Short answer: Joomla 5 has no CAPTCHA in core, because the Google reCAPTCHA plugins were removed in Joomla 5. You either install a CAPTCHA extension (reCAPTCHA, hCaptcha, Cloudflare Turnstile or a self-hosted option) or upgrade to Joomla 6.1 or later, which includes a built-in, privacy-friendly Proof-of-Work CAPTCHA based on ALTCHA. In every case, you then set it as the Default Captcha in Global Configuration and switch it on for the forms you want to protect.
What changed with CAPTCHA in Joomla 5 and 6
| Joomla version | CAPTCHA in core | What to do |
|---|---|---|
| Joomla 4 | Captcha – reCAPTCHA (v2) and Invisible reCAPTCHA plugins | Plan the move: these plugins are gone in Joomla 5 |
| Joomla 5.x | None (reCAPTCHA plugins removed) | Install a CAPTCHA extension from the JED |
| Joomla 6.0 | None | Install a CAPTCHA extension, or update to 6.1+ |
| Joomla 6.1+ | Proof-of-Work CAPTCHA (ALTCHA-based, no API key) | Enable the core plugin and set it as the default |
Sources: Joomla Community Magazine, January 2026 and the Joomla 6.1 pull request that added the plugin.
Choose a CAPTCHA: the options compared
| Option | How it works | Privacy (EU/GDPR) | Accessibility | Setup |
|---|---|---|---|---|
| Joomla 6.1 Proof-of-Work (core) | Browser solves a small task in the background | Self-hosted, no third party | Good: nothing for the visitor to solve | Enable the plugin; no keys |
| Google reCAPTCHA v2 / v3 (extension) | Checkbox/images (v2) or a background score (v3) | Data goes to Google: needs privacy-policy and consent review | v2 image challenges can be hard; v3 is invisible | Site + secret key from Google |
| hCaptcha (extension) | Checkbox/challenge or invisible mode | Third-party service: review its terms | Challenges can be hard; accessibility options exist | Site + secret key |
| Cloudflare Turnstile (extension) | Mostly non-interactive check | Third-party service: review its terms | Usually no challenge | Site + secret key |
| Honeypot / anti-spam extensions | Hidden fields and timing checks | Self-hosted | No visitor interaction | Install and configure |
How to set up CAPTCHA in Joomla 6.1+ (core Proof-of-Work)
- Go to System → Manage → Plugins and search for “captcha”.
- Open the Proof-of-Work captcha plugin, set Status: Enabled, review its options and save.
- Go to System → Global Configuration → Site and set Default Captcha to the Proof-of-Work plugin.
- Check each component that has its own CAPTCHA setting (for example Users → Options → User Options for registration, and Contacts → Options → Form) so it uses the default.
- Log out and submit the registration and contact forms as a guest to confirm it works.
How to set up CAPTCHA in Joomla 5 (extension)
- Pick a maintained CAPTCHA extension from the Joomla Extensions Directory that lists Joomla 5 (and 6, if you plan to upgrade) compatibility.
- Install it via System → Install → Extensions and enable its plugin.
- If the service needs keys (reCAPTCHA, hCaptcha, Turnstile), create a site key and secret key for your exact domain(s) and paste them into the plugin.
- Set it as Default Captcha in Global Configuration, then check the per-component settings as above.
- Test as a guest, on mobile and with your page cache enabled.
Where Joomla uses CAPTCHA
- User registration, login (if the extension supports it), password and username reminders
- Contact forms (com_contact)
- Third-party forms and comments that support Joomla’s captcha plugin event (RSForm, Convert Forms, comments extensions and others): check each extension’s settings
Troubleshooting: CAPTCHA not showing or always failing
| Symptom | Likely cause | Fix |
|---|---|---|
| Nothing appears on the form | Plugin disabled, or Default Captcha is “None” | Enable the plugin and set it in Global Configuration |
| Works on registration but not contact | Component-level CAPTCHA set to “None” | Check Contacts → Options |
| “Invalid domain” or key errors | Keys created for another domain or environment | Create keys for the live domain (and staging separately) |
| Fails only for guests on cached pages | Page cache serves an old token or script | Exclude form pages from System – Page Cache |
| Script missing after optimisation | JS combine/defer plugin breaks the CAPTCHA script | Exclude the CAPTCHA script from optimisation |
| Old reCAPTCHA plugin after upgrade to 5/6 | Legacy plugin no longer maintained in core | Replace it with a maintained extension or the 6.1 core plugin |
CAPTCHA, privacy and accessibility
If you serve visitors in the EU, UK or Switzerland, a third-party CAPTCHA can transfer personal data (IP address, browser data) to the provider. List it in your privacy policy and check with your consent setup whether it must wait for consent. A self-hosted option avoids most of this.
For accessibility, avoid image puzzles where you can. WCAG 2.2 criterion 3.3.8 (Accessible Authentication) requires an alternative to cognitive tests on login, which matters under the European Accessibility Act. See our guide on Joomla and the European Accessibility Act.
Related guides
- Joomla security: hardening checklist
- Cookies and GDPR on Joomla
- Joomla 6 and 6.2: what’s new
- Joomla support and maintenance services
Frequently asked questions
Does Joomla 5 have a built-in CAPTCHA?
No. The Google reCAPTCHA plugins were removed from core in Joomla 5, so a clean Joomla 5 install has no CAPTCHA plugin. Install a CAPTCHA extension from the Joomla Extensions Directory (JED), or upgrade to Joomla 6.1+, which ships a built-in Proof-of-Work CAPTCHA.
What is the Joomla 6.1 Proof-of-Work CAPTCHA?
It is a core captcha plugin based on the open-source ALTCHA library. The visitor’s browser solves a small computational task in the background, so there is no image puzzle, no external service and no API key. That makes it privacy-friendly (useful for GDPR) and accessible.
Can I still use Google reCAPTCHA on Joomla 5 or 6?
Yes, through a third-party extension from the JED. If an old core reCAPTCHA plugin survived an upgrade, replace it with a maintained extension, because it is no longer part of core and will not get core updates.
Which CAPTCHA is best for GDPR in the EU?
A self-hosted option such as the Joomla 6.1 Proof-of-Work CAPTCHA avoids sending visitor data to a third party. If you use reCAPTCHA, hCaptcha or Turnstile, mention it in your privacy policy and check whether your cookie-consent setup must block it until consent.
Why is my Joomla CAPTCHA not showing?
The usual causes: the plugin is not enabled, Global Configuration → Default Captcha is still “None”, the form or component has its own CAPTCHA setting overriding the default, the site/secret keys belong to another domain, or a page-cache or JavaScript optimiser is stripping the script.
Do CAPTCHAs affect accessibility?
They can. Image or puzzle CAPTCHAs can block people with disabilities, and WCAG 2.2 success criterion 3.3.8 (Accessible Authentication) says login must not depend on a cognitive test without an alternative. Invisible and proof-of-work methods are the most accessible choices.