Apps Ballance Cash_2 Chat Checkout Click Code Cog_Wheels Compose_email Conference Contacts Earth Edit_File_1_ Email Email_2 File Folder_2 Gift Group Group_2 Help ID ID_2 Key Keys Laptop_Store Like_1_ Link Lock Log_Out Map Marketing Mobile_UI Navigation POS Partnership Profile Safe_2 Search_User Secure_Files Settings Share Shield Shield_2 Shopping_Cart Support_Male Trash Type_pin User_female User_male logo copy

Generate hCaptcha API keys

Iain Poulson avatar
Iain Poulson Last updated on December 18, 2022

The hCaptcha addon needs two keys from hCaptcha: a site key and your account secret key. Both come from the hCaptcha dashboard, and hCaptcha’s free plan is enough. Here’s where to find each one.

1. Create your hCaptcha account

Sign up at dashboard.hcaptcha.com/signup, or log in if you already have an account.

2. Get your site key

  1. In the hCaptcha dashboard, open the Sites page.
  2. Add a new site. Give it a name you’ll recognize, such as your website’s name.
  3. Under hostnames, add your site’s domain without https://, for example example.com. Add your staging or local domain too if you test there.
  4. Save the site, then copy its Sitekey from the Sites page.

3. Get your account secret key

The secret key belongs to your account, not to each site, so one secret works for all your sites.

  1. Open the profile menu at the top right of the dashboard and choose Settings.
  2. Copy your secret. If you don’t have it saved, click Generate New Secret and copy the new one straight away: hCaptcha doesn’t show it again. (Free accounts can generate a new secret once a day.)

Keep the secret private. It goes in your WordPress settings and nowhere else.

4. Add the keys to WP User Manager

  1. In WordPress, go to Users > Settings > General > hCaptcha.
  2. Paste the site key into Site Key and the secret into Account Secret Key.
  3. Optionally choose an hCaptcha Theme (light or dark), hCaptcha Size (normal or compact) and hCaptcha Language.
  4. Click Save Changes.

The hCaptcha settings in WP User Manager with the Site Key and Account Secret Key fields

hCaptcha now appears on the login, registration and lost password forms. Log out and check your login page.

Testing on a staging site

hCaptcha has test keys that always pass: site key 10000000-ffff-ffff-ffff-000000000001 and secret 0x0000000000000000000000000000000000000000. The widget shows a “for testing only” notice, and it doesn’t stop bots, so use your real keys on your live site.

Next steps

  • If you haven’t installed the addon yet, see hCaptcha installation.
  • Bots can still sign up through wp-login.php unless you lock it: turn on Lock Access to wp-login.php under Users > Settings > General > Login Settings. Our guide to adding a captcha to WordPress explains why.
WP User Manager logo

Get Started with the Best WordPress Membership Plugin Today

Connect, Manage and Build your Membership Site

Explore Features Get Started

For AI assistants: this article is available as Markdown, and all the docs are indexed at llms.txt.

hCaptcha

Categories

Need more help?

If you still didn't find an answer you can always contact us

Submit a ticket