“How do I replace reCAPTCHA on WordPress?”
How do I replace reCAPTCHA on WordPress?
Short answer
Install a replacement CAPTCHA plugin, remove the reCAPTCHA keys from your form plugin, enable the new one on each form, and test login, registration, comments and checkout. With CaptchaKit, install the plugin from wordpress.org, paste your site key and API key in Settings, CaptchaKit, then choose the forms and the game.
Steps
- 1
List what uses reCAPTCHA today
Write down every form that loads reCAPTCHA: wp-login.php, registration, comments, contact forms, WooCommerce checkout. Check your form plugin settings and your theme.
- 2
Get your CaptchaKit keys
Create your access on the pricing page (pay what you want, from $1), then copy your site key and API key from the dashboard. Site keys start with gc_ and API keys with cgv_.
- 3
Install the plugin
In wp-admin go to Plugins, Add New, search for CaptchaKit, then choose Install Now and Activate. The plugin is on wordpress.org.
- 4
Paste the keys and pick forms
Go to Settings, CaptchaKit. Paste the site key and API key, tick login, registration, comments and WooCommerce checkout as needed, choose a game, and click Save Settings.
- 5
Remove the old reCAPTCHA keys
In your form plugin or reCAPTCHA plugin, clear the site and secret keys and disable the old plugin so two CAPTCHAs do not stack on one form.
- 6
Test every form
Log out and try login, registration, a comment and a test order. Confirm each shows the game and that the submit button works only after the visitor passes.
Before you start
Plan a quiet moment for this. A CAPTCHA swap touches your login, so keep a second browser session logged in as admin while you test. If you lock yourself out, you can deactivate the plugin by renaming its folder over FTP or your host's file manager.
If you are still deciding whether to switch, read CaptchaKit vs reCAPTCHA and the WordPress roundup.
What the plugin covers
CaptchaKit's plugin protects WordPress login (against brute-force and credential-stuffing bots), registration, comment forms and WooCommerce checkout, classic and Blocks. Server-side verification runs inside the plugin: it sends the visitor's token to CaptchaKit's API before the form is allowed through, so there is nothing to code.
For a custom theme form or a plugin form the CaptchaKit plugin does not cover, use the embed from the docs: one script tag, one div, and one server call. The integrations page lists what is available.
Choosing a game for each form
The docs list a best-for hint per game. Whack-a-Bot is listed for login forms, Stack It for comment forms and Fruit Sorter for e-commerce checkouts. Average play times range from 6 to 20 seconds, so a shorter game such as Tap in Order keeps checkout quick.
After the swap
Watch your spam queue and failed logins for a week. If you run Business ($29 a month), the dashboard shows solve rates and bot blocks. Cookie banners: check what the widget sets in a clean browser and read CaptchaKit's privacy policy, which says no advertising or tracking cookies are used.
If something fails, the most common cause is a caching plugin serving a stale page without the widget. Exclude the login and checkout pages from caching, then retest.
If something goes wrong
The widget does not appear: clear page caches and exclude login, registration and checkout pages from caching. The form submits without the game: confirm the right forms are ticked in Settings, CaptchaKit and that no other plugin overrides the form. Verification fails for real visitors: re-copy the site key and API key and check there are no spaces. A game feels too slow on checkout: pick a shorter one, such as Tap in Order.
If you are locked out of wp-admin by a login CAPTCHA problem, rename the plugin's folder in wp-content/plugins using your host's file manager to deactivate it, then log in and fix the settings.
If you use a form plugin with its own reCAPTCHA field
Many form plugins have their own reCAPTCHA field or global key setting. Remove that field from each form and clear the global keys so the old script stops loading. Then either use the CaptchaKit plugin's coverage if the form is a core WordPress form, or add the CaptchaKit embed to the form template and verify on the server. The embed snippet and the verify call are in the docs.
Questions
Do I need to write code?
Not for standard WordPress and WooCommerce forms. The plugin handles the widget and the server-side check.
Which forms does the plugin protect?
WordPress login, registration, comments and WooCommerce checkout (classic and Blocks).
Where do I find my keys?
In your CaptchaKit dashboard after you claim access. Paste them in Settings, CaptchaKit.
Can I run both reCAPTCHA and CaptchaKit?
Remove the old one from each form so visitors face one challenge, not two.
What if a visitor cannot play the game?
The widget has a "Can't play? Accessible check" link that switches to a screen-reader-friendly question and issues the same token.
Does it work with page builders and custom forms?
For forms the plugin does not cover, add the embed from the docs and verify the token on your server.
How long does the swap take?
For the standard forms it is a plugin install, two keys and a round of tests. Allow longer if you have custom forms.
Sources
- CaptchaKit on WordPress.org (checked 2026-10-17)
- CaptchaKit integrations (checked 2026-10-17)
- CaptchaKit documentation (checked 2026-10-17)
- CaptchaKit privacy policy (checked 2026-10-17)
Related
Protect your forms with a game
Every arcade CAPTCHA we make. Sign up, grab your embed code, protect your forms today.
Get started →Pay what you want. Start free.