services) or your procurement process requires EU-only data residency, CAPTCHA.eu (Austria) and Friendly Captcha (Germany) are the options that satisfy this without additional transfer documentation. Cloudflare Turnstile and hCaptcha involve US-based processing, which typically requires active transfer mechanism review and documentation.

Do you want to eliminate the consent banner entirely? Only proof-of-work solutions achieve this by architecture. Behavioral systems may support configurations that reduce consent requirements, but the assessment depends on your specific deployment, national law, and the signals the system collects. If removing the CAPTCHA-related consent question entirely is a priority, choose proof-of-work.

Which form plugins do you run? Most WordPress sites use Contact Form 7, WPForms, Gravity Forms, Ninja Forms, or Elementor. CAPTCHA.eu supports all of these natively via the WordPress plugin. Check compatibility before switching, especially if you run less common form builders.

Do you self-host? ALTCHA is the only serious self-hosted proof-of-work option with a WordPress plugin. It gives you complete data control but requires server infrastructure and maintenance. For most WordPress operators who want managed CAPTCHA without operational overhead, ALTCHA’s self-hosted model introduces more complexity than it removes.

CAPTCHA.eu fits most European WordPress sites because:

No cookies by architecture. Austria hosting with a standard DPA available. Native WordPress plugin covering login, registration, password reset, comments, and all major form builders. Independent WCAG 2.2 AA certification from TÜV Austria. Transparent pricing from €8.90/month with 100 free verifications to start (pricing as of April 2026; verify current rates at captcha.eu).

Which option fits which WordPress setup?

The best answer depends on what kind of site you run and how much operational complexity you want to carry long-term.

Choose CAPTCHA.eu if…

  • you want EU-hosted processing and no-cookie operation by default,
  • you need a managed solution rather than a self-hosted project,
  • you run Contact Form 7, WPForms, Gravity Forms, WooCommerce, or Elementor,
  • you want the shortest path from plugin install to a compliant live setup.

Choose another route if…

  • you want full self-hosting and can maintain the infrastructure yourself (ALTCHA),
  • you already rely heavily on Cloudflare and prefer to stay in that stack,
  • your compliance team has already approved a specific vendor you need to stick with.

For most European WordPress sites, the decisive factors are plugin compatibility, EU data hosting, and whether the privacy explanation stays simple across all protected flows.

How to replace reCAPTCHA in WordPress with CAPTCHA.eu

Switching takes less than ten minutes for most WordPress setups. Work through the steps below in order: remove reCAPTCHA before activating the replacement to avoid conflicts during the transition window.

  • Remove reCAPTCHA from your WordPress plugins

    Go to Plugins in your WordPress dashboard. Deactivate and delete the existing reCAPTCHA plugin. If reCAPTCHA is configured directly inside a form plugin like WPForms or Gravity Forms, go to that plugin’s settings and remove the reCAPTCHA site key before proceeding.

  • Create a CAPTCHA.eu account and domain

    Register at captcha.eu. After logging in, go to the Dashboard and create a new domain entry for your WordPress site. This generates the API keys you need for the plugin configuration.

  • Install the CAPTCHA.eu WordPress plugin

    In your WordPress dashboard, go to Plugins, click Add New Plugin, and search for “captcha.eu”. Install and activate the plugin. You can also download it directly from the WordPress plugin repository.

  • Enter your API keys in the plugin settings

    Open the CAPTCHA.eu plugin settings in WordPress. Copy your public key and REST key from the CAPTCHA.eu Dashboard and paste them into the corresponding fields. Save the settings.

  • Select which flows to protect

    In the plugin settings, check the boxes for each endpoint you want to protect: Login, Registration, Password Reset, Comments, and any supported form plugins you have installed. Enable protection for all flows that were previously covered by reCAPTCHA.

  • Test each protected flow

    Submit a test entry through each protected form and flow. Verify that the CAPTCHA verification completes silently in the background and that form submissions succeed. Check the CAPTCHA.eu Dashboard to confirm verifications are being logged.

  • Update your privacy notice

    Remove references to Google reCAPTCHA from your privacy policy. Add a brief note that your site uses CAPTCHA.eu for bot protection, with processing in Austria under EU law. If you previously had a consent mechanism for reCAPTCHA cookies, review whether it remains necessary. For CAPTCHA.eu, the cookie-based consent question does not apply.

Replace reCAPTCHA on your WordPress site today

Austria-hosted, no cookies, no cookie-consent layer for the CAPTCHA itself. Works with Contact Form 7, WPForms, Gravity Forms, Ninja Forms, Elementor, and more. 100 free verifications to start.

Start free trial
Contact sales

Which WordPress form plugins does CAPTCHA.eu support?

CAPTCHA.eu protects the core WordPress flows (login, registration, password reset, comments) and integrates with the major form builders used on European WordPress sites. If you run a plugin not listed here, the developer documentation covers custom integration via the API.

Contact Form 7

The most widely used WordPress contact form plugin. CAPTCHA.eu integrates via the plugin settings with no code required.

WPForms

Full integration with WPForms Lite and Pro. Protects all form types including contact, registration, and payment forms.

Gravity Forms

Integration available for Gravity Forms. Suitable for complex multi-step forms and high-value submission flows.

Ninja Forms

Supported via the plugin settings. Protects Ninja Forms submissions without requiring additional configuration.

