The short version: in 2026, Cloudflare Turnstile is the best captcha for most WordPress sites — it is free, privacy-respecting, and usually invisible to real users. hCaptcha remains a strong alternative, especially if you want to monetise verification traffic.
PBN sites and small business sites get absolutely drowned in comment and contact-form spam. High-authority PBN domains in particular are popular targets for automated spammers because a single successful comment can seed a link that outlasts the entire spam campaign. A decent captcha cuts that noise by 95%+ with minimal impact on legitimate visitors.
The options worth considering
Cloudflare Turnstile (recommended)
Launched in 2023 and now mature. Turnstile is Cloudflare's captcha alternative and has several advantages over the older options:
- Free and unlimited — no tier limits on volume
- Privacy-respecting — no cross-site tracking and no data flow back to ad networks
- Usually invisible — legitimate visitors see nothing; only suspicious traffic sees a challenge
- Works even for visitors without Cloudflare on their own sites
- WordPress integration via the Simple Cloudflare Turnstile plugin
Live demo (test sitekey — always passes):
For most WordPress use cases this is the right default.
hCaptcha
hCaptcha launched in 2018 and is now mature. It works the same way visually (click-the-boxes challenge when triggered) and remains a strong privacy-respecting choice.
- Free for basic use with generous monthly limits
- Privacy-respecting — does not feed ad-tech networks the way Google's reCAPTCHA does
- Opt-in Publisher programme pays small amounts for verification volume on high-traffic sites
- Same familiar challenge UX as reCAPTCHA v2 (select-the-images)
- WordPress integration via the hCaptcha for WordPress plugin
Live demo (test sitekey — always passes):
Honeypot (no captcha at all)
Honeypot techniques add a hidden form field that real users never fill in but bots frequently do. If the hidden field is populated, reject the submission. No captcha, no external service, completely invisible to real visitors. Coverage is not as strong as a proper captcha against modern bots, but as a first layer it costs nothing. Zero Spam for WordPress is a solid free honeypot plugin. Akismet (free for non-commercial, paid for commercial) is another option that uses pattern detection rather than a visible challenge.
Which should I pick?
- PBN site where you want to allow some comments: Cloudflare Turnstile. Privacy-respecting, free, invisible.
- Main business site, privacy-conscious: Turnstile or hCaptcha.
- Zero external services: honeypot plugin + Akismet for detection.
Frequently asked
Do I need a captcha if I block backlink checkers and AI crawlers?
Yes — captcha handles the form-spam bots specifically. Those bots target WordPress comment endpoints with automated POSTs regardless of whether they are blocked by user agent elsewhere.
Will a captcha hurt my Core Web Vitals?
Turnstile is the lightest of the external services (~15 KB). hCaptcha is around 40–80 KB depending on how it loads. Honeypot methods are zero overhead. For PBN sites where page-weight matters, prefer Turnstile or honeypot.
Does Bulk Buy Hosting include any anti-spam by default?
No — we host the sites and leave spam mitigation to you so you can choose what fits your setup. For PBN sites the cleanest answer is usually to disable comments entirely (a one-line change in wp-config.php or via any comment-management plugin); if you keep comments on, use Cloudflare Turnstile or hCaptcha.
What about Akismet?
Akismet is a good complement to any of the above — it catches comment spam that gets past the captcha based on content patterns. Free for personal use, paid for commercial. Works well alongside Turnstile or honeypot.
