{"id":350882,"date":"2026-08-19T22:26:47","date_gmt":"2026-08-19T22:26:47","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/usehuma-invisible-bot-protection-no-captcha\/"},"modified":"2026-08-19T22:26:32","modified_gmt":"2026-08-19T22:26:32","slug":"usehuma","status":"publish","type":"plugin","link":"https:\/\/ms.wordpress.org\/plugins\/usehuma\/","author":23544897,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.2","stable_tag":"1.0.2","tested":"7.0.4","requires":"5.8","requires_php":"7.4","requires_plugins":null,"header_name":"useHUMA \u2014 Invisible Bot Protection (No CAPTCHA)","header_author":"useHUMA","header_description":"Stop comment spam, fake registrations and form bots with invisible behavioral verification \u2014 no puzzles, no checkboxes, zero PII. Protects comments, registration and Contact Form 7.","assets_banners_color":"363a3d","last_updated":"2026-08-19 22:26:32","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"https:\/\/humaverify.com","header_author_uri":"","rating":0,"author_block_rating":0,"active_installs":0,"downloads":40,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.2":{"tag":"1.0.2","author":"usehuma","date":"2026-08-19 22:26:32"}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3655426,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3655426,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3655426,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3655426,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.2"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[2656,166108,262186,107,599],"plugin_category":[44,54],"plugin_contributors":[276587],"plugin_business_model":[],"class_list":["post-350882","plugin","type-plugin","status-publish","hentry","plugin_tags-anti-spam","plugin_tags-bot-protection","plugin_tags-captcha-alternative","plugin_tags-comments","plugin_tags-spam","plugin_category-discussion-and-community","plugin_category-security-and-spam-protection","plugin_contributors-usehuma","plugin_committers-usehuma"],"banners":{"banner":"https:\/\/ps.w.org\/usehuma\/assets\/banner-772x250.png?rev=3655426","banner_2x":"https:\/\/ps.w.org\/usehuma\/assets\/banner-1544x500.png?rev=3655426","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/usehuma\/assets\/icon-128x128.png?rev=3655426","icon_2x":"https:\/\/ps.w.org\/usehuma\/assets\/icon-256x256.png?rev=3655426","generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>CAPTCHAs interrupt every visitor to catch a few bots \u2014 and modern bots solve them anyway. useHUMA takes the opposite approach: it observes <em>how<\/em> a visitor behaves (mouse rhythm, typing cadence, scroll patterns, touch physics) and scores the probability that a real human is present. Real visitors feel nothing. Bots get blocked.<\/p>\n\n<p><strong>What it protects:<\/strong><\/p>\n\n<ul>\n<li><strong>Comments<\/strong> \u2014 spam comments are rejected before they reach your moderation queue<\/li>\n<li><strong>User registration<\/strong> \u2014 fake account signups are stopped at the door<\/li>\n<li><strong>Contact Form 7<\/strong> \u2014 form spam is invalidated on submission (if CF7 is installed)<\/li>\n<\/ul>\n\n<p><strong>Why site owners choose it:<\/strong><\/p>\n\n<ul>\n<li><strong>Invisible<\/strong> \u2014 no checkbox, no image puzzles, no friction for real visitors<\/li>\n<li><strong>Privacy-first<\/strong> \u2014 zero PII: no keystroke contents, no names, no fingerprinting databases; only statistical aggregates of interaction patterns<\/li>\n<li><strong>Fail-open by design<\/strong> \u2014 if the verification service is ever unreachable, your forms keep working<\/li>\n<li><strong>Tells you when it was an AI agent<\/strong> \u2014 not just bot or human. Playwright, Puppeteer, browser extensions and computer-use agents come back with their own verdict, on every plan including the free one<\/li>\n<li><strong>One setting<\/strong> \u2014 paste your API key and you're protected<\/li>\n<\/ul>\n\n<p>You'll need an API key from <a href=\"https:\/\/humaverify.com\/signup?utm_source=wordpress\">humaverify.com<\/a>. It is free and it stays free: every account starts with 14 days of the Starter plan and then settles on the Free plan, 1,000 verifications a month, for ever, no credit card. Most small sites never need more than that.