Start with the verification location
A lightweight, pleasant widget can still depend on a remote API. If you need verification entirely on your PHP or WordPress infrastructure, check the validation server as carefully as the browser script.
Gaitcha pairs a JavaScript client with a local PHP engine. Cloudflare Turnstile is managed: its integration verifies tokens with Cloudflare. ALTCHA offers an open-source proof-of-work widget and different hosting products. Friendly Captcha describes automatic verification using proof of work and risk signals, with several offerings including an enterprise self-hosted endpoint option.
Product scopes change. Check the Turnstile documentation, ALTCHA and Friendly Captcha for current details. This page does not rank their security performance.
Four questions to ask
| Question | What to check |
|---|---|
| Where does data go? | Script origin, verification endpoint, logs and temporary state |
| What does a visitor do? | Required interaction, slow devices, keyboards and assistive technology |
| What does your team operate? | Installation, updates, shared storage and diagnostics |
| What abuse are you facing? | Opportunistic spam versus targeted attacks, volume and additional defenses |
Running Gaitcha
Gaitcha asks for a checkbox interaction and evaluates the gesture. Proof of work can add a cost per token. You control the code, configuration and hosting.
You also maintain the installation: apply updates, check rejected submissions and adjust the configuration to your forms. The troubleshooting guide covers token expiry, AJAX fields and retries.
Library or plugin?
Choose the PHP library for a custom application. You define the endpoint, storage and submission handling.
Choose Gaitcha for WordPress for the eight supported builders and native forms. The plugin already enables proof of work and anti-replay. For WooCommerce checkout or custom membership forms, plan a separate integration.
Can Gaitcha replace reCAPTCHA on an existing form?
Gaitcha can provide spam verification for a supported form, but it is not a drop-in replacement for the reCAPTCHA API. Changing a site key is not enough.
On staging, install the WordPress connector or PHP integration, replace the old captcha field and its server validation, then test real submissions and retries. Remove the old provider’s script and unused keys once that migration is verified. Check email delivery as well as the success message.
For a custom application, the migration includes the initialization endpoint, hidden widget fields and PHP validation. For WordPress, first check your exact builder in the integration list. Unsupported checkout and membership flows need their own integration work.
Test before replacing
Use a staging environment and real mouse, keyboard and touch interactions. Check rejection, expiry, retries and the final form delivery. Keep a rollback path and your existing rate limits.
Try the widget, then read the implementation details. Competitor sources reviewed on 1 October 2026.
A question or an edge case?
Start a conversation on GitHub