An agent can check whether a specific comment looks like spam and pull the site's antispam performance statistics.
2 read
View abilitieshCaptcha for WP abilities, governed through the Bridge
An agent can read a threat snapshot of recent form submissions and top offenders, block offender IDs for a set duration, and export or import the plugin's settings as JSON, optionally including the site and secret keys.
- Abilities
- 42 read2 destructive
- Active installs
- 80K+
- Rating
- 92% (86 ratings)
- Version
- 5.3.0
- Requires
- WP 6.0+, PHP 7.4+
- Last updated
- 2026-09-11 1:57pm GMT
View hCaptcha for WP on WordPress.org
What has to be true first
Needs WordPress 6.9 or newer with hCaptcha for WP active. The threat-snapshot and block-offenders abilities check manage_options; export and import settings check manage_options, or manage_network_options when the integration's settings tab is network-wide.
The 4 hCaptcha for WP abilities
Grouped by what each one can change. Every one starts off until you enable it.
Read 2
- Read
Get Threat Snapshot
Returns a threat snapshot of recent form submissions and top offenders for a requested time window.
- Read
Export Settings
Exports hCaptcha settings as JSON, optionally including the site and secret keys.
Destructive 2
- Destructive
Block Offenders
Blocks offender IDs returned by a threat snapshot for a given duration.
- Destructive
Import Settings
Imports hCaptcha settings from JSON.
How to switch these on
Four steps from two active plugins to a governed connection.
Install hCaptcha for WP and Agent Abilities for MCP
Both plugins need to be active on the same WordPress site. hCaptcha for WP registers its own abilities; this plugin discovers and governs them.
Open the Other plugins screen
In Agent Abilities for MCP, open the Bridge tab (labeled "Other plugins" in the admin). Abilities from every registered plugin appear there, grouped by the plugin that registered them.
Enable one ability at a time
Every ability from hCaptcha for WP starts off. Turn on only the ones you want an agent to reach, or enable the whole set in one click.
Connect as a least-privilege user
Approve the connection as a WordPress account scoped to what you actually want the agent to do. Each call still re-checks that account’s capability before it runs.
Read more in how bridging works or the full documentation.
Frequently asked questions
Does hCaptcha for WP work with the Bridge?
Yes. hCaptcha for WP registers all four of its abilities in the core Abilities API with explicit readonly/destructive annotations, so the Bridge can classify and expose each one directly.
Do hCaptcha for WP's abilities register automatically?
Yes, unconditionally, once hCaptcha for WP is active. Nothing else has to be configured for the Bridge to discover them.
Does hCaptcha for WP need anything special to work with the Bridge?
Needs WordPress 6.9 or newer with hCaptcha for WP active. The threat-snapshot and block-offenders abilities check manage_options; export and import settings check manage_options, or manage_network_options when the integration's settings tab is network-wide.
More Security & privacy plugins
An agent can check exactly where comments are currently disabled across the site or a multisite network, turn comments off or on for specific post types, and delete existing comments.
1 read1 write1 destructive
View abilitiesAn agent can search and read the WordPress activity log: recent events, a single event's detail, one user's activity, failed login attempts, and a statistics summary grouped by users, content, media, plugins, core and notes, all without being able to change anything.
6 read
View abilitiesVerified from hCaptcha for WP's own free wordpress.org code on 28 September 2026, not from its marketing claims. Not every ability listed here has been run end to end against a live site. Plugin authors change their code, so a name, a capability, or a condition can be different in a later release. This site is not affiliated with, or endorsed by, hcaptcha or hCaptcha for WP. Back to the full directory.
Bridge hCaptcha for WP, keep the same control.
Every ability starts off, is scoped to the user you connect, and is written to the same audit log as core. Turn on only what you need.
Off by default. Capability checked on every call.