Turnstile, hCaptcha and reCAPTCHA for WordPress
The supported providers are Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2 and v3, and a built-in math challenge. The three hosted services need an account with the provider and a pair of keys pasted into the settings. The math challenge needs no account at all.
One provider is active at a time, and it applies to every form you switch on.
Needs setup. No provider is chosen on a new install.
Every form this WordPress CAPTCHA plugin covers
Each form has its own switch, so you can protect the comment form without touching login:
- WordPress login, registration, lost password and comments;
- WooCommerce login, registration and checkout;
- Contact Form 7;
- Elementor Pro forms;
- WPForms;
- the login and registration widgets from Essential Addons.
Off for every form until you switch it on.
Contact Form 7, Elementor and WPForms CAPTCHA
Form builders are where most contact-form spam lands, and each one handles CAPTCHAs its own way. WP SecureGate hooks into Contact Form 7, Elementor Pro and WPForms directly, so you don't need a separate CAPTCHA add-on per builder.
WooCommerce checkout has its own trade-offs, chiefly around wallet buttons such as Apple Pay. Those are covered on the WooCommerce CAPTCHA plugin page.
Off until you choose a provider and switch the form on.
Turnstile "auto": hidden where it can be
Turnstile's appearance is set to "auto" unless you change it. On a normal form, such as login or comments, the widget stays hidden and the visitor sees nothing unless Cloudflare decides it wants a click.
Forms that submit without reloading the page behave differently. On AJAX forms, which include WooCommerce checkout, Contact Form 7, Elementor and WPForms, the Turnstile box is always shown. So expect a visible widget on those forms even in auto mode.
Auto is the default appearance. You can set it to always visible.
A honeypot and timing check that cost visitors nothing
Two quiet traps run alongside any provider. The honeypot is a field a person never sees, with a name unique to your site; most spam bots fill in every field they find, and give themselves away. The timing check refuses a form sent back faster than anyone could read it.
They need no keys, so a form you switch on is covered by them even before you set up a provider. On sign-in forms the timing check is skipped, because password managers fill and submit those almost instantly. For bot sign-ups specifically, see WordPress spam registrations.
On by default, on every form you protect.
What the math challenge can and can't do
The built-in math challenge asks a simple sum. It needs no account and sends nothing to a third party, which suits sites that would rather not load an outside script.
Know its limit. It stops generic spam bots that fill forms blindly, but a bot written to read the question will pass it. For a targeted attack, use Turnstile, hCaptcha or reCAPTCHA instead, and keep the brute force protection on the login form.
Off unless you choose it as your provider.
When another plugin already adds a CAPTCHA
Two challenges on one form ask a visitor to prove twice that they're human, and two copies of Google's script on one page tend to break each other. WP SecureGate notices when another active plugin already puts a CAPTCHA on a form and says so next to that form's switch. It doesn't switch anything off for you; you decide which one to keep.
Built in. It warns and changes nothing.
Part of WP SecureGate: WooCommerce CAPTCHA →