Elementor Pro Forms

Works with Elementor Pro’s built-in form widget. Covers contact, newsletter, and lead generation forms built in Elementor.

Divi

Compatible with Divi’s form module. Protects forms built with the Divi Builder.

GDPR compliance checklist after switching from reCAPTCHA

Switching the plugin handles the technical layer. These four steps complete the compliance picture.

Update your data processing records. Under GDPR Article 30, controllers must maintain records of processing activities. Remove Google as a processor for CAPTCHA and add CAPTCHA.eu. A standard DPA is available from CAPTCHA.eu for this purpose.

Remove reCAPTCHA from your privacy notice. Delete references to Google reCAPTCHA, the associated data processing description, and any mention of transfer to Google servers. This is now inaccurate and should be corrected promptly.

Add a CAPTCHA.eu disclosure. Your privacy notice should state that the site uses CAPTCHA.eu for bot protection, that processing occurs in Austria under EU law, and that a DPA is available on request.

Review your consent banner. If your previous consent banner included a category or entry specifically for reCAPTCHA cookies, review whether that category remains necessary. For CAPTCHA.eu, no cookie-related consent mechanism is needed for the CAPTCHA layer itself.

Frequently Asked Questions

Does CAPTCHA.eu work with WooCommerce?

Yes. CAPTCHA.eu protects WooCommerce login, registration, and checkout flows via the plugin settings. Those flows are often the highest-value attack surfaces on an ecommerce WordPress site.

Will switching from reCAPTCHA to CAPTCHA.eu affect my conversion rates?

For most sites, switching maintains or improves conversion rates. Proof-of-work CAPTCHA adjusts difficulty computationally rather than showing challenges to flagged users, meaning no visitor encounters a visible CAPTCHA. Stanford research found traditional CAPTCHA reduces form conversions by up to 40%; invisible protection removes that drop-off.

Do I still need a cookie consent banner after switching?

Not for the CAPTCHA layer itself. CAPTCHA.eu sets no cookies for the CAPTCHA function, which removes the specific cookie-consent trigger that reCAPTCHA introduces. Other tools on your site (analytics, marketing tags, embedded content) may still require consent separately.

Is CAPTCHA.eu free for WordPress?

CAPTCHA.eu offers 100 free verifications to start with no credit card required. Paid plans begin at €8.90 per month for 1,000 verifications per month as of April 2026. Verify current pricing at captcha.eu before purchasing. The WordPress plugin itself is free to download and install.

Can I use CAPTCHA.eu with a WordPress multisite installation?

Yes. CAPTCHA.eu supports WordPress multisite. Each site in the network can use a separate domain in the CAPTCHA.eu Dashboard, or you can configure a shared domain for the entire network depending on your setup. The documentation covers multisite configuration in detail.

What happens to my existing reCAPTCHA configuration in Contact Form 7?

When you remove reCAPTCHA from Contact Form 7 and activate the CAPTCHA.eu plugin, the plugin automatically adds CAPTCHA.eu protection to Contact Form 7 submissions. You do not need to edit individual forms. The protection applies at the form submission level, not at the individual form configuration level, which means all your Contact Form 7 forms are covered immediately.

Does CAPTCHA.eu slow down my WordPress site?

No measurable performance impact. The proof-of-work computation runs in the browser while the user fills in the form, so it completes before the user submits. There is no additional page load, no blocking script, and no external resource that delays rendering. The CAPTCHA.eu plugin is lightweight and does not add database queries or background processing that would affect WordPress performance.

Is CAPTCHA.eu accessible for WordPress users with disabilities?

Yes. CAPTCHA.eu holds independent WCAG 2.2 AA certification from TÜV Austria. Because the verification runs invisibly in the background with no challenge of any kind, it creates no accessibility barrier regardless of how a user navigates: keyboard-only, screen reader, switch access, or any other assistive technology. This is particularly relevant for WordPress sites that need to comply with the European Accessibility Act, which became legally binding for EU businesses in June 2025.

Related reading

This guide focuses on the migration decision and process. The articles below answer the next questions most teams have once they decide to re-evaluate Cloudflare Turnstile.

Primary sources
Google reCAPTCHA FAQ (April 2026): confirmation that the _grecaptcha cookie persists after the controller-to-processor role change
CAPTCHA.eu: Is reCAPTCHA GDPR-Compliant in 2026?: analysis of the April 2026 changes and their compliance implications
CAPTCHA.eu WCAG 2.2 AA Certification: independently certified by TÜV Austria
European Accessibility Act (Directive 2019/882): WCAG 2.2 AA legally binding for EU businesses from June 2025
Stanford University study: CAPTCHA challenges reduce form conversions by up to 40%
Transparency: This article is written by the CAPTCHA.eu team. Competitor options are characterised based on their public product pages and documentation. If you find an inaccuracy, contact us and we will correct it.

Try the European alternative built for privacy-first deployments

If your team needs low-friction bot protection with Austrian hosting, no cookies at the CAPTCHA layer, EU-based processing, transparent pricing, and TÜV-certified accessibility, test CAPTCHA.eu on a real flow before you decide. Start with your login, sign-up, or contact form. 100 free requests, no credit card required.

Start free trial
Contact sales

Recent Posts

en_USEnglish
de_DEGerman fr_FRFrench es_ESSpanish nl_NLDutch it_ITItalian en_USEnglish