Discourse Captcha

Customization Plugin
, ,
1
:discourse: Summary Discourse Captcha adds CAPTCHA challenge support to the local sign-up form, with support for multiple providers including hCaptcha and reCAPTCHA.
:open_book: Install guide This plugin is bundled with Discourse core. There is no need to install it separately.

:discourse2: Hosted by us? This plugin is available on our Pro, Business, and Enterprise plans. https://www.discourse.org/plugins/captcha

Supported providers

The plugin supports the following CAPTCHA providers:

  • hCaptcha — a privacy-focused CAPTCHA service with a free tier of up to one million requests per month.
  • reCAPTCHA — Google’s CAPTCHA service.

Both providers require a site key and a secret key, which you obtain from the provider’s dashboard and enter into the plugin settings.

Configuration

:spiral_notepad: The enable_local_logins site setting must be active. The plugin will not work if local logins are disabled.

hCaptcha

  1. Visit hcaptcha.com and create an account. Choose the plan that suits your site’s traffic. A Sitekey and Account Secret are generated during setup.

    :warning: Keep your secret key private at all times.

  2. In your Discourse admin panel, go to Admin → Plugins → Installed → Captcha Settings, or search for captcha in site settings.

  3. Set discourse_captcha_provider to hcaptcha.

  4. Copy the Sitekey into the hcaptcha_site_key setting and the Account Secret into the hcaptcha_secret_key setting.

  5. Enable the plugin via the discourse_captcha_enabled setting.

reCAPTCHA

  1. Visit google.com/recaptcha and sign in with a Google account. Register a new site to receive a Site Key and Secret Key.

    :warning: Keep your secret key private at all times.

  2. In your Discourse admin panel, go to Admin → Plugins → Installed → Captcha Settings, or search for captcha in site settings.

  3. Set discourse_captcha_provider to recaptcha.

  4. Copy the Site Key into the recaptcha_site_key setting and the Secret Key into the recaptcha_secret_key setting.

  5. Enable the plugin via the discourse_captcha_enabled setting.

Upgrading from Discourse hCaptcha

This plugin replaces the previous Discourse hCaptcha plugin. If you were already using hCaptcha, your configuration is preserved automatically — you don’t need to re-enter your keys.

Last edited by @Juan_David_MartĂ­nez 2026-07-21T22:22:58Z

Check documentPerform check on document:
17 Likes
Tips for Preventing Spam
Blocking spammer.<random>.domain registration attempts
A recaptcha plugin?
Hiding "e-mail taken" on sign-up by default
Tips for Preventing Spam
Bundling more popular plugins with Discourse core
Custom dropdown user field contains unselectable value
Registration challenge to stop spam registrations
Is anyone experiencing an odd spam user attack? Any way to block?
18

The image appears to be a screenshot of a code snippet in a text editor or IDE, likely being used for development or debugging purposes. (Captioned by AI)
The image appears to be a screenshot of a code snippet in a text editor or IDE, likely being used for development or debugging purposes. (Captioned by AI)1870Ă—354 27.3 KB

Please help

1 Like
19

It seems that you’re using a plugin, theme, or theme component that is interfering with the hCaptcha plugin. Try using safe mode by disabling the themes to start, and see if the plugin works then.

5 Likes
20

thank you for your response. we solved it with csp policy fix. but it was not opt for our site so we had to remove it and place in other security checks.

2 Likes
21

We have made a fix for this, if you want to give it a try it should work with out any issues now

2 Likes
22

6 posts were split to a new topic: Signin doesn’t work when hCaptcha enabled and keys not configured

24

:partying_face: This plugin is now bundled with Discourse core as part of Bundling more popular plugins with Discourse core. If you are self-hosting and use the plugin, you need to remove it from your app.yml before your next upgrade.

2 Likes
25

Just in case the dev team needs someday a docker compatible alternative to hcaptcha; , this one is nice too GitHub - altcha-org/altcha: GDPR, WCAG 2.2 AA, and EAA compliant, self-hosted CAPTCHA alternative with PoW mechanism. · GitHub ; Free, open-source Captcha alternative | ALTCHA

27

Plugin update: Discourse hCaptcha is now Discourse Captcha :tada:

This plugin has been renamed from Discourse hCaptcha to Discourse Captcha to reflect its expanded scope. It now supports both hCaptcha and reCAPTCHA, with the architecture in place to accommodate additional providers in the future.

The first post has been updated with full setup instructions for both providers.

What’s changed for you:

  • If you were using hCaptcha, no action is needed — your site key, secret key, and enabled state are all preserved automatically.
  • The site setting keys have been updated to use a captcha_ prefix (e.g. captcha_site_key instead of hcaptcha_site_key). These are migrated automatically on upgrade.
  • Self-hosted sites: remove the old discourse-hCaptcha git clone line from your app.yml before rebuilding. See the first post for details.
5 Likes
User Spam - automatic account deletions and domain blacklist
28

This bit is confusing. Does it pertain only to people who self installed and have not upgraded since the plugin was bundled with core?

Thanks for your work on this!

1 Like