Title: useHUMA — Invisible Bot Protection (No CAPTCHA)
Author: usehuma
Published: <strong>2026 年 8 月 19 日</strong>
Last modified: 2026 年 8 月 21 日

---

搜尋外掛

![](https://ps.w.org/usehuma/assets/banner-772x250.png?rev=3655426)

![](https://ps.w.org/usehuma/assets/icon-256x256.png?rev=3655426)

# useHUMA — Invisible Bot Protection (No CAPTCHA)

 由 [usehuma](https://profiles.wordpress.org/usehuma/) 開發

[下載](https://downloads.wordpress.org/plugin/usehuma.1.0.2.zip)

 * [詳細資料](https://tw.wordpress.org/plugins/usehuma/#description)
 * [使用者評論](https://tw.wordpress.org/plugins/usehuma/#reviews)
 *  [安裝方式](https://tw.wordpress.org/plugins/usehuma/#installation)
 * [開發資訊](https://tw.wordpress.org/plugins/usehuma/#developers)

 [技術支援](https://wordpress.org/support/plugin/usehuma/)

## 外掛說明

CAPTCHAs interrupt every visitor to catch a few bots — and modern bots solve them
anyway. useHUMA takes the opposite approach: it observes _how_ a visitor behaves(
mouse rhythm, typing cadence, scroll patterns, touch physics) and scores the probability
that a real human is present. Real visitors feel nothing. Bots get blocked.

**What it protects:**

 * **Comments** — spam comments are rejected before they reach your moderation queue
 * **User registration** — fake account signups are stopped at the door
 * **Contact Form 7** — form spam is invalidated on submission (if CF7 is installed)

**Why site owners choose it:**

 * **Invisible** — no checkbox, no image puzzles, no friction for real visitors
 * **Privacy-first** — zero PII: no keystroke contents, no names, no fingerprinting
   databases; only statistical aggregates of interaction patterns
 * **Fail-open by design** — if the verification service is ever unreachable, your
   forms keep working
 * **Tells you when it was an AI agent** — not just bot or human. Playwright, Puppeteer,
   browser extensions and computer-use agents come back with their own verdict, 
   on every plan including the free one
 * **One setting** — paste your API key and you’re protected

You’ll need an API key from [humaverify.com](https://humaverify.com/signup?utm_source=wordpress).
It is free and it stays free: every account starts with 14 days of the Starter plan
and then settles on the Free plan, 1,000 verifications a month, for ever, no credit
card. Most small sites never need more than that.

### External services

This plugin connects to the useHUMA API (https://humaverify.com) to score form submissions.
On each protected submission, the plugin sends: anonymous behavioral statistics 
collected on the page (timing variance of mouse/keyboard/scroll/touch interactions—
never the contents of what was typed) and a pseudonymous identifier. When the form
provides an email address it is hashed on your server first, with a salt generated
once and stored only in your own WordPress database, so the address itself never
leaves your site and the hash cannot be reversed or matched against any other site.
No other personal data is transmitted.

This service is provided by useHUMA: [terms of service](https://humaverify.com/terms),
[privacy policy](https://humaverify.com/privacy).

## 螢幕擷圖

[⌊The whole configuration: one API key, a threshold, and what to protect. The key
is free at humaverify.com.⌉⌊The whole configuration: one API key, a threshold, and
what to protect. The key is free at humaverify.com.⌉[

The whole configuration: one API key, a threshold, and what to protect. The key 
is free at humaverify.com.

[⌊What your visitors see on a protected form: the form. No puzzle, no checkbox, 
no badge.⌉⌊What your visitors see on a protected form: the form. No puzzle, no checkbox,
no badge.⌉[

What your visitors see on a protected form: the form. No puzzle, no checkbox, no
badge.

## 安裝方式

 1. Install and activate the plugin.
 2. Get a free API key at [humaverify.com/signup](https://humaverify.com/signup?utm_source=wordpress).
    No credit card.
 3. Go to **Settings  useHUMA**, paste your API key, and choose what to protect.
 4. Done — protection is invisible from this point on.

