Show HN: Replacing CAPTCHAs with adaptive proof-of-work in WordPress

A WordPress plugin replaces visible CAPTCHAs with an invisible, adaptive proof-of-work: the visitor’s browser performs a tiny cryptographic computation in the background and the server verifies a signed, single-use token before accepting a submission. It identifies forms by request "signatures" rather than by specific builder integrations, so it protects WordPress logins, registrations, comments, WooCommerce checkout and reviews, and dozens of popular form builders out of the box. Unrecognized or custom forms can be added instantly via a direct analysis mode. The plugin runs entirely on the host server, ships a few kilobytes of JavaScript, needs no API keys or third-party scripts, stores IPs only as hashes, and is designed to be GDPR-friendly and compatible with caching through runtime Ajax token fetching.

The core argument is that making the client pay computationally, invisibly, breaks the economics of mass automated spam without adding friction for real users. Practical benefits include adaptive "under-attack" hardness that tightens during spam waves, brute-force login protection with optional Fail2Ban logs, a message inbox that separates spam from real submissions, and configurable handling (block, flag, or collect). It claims years of production use and closed a reuse-of-challenge attack with single-use tokens in version 5.0. One concrete limitation: externally hosted embedded forms (Typeform, Jotform, HubSpot, etc.) cannot be inspected or protected.