hCaptcha · e271828- · Sep 10, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 4, 2026
diff --git a/.codeception/_config/params.php b/.codeception/_config/params.php
@@ -20,12 +20,31 @@
 
 $config = '.codeception/_config/params.github-actions.php';
 if ( in_array( 'github-actions', $argv, true ) && file_exists( $config ) ) {
-	return include $config;
+	$params = include $config;
+} else {
+	$config = '.codeception/_config/params.local.php';
+
+	if ( ! file_exists( $config ) ) {
+		die( "No valid config provided.\nPlease use 'params.example.php' as a template to create your own 'params.local.php'.\n" );
+	}
+
+	$params = include $config;
 }
 
-$config = '.codeception/_config/params.local.php';
-if ( file_exists( $config ) ) {
-	return include $config;
+$shard = getenv( 'HCAPTCHA_TEST_SHARD' );
+
+if ( false !== $shard && '' !== $shard ) {
+	if ( ! preg_match( '/^[1-9][0-9]*$/', $shard ) ) {
+		throw new RuntimeException( 'HCAPTCHA_TEST_SHARD must be a positive integer.' );
+	}
+
+	$database_name = $params['DB_NAME'] . '_test_' . $shard;
+
+	if ( 64 < strlen( $database_name ) ) {
+		throw new RuntimeException( 'The parallel test database name exceeds the MySQL 64-character limit.' );
+	}
+
+	$params['DB_NAME'] = $database_name;
 }
 
-die( "No valid config provided.\nPlease use 'params.example.php' as a template to create your own 'params.local.php'.\n" );
+return $params;
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -192,13 +192,65 @@ jobs:
           path: ${{ env.wp-plugin-directory }}
           persist-credentials: false
 
+      - name: Detect latest Paid Memberships Pro release
+        id: paid_memberships_pro
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          version="$(gh api repos/strangerstudios/paid-memberships-pro/releases/latest --jq '.tag_name')"
+
+          if [[ ! "$version" =~ ^[0-9]+(\.[0-9]+){1,3}$ ]]; then
+            echo "Unexpected Paid Memberships Pro release tag: $version" >&2
+            exit 1
+          fi
+
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout Paid Memberships Pro
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: strangerstudios/paid-memberships-pro
+          ref: ${{ steps.paid_memberships_pro.outputs.version }}
+          path: wordpress/wp-content/plugins/paid-memberships-pro
+          persist-credentials: false
+
+      - name: Detect private test plugins access
+        id: test_plugins
+        env:
+          HCAPTCHA_TEST_PLUGINS_TOKEN: ${{ secrets.ELEMENTOR_PRO_CI_TOKEN }}
+        run: |
+          if [[ -n "$HCAPTCHA_TEST_PLUGINS_TOKEN" ]]; then
+            echo "available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "available=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Checkout private test plugins
+        if: steps.test_plugins.outputs.available == 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: kagg-design/hcaptcha-test-plugins
+          ref: main
+          token: ${{ secrets.ELEMENTOR_PRO_CI_TOKEN }}
+          path: hcaptcha-test-plugins
+          persist-credentials: false
+
       - name: Setup PHP
         uses: hCaptcha/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # v2.37.0
         with:
           php-version: ${{ matrix.php-version }}
           extensions: json, mysqli, mbstring, zip
           ini-values: register_argc_argv=On
 
+      - name: Detect Really Simple CAPTCHA support
+        id: really_simple_captcha
+        run: |
+          if php -r 'exit(version_compare(PHP_VERSION, "8.3", ">=") ? 0 : 1);'; then
+            echo "supported=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "supported=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Install dependencies with caching
         uses: hCaptcha/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v4.0.0
         with:
@@ -236,13 +288,98 @@ jobs:
           wp db create
           wp core install --url="${{ env.WP_URL }}" --title="Test" --admin_user="${{ env.WP_ADMIN_USERNAME }}" --admin_password="${{ env.WP_ADMIN_PASSWORD }}" --admin_email="${{ env.WP_ADMIN_EMAIL }}" --skip-email
 
