GateCHA CAPTCHA

GateCHA CAPTCHA connects your WordPress site to your own GateCHA instance — a self-hosted, open-source CAPTCHA management service based on the ALTCHA proof-of-work protocol.

Why GateCHA?

• Privacy-first — No cookies, no fingerprinting, no user tracking. Fully GDPR-compliant.
• Self-hosted — Your challenges and verifications stay on your own server. No data goes to third parties.
• Proof-of-work — Bots must solve a computational puzzle. No annoying image puzzles for humans.
• Centralized stats — Track challenges issued, verified, and failed across all your sites from one dashboard.
• Interaction signals — Optional second opinion on each submission, scored from counts and durations alone. Off by default.

Supported forms:

• WordPress login, registration, password reset, and comments
• WooCommerce login, registration, and password reset
• Contact Form 7
• WPForms
• Gravity Forms
• Elementor Pro Forms
• Forminator
• Formidable Forms
• HTML Forms
• Custom placement via [gatecha] shortcode

Setup in 2 steps:

1. Enter your GateCHA instance URL
2. Enter your API key

That’s it. Enable CAPTCHA on the forms you want to protect.

External Services

This plugin connects to your self-hosted GateCHA instance for CAPTCHA challenge generation and verification. Two API calls are made:

1. GET /api/v1/challenge — Fetched by the user’s browser to obtain a proof-of-work challenge.
2. POST /api/v1/verify — Called from your WordPress server to verify the solved challenge.

One more request happens only when Collect Interaction Signals is enabled, which it is not by default:

1. GET /api/public/his.js — The interaction-signal collector, loaded by the user’s browser from the same instance. It measures aggregates on the pages that carry a CAPTCHA (durations, event counts, total pointer distance, typing rhythm variance) and hands them to your WordPress server with the form, which forwards them to /api/v1/verify. It reads no field values, no pointer coordinates and no key contents.

No data is sent to any third-party service. All communication is between your WordPress installation and your own GateCHA instance at the URL you configure in Settings → GateCHA.

• GateCHA source code: https://github.com/Upellift99/GateCHA

Source Code

The full source of this plugin is available at https://github.com/Upellift99/GateCHA-WordPress.

The plugin’s own JavaScript (assets/js/gatecha.js) and CSS (assets/css/gatecha.css) are shipped unminified and human-readable.

The plugin bundles one third-party library in minified form:

• ALTCHA widget — assets/js/altcha-widget.min.js
  • Version: 2.2.4
  • License: MIT
  • Source code: https://github.com/altcha-org/altcha

This is the unmodified production build distributed on npm as the altcha package (it corresponds to the package’s dist/altcha.js ES module build). To obtain and review the human-readable source, run npm install altcha@2.2.4 and inspect the package’s src/ directory on GitHub.