<\/p>\n\n<h3>External services<\/h3>\n\n<p>This plugin connects to the useHUMA API (https:\/\/humaverify.com) to score form submissions. On each protected submission, the plugin sends: anonymous behavioral statistics collected on the page (timing variance of mouse\/keyboard\/scroll\/touch interactions \u2014 never the contents of what was typed) and a pseudonymous identifier. When the form provides an email address it is hashed on your server first, with a salt generated once and stored only in your own WordPress database, so the address itself never leaves your site and the hash cannot be reversed or matched against any other site. No other personal data is transmitted.<\/p>\n\n<p>This service is provided by useHUMA: <a href=\"https:\/\/humaverify.com\/terms\">terms of service<\/a>, <a href=\"https:\/\/humaverify.com\/privacy\">privacy policy<\/a>.<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Install and activate the plugin.<\/li>\n<li>Get a free API key at <a href=\"https:\/\/humaverify.com\/signup?utm_source=wordpress\">humaverify.com\/signup<\/a>. No credit card.<\/li>\n<li>Go to <strong>Settings \u2192 useHUMA<\/strong>, paste your API key, and choose what to protect.<\/li>\n<li>Done \u2014 protection is invisible from this point on.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"will%20my%20visitors%20see%20a%20captcha%20or%20checkbox%3F\"><h3>Will my visitors see a CAPTCHA or checkbox?<\/h3><\/dt>\n<dd><p>No. Verification is completely invisible. Visitors just use your site normally; the behavioral score happens in the background.<\/p><\/dd>\n<dt id=\"what%20data%20is%20collected%3F\"><h3>What data is collected?<\/h3><\/dt>\n<dd><p>Only statistical aggregates of interaction timing (e.g. \"how much did typing rhythm vary\"), never the contents of what a visitor types, and never biometric identifiers. See the External services section for the full list.<\/p><\/dd>\n<dt id=\"what%20happens%20if%20the%20usehuma%20api%20is%20down%3F\"><h3>What happens if the useHUMA API is down?<\/h3><\/dt>\n<dd><p>The plugin fails open: submissions are allowed through. An outage will never lock real users out of your forms.<\/p><\/dd>\n<dt id=\"what%20is%20strict%20mode%3F\"><h3>What is strict mode?<\/h3><\/dt>\n<dd><p>By default, submissions without behavioral signals (e.g. from visitors with JavaScript disabled) are allowed. Strict mode rejects them \u2014 which blocks direct-POST bots completely, at the cost of also blocking no-JavaScript visitors.<\/p><\/dd>\n<dt id=\"is%20it%20really%20free%2C%20or%20is%20it%20a%20trial%20that%20ends%3F\"><h3>Is it really free, or is it a trial that ends?<\/h3><\/dt>\n<dd><p>Both. Every account gets 14 days on the Starter plan, then settles on the Free plan and stays there: 1,000 verifications a month, no expiry, no card, with the AI-agent verdict included. A thousand a month is enough for most personal and small business sites. If your forms see more than that, the paid plans start at $49 a month, and the same API key keeps working.<\/p><\/dd>\n<dt id=\"does%20it%20work%20with%20caching%20plugins%3F\"><h3>Does it work with caching plugins?<\/h3><\/dt>\n<dd><p>Yes. The collector runs client-side after page load, so full-page caching doesn't affect it.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Email addresses are now hashed on your own server before anything is sent. The address itself never leaves your site, and the readme no longer claims zero PII while transmitting one.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>The bundled collector now reports automation tells, and the plugin forwards them instead of dropping them. Without this a headless browser that moved the cursor a little was scored as a real visitor.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: comment, registration and Contact Form 7 protection, settings page, bundled behavioral collector.<\/li>\n<\/ul>","raw_excerpt":"Stop comment spam, fake registrations and form bots with invisible behavioral verification \u2014 no puzzles, no checkboxes, zero PII.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/350882","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=350882"}],"author":[{"embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/usehuma"}],"wp:attachment":[{"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=350882"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=350882"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=350882"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=350882"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=350882"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/ms.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=350882"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}