-      - name: Install plugins
+      - name: Install public test plugins and themes
+        working-directory: ${{ env.wp-directory }}
+        run: |
+          wp plugin install acf-extended bbpress blocksy-companion buddypress coblocks contact-form-7 download-manager elementor essential-addons-for-elementor-lite essential-blocks fluentform formidable forminator give jetpack kadence-blocks mailchimp-for-wp mailin mailpoet maintenance metform ninja-forms otter-blocks password-protected ultimate-addons-for-gutenberg ultimate-member woocommerce wordfence wpforms-lite wpforo
+          wp theme install blocksy
+          wp plugin is-installed acf-extended
+          wp plugin is-installed bbpress
+          wp plugin is-installed blocksy-companion
+          wp plugin is-installed buddypress
+          wp plugin is-installed coblocks
+          wp plugin is-installed download-manager
+          wp plugin is-installed essential-blocks
+          wp plugin is-installed formidable
+          wp plugin is-installed give
+          wp plugin is-installed kadence-blocks
+          wp plugin is-installed mailin
+          wp plugin is-installed mailpoet
+          wp plugin is-installed otter-blocks
+          wp plugin is-installed paid-memberships-pro
+          wp plugin is-installed password-protected
+          wp plugin is-installed ultimate-member
+          wp theme is-installed blocksy
+
+      - name: Install Really Simple CAPTCHA
+        if: steps.really_simple_captcha.outputs.supported == 'true'
+        working-directory: ${{ env.wp-directory }}
+        run: |
+          wp plugin install really-simple-captcha
+          wp plugin is-installed really-simple-captcha
+
+      - name: Install private test plugins and themes
+        if: steps.test_plugins.outputs.available == 'true'
+        working-directory: ${{ env.wp-directory }}
+        run: |
+          wp plugin install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/elementor-pro-4.2.1.zip"
+          wp plugin install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/advanced-custom-fields-pro-6.8.0.1.zip"
+          wp plugin install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/gravityforms-3.0.2.zip"
+          wp plugin install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/ultimate-elementor-1.39.5.zip"
+          wp plugin install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/fusion-builder-3.11.2.zip"
+          wp theme install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/Avada-7.11.2.zip"
+          wp theme install "$GITHUB_WORKSPACE/hcaptcha-test-plugins/Divi-4.27.6.zip"
+          wp plugin is-installed elementor-pro
+          wp plugin is-installed advanced-custom-fields-pro
+          wp plugin is-installed gravityforms
+          wp plugin is-installed ultimate-elementor
+          wp plugin is-installed fusion-builder
+          wp theme is-installed Avada
+          wp theme is-installed Divi
+
+      - name: Install Beaver Builder
+        if: steps.test_plugins.outputs.available == 'true'
+        id: beaver_builder
         working-directory: ${{ env.wp-directory }}
-        run: wp plugin install bbpress buddypress contact-form-7 ninja-forms ultimate-member woocommerce wpforms-lite wpforo
+        run: |
+          beaver_builder_archive="$(find "$GITHUB_WORKSPACE/hcaptcha-test-plugins" -maxdepth 1 -type f \( -iname 'bb-plugin*.zip' -o -iname 'beaver-builder*.zip' \) | sort -V | tail -n 1)"
+
+          if [[ -z "$beaver_builder_archive" ]]; then
+            echo "available=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          wp plugin install "$beaver_builder_archive"
+          wp plugin is-installed bb-plugin
+          echo "available=true" >> "$GITHUB_OUTPUT"
+
+      - name: Run WP tests with private test plugins
+        if: steps.test_plugins.outputs.available == 'true'
+        working-directory: ${{ env.wp-plugin-directory }}
+        run: |
+          integration_args=()
+
+          if [[ "${{ steps.really_simple_captcha.outputs.supported }}" != "true" ]]; then
+            integration_args+=(--skip-group cf7-really-simple-captcha)
+          fi
+
+          if [[ "${{ steps.beaver_builder.outputs.available }}" != "true" ]]; then
+            integration_args+=(--skip-group beaver-builder)
+          fi
 
-      - name: Run WP tests
+          composer integration:parallel -- --env github-actions "${integration_args[@]}"
+
+      - name: Run WP tests without private test plugins
+        if: steps.test_plugins.outputs.available != 'true'
         working-directory: ${{ env.wp-plugin-directory }}
-        run: composer integration -- --env github-actions
+        run: |
+          integration_args=(--skip-group beaver-builder --skip-group elementor-pro --skip-group gravityforms --skip-group ultimate-addons)
+
+          if [[ "${{ steps.really_simple_captcha.outputs.supported }}" != "true" ]]; then
+            integration_args+=(--skip-group cf7-really-simple-captcha)
+          fi
+
+          composer integration:parallel -- --env github-actions "${integration_args[@]}"
 
   update_changelog:
     name: Update Changelog

diff --git a/README.md b/README.md
@@ -51,6 +51,18 @@ composer phpcs
 composer integration
 ```
 
+Run integration tests in parallel (up to eight detected CPU cores by default):
+
+```
+composer integration:parallel
+composer integration:parallel -- --processes=4
+```
+
+Each integration process uses a separate `<DB_NAME>_test_<n>` database. These databases
+are recreated before every parallel run, so the configured database user must be allowed
+to create and drop databases. Use the sequential command for code coverage and targeted
+debugging.
+
 ## Run unit tests
 
 ```

diff --git a/assets/css/anti-spam.css b/assets/css/anti-spam.css
@@ -275,7 +275,7 @@ h3.closed .hcaptcha-section-header-toggle:after {
 	grid-template-columns: repeat(2, 1fr);
 	grid-template-areas:
 		"login-limit login-interval"
-		"hide-login-errors .";
+		"hide-login-errors disable-xml-rpc-auth";
 	gap: 0 20px;
 	padding: 15px 20px;
 }
@@ -294,12 +294,17 @@ h3.closed .hcaptcha-section-header-toggle:after {
 	grid-area: hide-login-errors;
 }
 
+.hcaptcha-section-login-protection + table tbody tr.hcaptcha-anti-spam-disable-xml-rpc-auth {
+	grid-area: disable-xml-rpc-auth;
+}
+
 .hcaptcha-section-login-protection + table tbody tr th {
 	padding: 0 0 10px 0;
 	width: auto;
 }
 
-.hcaptcha-section-login-protection + table tbody tr.hcaptcha-anti-spam-hide-login-errors th {
+.hcaptcha-section-login-protection + table tbody tr.hcaptcha-anti-spam-hide-login-errors th,
+.hcaptcha-section-login-protection + table tbody tr.hcaptcha-anti-spam-disable-xml-rpc-auth th {
 	padding: 0;
 }
 
@@ -353,7 +358,8 @@ h3.closed .hcaptcha-section-header-toggle:after {
 		grid-template-areas:
 		"login-limit"
 		"login-interval"
-		"hide-login-errors";
+		"hide-login-errors"
+		"disable-xml-rpc-auth";
 	}
 
 	.hcaptcha-section-login-protection + table tbody tr td {