# Generate hCaptcha API keys

URL: https://wpusermanager.com/article/317-generate-hcaptcha-api-keys/
Last updated: 2026-10-16

The [hCaptcha addon](https://wpusermanager.com/addons/hcaptcha/) needs two keys from hCaptcha: a **site key** and your **account secret key**. Both come from the hCaptcha dashboard, and hCaptcha's free plan is enough. Here's where to find each one.

1. Create your hCaptcha account
-------------------------------

Sign up at [dashboard.hcaptcha.com/signup](https://dashboard.hcaptcha.com/signup), or log in if you already have an account.

2. Get your site key
--------------------

1. In the hCaptcha dashboard, open the **Sites** page.
2. Add a new site. Give it a name you'll recognize, such as your website's name.
3. Under hostnames, add your site's domain without `https://`, for example `example.com`. Add your staging or local domain too if you test there.
4. Save the site, then copy its **Sitekey** from the Sites page.

3. Get your account secret key
------------------------------

The secret key belongs to your account, not to each site, so one secret works for all your sites.

1. Open the profile menu at the top right of the dashboard and choose **Settings**.
2. Copy your secret. If you don't have it saved, click **Generate New Secret** and copy the new one straight away: hCaptcha doesn't show it again. (Free accounts can generate a new secret once a day.)

Keep the secret private. It goes in your WordPress settings and nowhere else.

4. Add the keys to WP User Manager
----------------------------------

1. In WordPress, go to **Users > Settings > General > hCaptcha**.
2. Paste the site key into **Site Key** and the secret into **Account Secret Key**.
3. Optionally choose an **hCaptcha Theme** (light or dark), **hCaptcha Size** (normal or compact) and **hCaptcha Language**.
4. Click **Save Changes**.

![The hCaptcha settings in WP User Manager with the Site Key and Account Secret Key fields](https://wpusermanager.com/content/uploads/2026/10/wordpress-recaptcha-05-hcaptcha-settings-cb63e03b.webp)

hCaptcha now appears on the login, registration and lost password forms. Log out and check your login page.

Testing on a staging site
-------------------------

hCaptcha has test keys that always pass: site key `10000000-ffff-ffff-ffff-000000000001` and secret `0x0000000000000000000000000000000000000000`. The widget shows a "for testing only" notice, and it doesn't stop bots, so use your real keys on your live site.

Next steps
----------

- If you haven't installed the addon yet, see [hCaptcha installation](https://wpusermanager.com/article/316-hcaptcha-installation/).
- Bots can still sign up through `wp-login.php` unless you lock it: turn on **Lock Access to wp-login.php** under **Users > Settings > General > Login Settings**. Our guide to [adding a captcha to WordPress](https://wpusermanager.com/tutorials/how-to-easily-add-google-recaptcha-to-wordpress-step-by-step/) explains why.