The plugin supports the following CAPTCHA providers:
hCaptcha — a privacy-focused CAPTCHA service with a free tier of up to one million requests per month.
reCAPTCHA — Google’s CAPTCHA service.
Both providers require a site key and a secret key, which you obtain from the provider’s dashboard and enter into the plugin settings.
Configuration
The enable_local_logins site setting must be active. The plugin will not work if local logins are disabled.
hCaptcha
Visit hcaptcha.com and create an account. Choose the plan that suits your site’s traffic. A Sitekey and Account Secret are generated during setup.
Keep your secret key private at all times.
In your Discourse admin panel, go to Admin → Plugins → Installed → Captcha Settings, or search for captcha in site settings.
Set discourse_captcha_provider to hcaptcha.
Copy the Sitekey into the hcaptcha_site_key setting and the Account Secret into the hcaptcha_secret_key setting.
Enable the plugin via the discourse_captcha_enabled setting.
reCAPTCHA
Visit google.com/recaptcha and sign in with a Google account. Register a new site to receive a Site Key and Secret Key.
Keep your secret key private at all times.
In your Discourse admin panel, go to Admin → Plugins → Installed → Captcha Settings, or search for captcha in site settings.
Set discourse_captcha_provider to recaptcha.
Copy the Site Key into the recaptcha_site_key setting and the Secret Key into the recaptcha_secret_key setting.
Enable the plugin via the discourse_captcha_enabled setting.
Upgrading from Discourse hCaptcha
This plugin replaces the previous Discourse hCaptcha plugin. If you were already using hCaptcha, your configuration is preserved automatically — you don’t need to re-enter your keys.
It seems that you’re using a plugin, theme, or theme component that is interfering with the hCaptcha plugin. Try using safe mode by disabling the themes to start, and see if the plugin works then.
thank you for your response. we solved it with csp policy fix. but it was not opt for our site so we had to remove it and place in other security checks.
This plugin is now bundled with Discourse core as part of Bundling more popular plugins with Discourse core. If you are self-hosting and use the plugin, you need to remove it from your app.yml before your next upgrade.
Plugin update: Discourse hCaptcha is now Discourse Captcha
This plugin has been renamed from Discourse hCaptcha to Discourse Captcha to reflect its expanded scope. It now supports both hCaptcha and reCAPTCHA, with the architecture in place to accommodate additional providers in the future.
The first post has been updated with full setup instructions for both providers.
What’s changed for you:
If you were using hCaptcha, no action is needed — your site key, secret key, and enabled state are all preserved automatically.
The site setting keys have been updated to use a captcha_ prefix (e.g. captcha_site_key instead of hcaptcha_site_key). These are migrated automatically on upgrade.
Self-hosted sites: remove the old discourse-hCaptcha git clone line from your app.yml before rebuilding. See the first post for details.
Yes, this only affects people who self-host. If you use captcha and think you might be affected, search your app.yml file for discourse-hCaptcha. If it exists, remove the line and rebuild Discourse.
Hosted by us? This plugin is available on our Pro, Business, and Enterprise plans. https://www.discourse.org/plugins/captcha
The
Keep your secret key private at all times.
This plugin is now bundled with Discourse core as part of 
