Gatekeep - CAPTCHA & Spam Protection

Stop spam without annoying your visitors. Gatekeep protects virtually every form on your WordPress site - not just contact forms. Whether visitors are logging in, registering, checking out, leaving comments or submitting a form you wrote yourself, Gatekeep quietly analyses every submission and stops suspicious activity before it reaches your inbox. Unlike traditional CAPTCHA plugins, Gatekeep uses risk scoring, honeypots, timing analysis, rate limiting and a dozen other signals to detect bots with almost no friction for real people. Most visitors never see a challenge at all. Every form, not just one

• Contact forms
• Login, registration and password reset
• WooCommerce checkout and account creation
• Comments
• BuddyPress and bbPress
• Membership and LMS plugins
• Page-builder forms
• Custom-coded forms - two function calls, or none at all with the universal guard

CAPTCHA for Contact Form 7 - without the CAPTCHA Searching for a Contact Form 7 CAPTCHA usually means one thing: the form is drowning in spam. Gatekeep protects CF7 the moment it is activated - including the AJAX submission path most honeypot plugins miss - with nothing visible added to the form. The same is true for WPForms, Gravity Forms, Fluent Forms, Formidable, Ninja Forms, Elementor forms and the WooCommerce checkout: install, click Protect my website, done. If you specifically want a visible challenge, four self-hosted ones are included - no Google account, no site keys. What it caught that other filters did not Every anti-spam plugin reports what it blocked. None report what they missed - which is the number that actually tells you whether you are protected. Gatekeep records every submission, clean ones included, so its totals have a denominator: not "12 blocked" but "12 blocked of 4,310". Monitor Mode goes further and scores submissions without blocking any, alongside whatever protection you already run, so you can read a week of real verdicts before changing anything. Nothing else on the plugin directory will tell you what your current filter is letting through. Signals a human spammer cannot avoid Most anti-spam checks measure how a form was submitted - speed, tokens, hidden fields. Someone typing at human speed passes all of them. Gatekeep also reads what was sent:

• Imitating sender domains. Mail from search-yoursite.com when you are yoursite.com. Nobody legitimate writes to you from a domain built out of yours.
• Disguised web addresses. "example dot com", "example[.]org", "hxxps://" - written that way to slip past filters, and scored precisely because honest correspondents never do it.
• Link density. A short message that is mostly links.
• Repeated messages. The same pitch arriving again and again, recognised even when names, numbers and links are varied between sends.
• Malformed payloads. Submissions carrying hundreds of fields or nested absurdly deep to push the real message past a scanner.

Smarter than a CAPTCHA Traditional captcha asks everyone to prove they are human. Gatekeep asks the submission instead, scoring signals the visitor never sees: honeypot traps, impossible submission speed, disposable email addresses, scripted HTTP clients and headless browsers, rate limits, invalid form tokens, missing browser headers and invisible link traps. Only ambiguous submissions ever meet a challenge - and if you want one, four self-hosted options need no account and no keys. Monitor Mode: prove it is safe before it blocks Losing a real customer costs more than receiving spam. So Gatekeep starts in Monitor Mode: for the first week it watches, scores, logs and explains every decision without blocking anything. You switch enforcement on when the verdicts look right. More than spam protection A 17-point security audit checks for weak configuration - default admin accounts, unrotated salts, exposed config backups, the built-in file editor, XML-RPC, missing HTTPS, end-of-life PHP, pending updates and dormant plugins. Every finding explains what to do; nothing is changed automatically. A security event log records who changed what: role changes, sign-ins and failures, plugin and theme changes, password and email changes, and critical settings. Features

• Intelligent risk scoring rather than puzzles
• Universal form protection, including custom-coded forms
• Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Formidable, Ninja Forms, MetForm
• WooCommerce, BuddyPress, bbPress, MemberDash, Academy LMS, Bloom
• Divi 4 and 5, Elementor Pro, Bricks, Avada, Thrive, WPBakery, Oxygen, Beaver Builder
• Honeypot, timing analysis, rate limiting, disposable email detection
• Four self-hosted challenges - maths, image, checkbox and proof-of-work
• reCAPTCHA, hCaptcha and Turnstile supported if you already use them
• Login, registration and comment protection
• Security audit and security event log
• Developer API and shortcode
• Privacy friendly - hashed IP addresses, no third-party tracking
• No API keys required
• Works with page caching
• No JavaScript in the default configuration

Switching from a CAPTCHA or another anti-spam plugin? Coming from reCAPTCHA, hCaptcha or Turnstile: keep it, install Gatekeep in Monitor Mode beside it, and watch the log for a fortnight. You will see exactly what your captcha lets through - measured on your own traffic, not claimed by a vendor. Most sites then retire the puzzle; Gatekeep even ships a reCAPTCHA-compatible siteverify endpoint so custom code can switch by changing one URL. Coming from Akismet or another comment filter: they classify comment text; Gatekeep protects the forms they never see - registration, login, checkout, contact. The two can run together, and the Compatibility screen shows the overlap so it stays a decision, not an accident. Coming from a honeypot plugin: Gatekeep's honeypot uses a field name derived from your own site's salts, so bots cannot learn it elsewhere - and it is one signal of a dozen rather than the whole defence. Measured, not promised

