HashCash – Proof of Work CAPTCHA

HashCash stops spam by making the visitor’s browser do the work — not the visitor.

While your user fills out a form, HashCash runs a cryptographic proof-of-work calculation silently in the background. By the time they hit Submit, the work is done. No checkbox to click. No images to identify. No third-party service watching over their shoulder.

This is the WordPress port of a Joomla plugin with a 12-year track record — originally released three years before Google launched reCAPTCHA v3. The core idea hasn’t changed: spam protection should be invisible to real users and brutal to bots.

What makes HashCash different:

• No third-party services. No reCAPTCHA, no hCaptcha, no Cloudflare Turnstile. Nothing phones home.
• No tracking, no cookies. GDPR and CCPA friendly by design, not by policy.
• Nothing for users to solve. A brief “Securing this form…” indicator appears while the calculation runs — that’s it. No puzzles, no clicks, no friction.
• Logged-in users are exempt. Trusted users never see the indicator at all.
• Adjustable difficulty. SHA-256 at level 1 by default for maximum compatibility. Argon2id available for sites that need state-of-the-art memory-hard hashing.
• Bot punishment mode. Suspicious behavior triggers difficulty so high the proof-of-work becomes computationally unsolvable. The bot spins forever. Legitimate users never notice.
• Automatic protection. Works out of the box on WordPress comments, login, registration, lost password, and Contact Form 7. No configuration required.

Supported hash algorithms:
* SHA-256 (default — fast, broadly compatible)
* SHA-384 / SHA-512
* PBKDF2
* PBKDF2 (64KB)
* Argon2id (recommended for maximum security — requires PHP sodium extension)

Works automatically with:
* WordPress comment forms
* WordPress login form
* WordPress registration form
* WordPress lost password form
* Contact Form 7

Add to any other form:

Use the shortcode [hashcash] to add protection to any form on your site.

Support

For support, feature requests, or custom integrations:
https://www.richeyweb.com/

HashCash for WordPress is maintained by Michael Richey — author of the original Joomla HashCash plugin, with over 12 years of proof-of-work CAPTCHA development.