Turnstile, reCAPTCHA or hCaptcha for WooCommerce
Pick the provider you already have an account with, or the one your shoppers are least likely to trip over:
- Cloudflare Turnstile;
- hCaptcha;
- Google reCAPTCHA, version 2 or version 3;
- a built-in math challenge that needs no account at all.
Off by default. No CAPTCHA appears until a provider and forms are chosen.
Forms the WooCommerce CAPTCHA plugin can cover
You tick the forms one by one. On the WooCommerce side that means the My Account login, the My Account registration form, the classic checkout and the block checkout. For the block checkout the challenge is also checked on the Store API route, the endpoint the checkout sends orders to, so a bot that skips the page and posts there directly still has to pass it.
The same settings cover WordPress's own login, registration, lost-password and comment forms, plus Contact Form 7, Elementor Pro forms, WPForms and Essential Addons login and sign-up widgets. If another plugin already puts a CAPTCHA on one of those forms, WP SecureGate notices the conflict. For the wider WordPress side, see WordPress CAPTCHA.
No forms are ticked by default. Each one is switched on separately.
CAPTCHA on WooCommerce checkout: the wallet-button trade-off
A checkout challenge has a real cost. Express wallet buttons such as Apple Pay, Google Pay and PayPal take payment without the shopper filling in the checkout form, so there is nowhere for a challenge to appear. While a checkout CAPTCHA applies, those buttons stop working.
If most of your sales come through wallets, the next option is usually the better fit. It is one of several checkout layers in the WooCommerce security plugin, and the others work without any challenge.
The checkout CAPTCHA is off by default, so wallet buttons are unaffected until you turn it on.
Ask for it only during an attack
Instead of challenging every buyer, you can tell WP SecureGate to ask for the CAPTCHA at checkout only while its card-testing alarm is up. The alarm watches failed payments across the whole shop and stays up for 6 hours once it fires. Outside that window, checkout and wallet buttons work as normal.
How the alarm decides that an attack is happening is covered on WooCommerce card-testing protection.
Off by default. Needs a CAPTCHA provider.
Why Turnstile shows on the checkout page
Turnstile's "auto" appearance keeps the widget hidden on normal forms unless Cloudflare decides it wants a click. Checkout is different: it submits in the background without reloading the page, and on forms like that the widget is always visible. The same is true of Contact Form 7, Elementor and WPForms forms. Expect shoppers to see a small Turnstile box at checkout.
Turnstile's appearance is set to "auto" by default; "always" shows it on every form.
The honeypot, and what the math challenge can't do
On every form you tick, a hidden honeypot field and a timing check run as well, even if you pick no provider. They catch simple bots that fill in every field they find, or submit a form faster than a person could read it.
The built-in math challenge is a step up from that and needs no outside account, but keep expectations modest. It stops generic spam bots; a bot written to read the question can answer it. For a shop under real pressure, one of the hosted providers is the stronger choice.
Honeypot and timing check on by default, on the forms you choose. The math challenge is off until you pick it.
Part of WP SecureGate: WooCommerce security →