## 常見問題集

### Will my visitors see a CAPTCHA or checkbox?

No. Verification is completely invisible. Visitors just use your site normally; 
the behavioral score happens in the background.

### What data is collected?

Only statistical aggregates of interaction timing (e.g. “how much did typing rhythm
vary”), never the contents of what a visitor types, and never biometric identifiers.
See the External services section for the full list.

### What happens if the useHUMA API is down?

The plugin fails open: submissions are allowed through. An outage will never lock
real users out of your forms.

### What is strict mode?

By default, submissions without behavioral signals (e.g. from visitors with JavaScript
disabled) are allowed. Strict mode rejects them — which blocks direct-POST bots 
completely, at the cost of also blocking no-JavaScript visitors.

### Is it really free, or is it a trial that ends?

Both. Every account gets 14 days on the Starter plan, then settles on the Free plan
and stays there: 1,000 verifications a month, no expiry, no card, with the AI-agent
verdict included. A thousand a month is enough for most personal and small business
sites. If your forms see more than that, the paid plans start at $49 a month, and
the same API key keeps working.

### Does it work with caching plugins?

Yes. The collector runs client-side after page load, so full-page caching doesn’t
affect it.

## 使用者評論

這個外掛目前沒有任何使用者評論。

## 參與者及開發者

以下人員參與了開源軟體〈useHUMA — Invisible Bot Protection (No CAPTCHA)〉的開發相關
工作。

參與者

 *   [ usehuma ](https://profiles.wordpress.org/usehuma/)

[將〈useHUMA — Invisible Bot Protection (No CAPTCHA)〉外掛本地化為台灣繁體中文版](https://translate.wordpress.org/projects/wp-plugins/usehuma)

### 對開發相關資訊感興趣？

任何人均可[瀏覽程式碼](https://plugins.trac.wordpress.org/browser/usehuma/)、查看
[SVN 存放庫](https://plugins.svn.wordpress.org/usehuma/)，或透過 [RSS](https://plugins.trac.wordpress.org/log/usehuma/?limit=100&mode=stop_on_copy&format=rss)
訂閱[開發記錄](https://plugins.trac.wordpress.org/log/usehuma/)。

## 變更記錄

#### 1.0.2

 * Email addresses are now hashed on your own server before anything is sent. The
   address itself never leaves your site, and the readme no longer claims zero PII
   while transmitting one.

#### 1.0.1

 * The bundled collector now reports automation tells, and the plugin forwards them
   instead of dropping them. Without this a headless browser that moved the cursor
   a little was scored as a real visitor.

#### 1.0.0

 * Initial release: comment, registration and Contact Form 7 protection, settings
   page, bundled behavioral collector.

## 中繼資料

 *  版本 **1.0.2**
 *  最後更新 **1 個月前**
 *  啟用安裝數 **少於 10 次**
 *  WordPress 版本需求 ** 5.8 或更新版本 **
 *  已測試相容的 WordPress 版本 **7.0.5**
 *  PHP 版本需求 ** 7.4 或更新版本 **
 *  語言
 * [English (US)](https://wordpress.org/plugins/usehuma/)
 * 標籤:
 * [anti-spam](https://tw.wordpress.org/plugins/tags/anti-spam/)[bot protection](https://tw.wordpress.org/plugins/tags/bot-protection/)
   [captcha alternative](https://tw.wordpress.org/plugins/tags/captcha-alternative/)
   [comments](https://tw.wordpress.org/plugins/tags/comments/)[spam](https://tw.wordpress.org/plugins/tags/spam/)
 *  [進階檢視](https://tw.wordpress.org/plugins/usehuma/advanced/)

## 評分

這個項目尚無任何評論記錄。

[撰寫評分](https://wordpress.org/support/plugin/usehuma/reviews/#new-post)

[查看全部使用者評論](https://wordpress.org/support/plugin/usehuma/reviews/)

## 參與者

 *   [ usehuma ](https://profiles.wordpress.org/usehuma/)

## 技術支援

使用者可在技術支援論壇提出意見反應或使用問題。

 [檢視技術支援論壇](https://wordpress.org/support/plugin/usehuma/)