Gate House – Spam Protection & CAPTCHA

Gate House helps reduce automated spam on native WordPress and WooCommerce forms. Start with built-in keyless checks, or connect Cloudflare Turnstile, Google reCAPTCHA v2/v3 or hCaptcha. Free needs no Gate House account, license, credit card or trial. WordPress login, registration and comment spam protection Choose Off, Invisible or Human check for native WordPress login, registration, password-reset requests and comments. The checks act on supported submissions; they do not classify comment content or prove that every visitor is legitimate. WooCommerce checkout, account and review forms Add checks to WooCommerce My Account forms, product reviews, classic checkout, Checkout Blocks and native order-payment forms. Checkout checks are an explicit choice: test complete sandbox payment journeys before enabling them. Custom forms, headless routes, express wallets and gateway-specific flows need separate assessment. Start without CAPTCHA keys Automatic protection runs on your server using a signed form proof, a hidden honeypot and a minimum submission time. No external provider account or browser challenge is needed for this mode. Fresh settings observe until you choose protection. Turn on recommended protection enables invisible checks for supported sign-in, registration, reset, comment and review forms while leaving checkout unchanged. Choose Turnstile, reCAPTCHA or hCaptcha All three provider integrations are included in Free: Cloudflare Turnstile Managed, Google reCAPTCHA v2 checkbox or v3 score, and standard hCaptcha. Connect one external provider at a time, save that provider's keys and run the browser-to-server connection test. Then select Human check on the forms you want to protect. Provider key creation takes place in the provider's own dashboard. See form coverage and blocked attempts Guided setup includes form discovery, provider diagnostics and daily blocked-attempt totals. Overview separates enabled form types from successful-use observations. A detected form or passing provider test is not proof that every theme or payment journey works. Try successful and rejected submissions on the actual forms your visitors use. Free protection and optional Pro controls Free includes the form checks above, keyless setup, provider testing, coverage and the aggregate blocked-attempt counter. Gate House Pro is a separately distributed add-on for configurable rate limits and presets, advanced rules, disposable-email and account-abuse checks, card-testing signals, held-order review, detailed local activity, Contact Form 7 and administration tools. Free keeps working independently. Learn more: https://gatehousewp.com/

Since 1.21.0, open Gate House directly in the WordPress admin sidebar. Version 1.20.1 and earlier use Settings > Gate House instead.

1. Install and activate Gate House on an individual WordPress site.
2. Open Gate House in the WordPress admin sidebar and review the detected forms.
3. Choose Automatic, or save your external provider keys and complete its connection test.
4. Enable protection for the forms you use and verify the actual visitor journeys, including rejected submissions and sandbox checkout.

PHP 8.1 and WordPress 7.1 minimum. WooCommerce integrations require 11.1.2 or later. Selected test targets are WordPress 7.1.2 and WooCommerce 11.1.2; other versions need testing. WordPress protection works without WooCommerce. Network activation is not supported.

1.21.1 Cleans up Pro summary retry schedules and status when plugin data is explicitly deleted. Free form protection is unchanged; weekly protection summary emails remain a Pro feature. 1.21.0 Moves Gate House to its own shield-icon entry in the WordPress admin sidebar while retaining the existing dashboard tabs and permissions. Existing Settings and Tools links redirect to the matching page. Updates in-plugin links, notices and setup instructions for the new location; protection settings and stored data are unchanged. 1.20.1 Marks the atomic settings write as a reviewed direct database query, clearing the last Plugin Check warning. No behavior or stored-data changes. 1.20.0 Retires the remaining short-prefix names: front-end markup, submitted form fields, error codes, the held-order status and the notice parameter now use the unique gate_house / gate-house names, and orders held under the earlier status move automatically. The old wp usp command alias and the USP_RECOVERY_MODE, USP_SITE_KEY and USP_SECRET_KEY wp-config fallbacks are removed; use the GATE_HOUSE_ names. If you use Gate House Pro, update it together with this plugin: Pro 1.20.0 or later is required. 1.19.0 Addresses WordPress.org review feedback. Stored data, hooks, scripts, capabilities and database tables now use the unique gate_house prefix instead of a short one, and earlier settings, provider connection state, coverage evidence and administrator access are copied forward automatically on first load (the originals are left in place). The Protection Test builds the login URL with wp_login_url() and no longer touches submitted form data. If you use Gate House Pro, update it together with this plugin: Pro 1.19.0 or later is required. 1.18.1 Uses WordPress.org language packs for Free translations and omits bundled translation catalogs and the explicit translation loader. Package checks guard against bundled translations returning. Existing settings and protection behavior are preserved. 1.18.0 Gate House Pro can now protect WPForms forms (verified against WPForms Lite 2.0.2.1). With Pro active, every WPForms form gets the same per-form check ladder (Off, Invisible, Human check) and rate limits as the built-in forms; a blocked attempt surfaces as WPForms' own error and stores nothing. The Coverage tab's entry-points card counts WPForms forms and reports them covered with Pro, and says plainly that no adapter is available yet without it. This update contains the base-side wiring; the adapter itself ships in the Pro add-on of the same version. 1.17.0 Base compatibility for separately consented Cloud rule lists; existing Free protection and local settings are preserved. 1.16.0 Compatible settings support for separately consented Cloud templates. The assigned WordPress.org identity and existing settings are preserved. 1.15.2 Uses the WordPress.org-assigned gate-house-spam-protection-captcha directory, entrypoint and shared translation domain. Preserves safe migration from earlier installation folders, existing settings and the WooCommerce checkout extension contract. 1.15.1 Introduces the public title Gate House – Spam Protection & CAPTCHA and the matching directory identity. Clarifies Free form protection, keyless setup, checkout opt-in and optional Pro controls while preserving existing settings and the checkout extension contract. 1.15.0 Uses the branded gate-house directory, entrypoint and text domain for the WordPress.org candidate. Preserves existing settings and data, with an explicit Pro-first migration from older installations. 1.14.1 Prepares the Free edition for WordPress.org review with contributor metadata, explicit external-service disclosures and reproducible asset-build instructions. Enqueues the recovery helper through WordPress, improves translation extraction, and guards direct file access. Keeps the existing plugin identity and separate Pro and legacy distributions. 1.14.0 Introduces separate Free and Pro distribution, preserves the legacy complete-product update channel, and removes anonymous Gate House store requests. Existing product history remains in CHANGELOG.md.