[Feature Request] Delaying hCaptcha connection until it is actually required, for better privacy compliance

[asafm7]

With evolving global privacy and ePrivacy regulations, justifying third-party network connections as "strictly necessary" often requires delaying execution until a user shows explicit intent to interact with the protected asset.

Currently, the plugin’s "delayed loading" option triggers on general page interaction (e.g., any scroll or click anywhere on the page). On pages where a form is lower down or secondary to the content, loading the hCaptcha API purely based on general page movement makes it difficult to justify as strictly necessary under strict compliance frameworks.

As compatibility across diverse form types can be difficult, a cascading fallback mechanism, according to what a specific integration or user experience considerations make possible, can be:

• hCaptcha Hover / Click: hCaptcha can load as a static facade, only replaced by a live version when a user interacts with it. I assume legally this is the best option, but it may not always be available or possible while maintaining a decent user experience. Also, it isn't relevant for invisible implementation.
• Submit Button Hover/Click: Intercepting the submission, loading the API, fetching the token, and then releasing/continuing the form submission flow.
• Form Focus / Input: Triggered when the user focuses or inputs text into the first field of a form.
• Form Hover / Pointer Move: Triggered when a cursor enters the form wrapper bounding box (offering a pre-fetch buffer).

Answer to implementation questions requested in the forum:

The form/plugin/integration needed for:

• Primary immediate use case is Jetpack Forms, but the framework should ideally be generic enough to apply via developer selectors or targeted hooks for other standard integrations over time.

Which exact user action should trigger loading:

• Described above.

What should happen if the user submits before hCaptcha has finished loading:

• If a user manages to click the submit button before the API script is fully loaded and executed, the submission event should be intercepted/paused. A loading spinner can be shown natively over the button while the hCaptcha API initializes, obtains the token, and then programmatically refires or resumes the submission flow.

• Whether a developer hook/filter would be acceptable:
  For my specific case, yes, absolutely. I assume allowing a wider audience to improve their privacy compliance with such a feature will require a UI configuration.

Thanks again, and let me know if more information is needed.

[kagg-design]

Thanks for opening the issue and for the detailed write-up.

I agree with the general privacy goal, but I would like to keep the first implementation deliberately narrow. A generic cascading system with submit interception, API initialization, token generation, spinner UI, and resumed submission flow is risky across the number of integrations this plugin supports. It would also be especially fragile for AJAX forms and third-party form plugins that manage their own submit lifecycle.

For the first MVP, I think the realistic scope is a developer-level opt-in mechanism:

• site/plugin code opts into a stricter delay mode via a PHP filter;
• hCaptcha waits for a specific browser event before loading the API;
• the site/plugin code is responsible for deciding when that event should fire;
• no generic submit interception or UI configuration is included in the first version.

This keeps the feature usable for privacy-conscious/custom implementations without making the plugin guess the correct trigger for every form integration.

For example, a site could choose to dispatch the event on Jetpack form focus, button hover, a consent state change, or any other condition it controls. If the event is never dispatched, hCaptcha will not load, so the responsibility for choosing a safe trigger stays with the implementation that enabled the feature.

We will propose a focused, opt-in developer-level solution shortly.

[asafm7]

Thanks, @kagg-design.

It sounds like a solid plan for an MVP.

Looking forward to updates.

[kagg-design]

Please try the v5.1.0-RC4 and let me know.

It implements the hcap_delay_api_event filter. To use it, please add the mu-plugin below.

hcaptcha-delay-api-event.php

P.S. RC4 also includes a fix to delay hCaptcha scripts until Jetpack becomes visible. It works only when no API event is added by the filter above.

[asafm7]

That's great, @kagg-design! I'm away for a few days and will test it when I'm back. Thanks again for your time.

[asafm7]

@kagg-design, I've noticed that the fix has already been released. I have updated the plugin, and it appears to be functioning as expected.

Thank you for addressing the issue.

I hope that, in the future, a more intent-focused solution will be implemented as we discussed.