Everything happens within WordPress
You activate the protection and it runs on your own site. No need to open an account elsewhere, no need to fetch a key. The plugin works as soon as you activate it, right from your own site.
Protection that stays with you
Rootcha protects your WordPress forms
The idea is simple: to stop spam without outsourcing anything. You activate Rootcha in WordPress, and the protection runs on your own server – no need to open an account elsewhere, no keys to configure and no extra steps for your visitors.
No third-party cookies are set
Verification takes place entirely within your website and does not set any cookies on behalf of an external service. Your privacy policy remains straightforward and your website retains control over the data.
The visitor submits the form without having to do anything
The verification takes place automatically, in the background. The form and submission proceed as normal, with no images to sort or boxes to tick to prove you’re human.
WordPress CAPTCHA Comparison
Why choose Rootcha over other WordPress anti-spam plugins?
Rootcha protects your forms directly from within WordPress, without the need to create an external account or manage a separate dashboard. You benefit from a simpler setup, verification that’s invisible to visitors, and protection tailored to the everyday needs of WordPress sites.
| Solution | Free | Account required | API key | Third-party cookies | Visual puzzle | Stats in WP |
|---|---|---|---|---|---|---|
| Rootcha | Oui | Non | Non | Non | Non | Oui |
| reCAPTCHA v3 | Plan gratuit | Google requis | Oui | Oui | Non | Non |
| hCaptcha | Plan gratuit | hCaptcha requis | Oui | Oui | Configurable | Non |
| Cloudflare Turnstile | Oui | Cloudflare requis | Oui | Non | Non | Non |
| Friendly Captcha | Plan gratuit | Requis | Oui | Non | Non | Non |
| Akismet | Usage personnel | WordPress.com | Oui | Non | Non | Partiel |
WordPress Compatibility
The entry points that bots target first are covered as soon as
Contact Form 7, comments and registration are automatically protected. Log-in remains optional, which avoids having to add verification everywhere when the need is often limited to just a few forms.
Contact Form 7
AutomaticThe widget is added to forms without you having to edit each page manually.
WordPress Comments
AutomaticPublic comments can be moderated before publication to reduce moderation overhead.
Registration
AutomaticFake registrations and automated account creations are filtered out as soon as the feature is activated, without the need for any specific settings.
Log in
OptionalLogin protection can still be enabled on a case-by-case basis so as not to create friction everywhere by default.
Shortcode [rootcha]
ManualIn specific cases, the shortcode allows you to add Rootcha exactly where you want it.
Are you being inundated with bots?
Block spam without a third-party account, without an API key and without relying on the cloud
Less spam, no more tedious forms
When a WordPress form gets flooded with fake messages, it quickly becomes useless. Rootcha provides protection directly within WordPress and filters out automated submissions before they reach your inbox, whilst maintaining a discreet verification process for genuine visitors.
Account required toactivate itNo
API key to beconfiguredNo
Visual puzzle to solve:No
Third-party cookies subject toconsent: No
Dependency on anexternalservice: None
Statistics inWordPress: Yes
FAQ
Useful questions to ask before installing Rootcha
Rootcha est-il vraiment gratuit, sans limitation de volume ?
u003cpu003eOui, sans restriction. Rootcha ne dépend pas d’un service externe avec un palier gratuit limité. Il tourne entièrement dans votre installation WordPress, quel que soit le volume de soumissions.u003c/pu003e
Rootcha fonctionne-t-il avec d’autres plugins de formulaire que Contact Form 7 ?
u003cpu003eContact Form 7 est couvert automatiquement. Pour tout autre formulaire HTML, le shortcode u003ccodeu003e[rootcha]u003c/codeu003e permet d’ajouter la protection exactement à l’endroit voulu, sans modifier le plugin de formulaire.u003c/pu003e
Concrètement, comment Rootcha vérifie-t-il qu’un envoi est légitime ?
u003cpu003eAu moment de l’envoi, le navigateur résout une petite « preuve de travail » : un court calcul, limité dans le temps, qui produit un jeton à usage unique. Ce jeton est ensuite vérifié côté serveur grâce à une signature HMAC calculée avec un secret stocké sur votre site. Un jeton copié, modifié ou réutilisé hors de sa fenêtre de validité est rejeté.u003c/pu003e
Que se passe-t-il si un visiteur a JavaScript désactivé ?
u003cpu003eLa vérification s’exécute dans le navigateur et nécessite JavaScript. Sans JS, Rootcha ne peut pas produire la preuve attendue. Si ce cas compte pour vous, il faut prévoir une autre barrière ou accepter qu’une petite partie des soumissions passe sans cette protection.u003c/pu003e
Rootcha ralentit-il le chargement de la page ?
u003cpu003eLe script se charge de manière asynchrone et le calcul s’exécute en arrière-plan. En pratique, l’impact reste faible sur une page standard, mais il vaut mieux le vérifier sur votre site si vous surveillez de près les performances.u003c/pu003e