Download websites that use Really Simple CAPTCHA

About Really Simple CAPTCHA

Some software is chosen and some software simply arrives. Really Simple CAPTCHA is mostly the second kind. The plugin draws a distorted image of a few letters and checks that a form submission repeats them, and it is usually installed because a form plugin asked for it rather than because a site owner sat down and compared bot defences.

Really Simple CAPTCHA is the work of Takayuki Miyoshi, released under GPL v2, written in PHP, and available since 2009. Provenance matters for a component like this. A single maintainer publishing under a copyleft licence in a public plugin directory means anyone can install the code at no cost and nobody is contractually obliged to keep it current, which is the usual arrangement for the small pieces that hold larger sites together.

As of October 2026 we find Really Simple CAPTCHA on 1 site. Counts for bundled components read differently from counts for products. Nobody buys a captcha of this kind, so the number is not a market share. What the number measures is how many public pages still protect a form with a locally generated image challenge rather than with a hosted challenge service or an invisible scoring API.

For a researcher the useful inference is about everything around the plugin. A site serving the fingerprint is running PHP through a WordPress installation with at least one public form, which usually means a contact or enquiry path that a human reads. The vintage matters as well. Image challenges of this design are solvable by commodity optical character recognition, so their continued presence is a fair proxy for a site that has not revisited its spam defences in a long while, and by extension for a site that has probably not audited the rest of its plugin inventory either.

Three audiences ask for a list like this one. Security vendors selling bot mitigation want the sites still relying on an image challenge, because the pitch writes itself. Agencies and maintenance providers want the sites whose plugin stack has drifted, since an outdated form defence rarely travels alone. Researchers measuring the health of the WordPress ecosystem want population figures over time rather than a verdict on any single domain.

A lookup on one domain answers whether that domain carries the plugin. The export answers how many do, on which top level domains they sit, and whether the population shrinks release by release, which is the only practical way to watch an old component actually leave the web. The limit worth stating is that a captcha only shows up where a form shows up. A site that has the plugin installed but keeps the protected form behind a login, or on a page our crawl does not reach, will not present the fingerprint at all, so the count leans low by an amount that cannot be measured from outside.