• ~380 bytes added to a form, no JavaScript by default
• Blocked submissions decided in under 5 ms
• 1,200+ automated assertions pass on every release, on WordPress and WooCommerce current versions
• Nothing loads for a visitor except what a page view needs - admin, licensing and hardening code stay out of the way

Free forever, and what Pro adds Everything that is code is free - and the code agrees. The engine, all 33 integrations, Monitor Mode, the activity log, the dashboard health score, the 17-point security audit, protection profiles, the coexistence report, IP and keyword rules, advanced signals, settings export/import and all four challenges including the image one: free, with no licence prompt anywhere. The paid tier buys hosted services that need someone on duty: the disposable-email-domain feed of 75,000+ entries refreshed daily, IP reputation, hosted verification, the Fortify hardening pack (a separate companion plugin you download from your account and install like any other plugin), and priority support. This plugin never downloads or installs other software. See plans and pricing. Your forms never depend on the licence: if it lapses, protection keeps working and you keep the version you have.

1.0 First public release.

• Local features (security score, image challenge, allowlists, blocked terms, MX checks, the bundled disposable-domain list, the security audit and the event log) are free in both code and documentation. A licence only buys hosted services and the optional companion plugin, which you install yourself.
• The universal form guard uses WordPress 6.9's template enhancement output buffer when available. On older WordPress it wraps the template in a paired ob_start() / ob_get_clean() in the same function, and includes the theme via load_template() so $post and $wp_query stay in scope.
• Directory-listing advice no longer writes index.php or .htaccess outside a plugin-specific uploads folder.
• Field HTML is escaped with wp_kses() at every output sink, including render_block / the_content filter callbacks.
• Compatibility tracking no longer reads visitor POST or writes transients from the front end.
• Pro entitlement can no longer be granted from the site itself. The gatekeep_can_use filter may now only restrict a capability, never grant one; developers who need an unlocked build locally have GATEKEEP_DEV_UNLOCK, which refuses to run on anything that looks like a production hostname.
• Licence answers from the licence server are verified with an Ed25519 signature and re-checked on every capability query, so editing the stored licence record by hand no longer unlocks anything.
• Disposable-address checks and MX checks moved to the free tier. Both run entirely on your own server and the data file already ships in this package, so gating them was never defensible.
• Uninstalling now removes everything the plugin created, including the visitor-reputation and domain tables and the stored licence record.
• On multisite, deleting a site now drops that site's Gatekeep tables instead of leaving them behind.
• Protects every entry point, not just contact forms: 33 form plugins, page-builder forms, WordPress login, registration, password reset and comments, WooCommerce checkout and account creation, plus a universal guard for forms belonging to no plugin at all.
• Over twenty scoring signals. Honeypot, submission timing, form tokens, rate and subnet limits, request shape, field integrity, visitor reputation, disposable and role addresses, MX checks, imitating sender domains, disguised web addresses, link density, repeated messages and malformed payloads.
• Monitor Mode: score submissions without blocking any, alongside whatever protection you already run, and see what it is letting through.
• Every submission recorded, clean ones included, so totals have a denominator — not "12 blocked" but "12 blocked of 4,310".
• Every verdict explained by the signals behind it, in plain sentences.
• Eight challenge options if you want a visible check, four of them self-hosted with no keys and no third party.
• Nothing leaves your site. Scoring happens on your own server.
• Honest about what it did not check. If your challenge provider is unreachable, submissions are still allowed so your forms keep working — but the log records that they were allowed WITHOUT verification rather than claiming they passed, and Diagnostics counts it.
• Correct under load. The repeat-message and token counters are incremented by the database itself rather than read-modify-written, so a burst of traffic cannot make the counts drift — which matters because a burst is exactly when those checks are needed.
• Bounded under attack. Storage a spammer can force Gatekeep to use is capped: message and token memory live in fixed-size stores rather than growing a row per submission, the activity log has a row ceiling as well as a retention period, and there is a limit on how much text one submission can make the server read.
• Understands what sits in front of your site. Behind Cloudflare, a load balancer or a reverse proxy, Gatekeep identifies the real visitor rather than the proxy — so rate limits and reputation apply to one person instead of your entire audience. Diagnostics tells you if it needs setting.
• Clears WP Rocket, W3 Total Cache, LiteSpeed, SG Optimizer, WP Super Cache and other page caches on activation, on update and whenever you change a setting — so a stored copy of yesterday's page never makes a working plugin look broken. There is a manual button on Diagnostics, and it tells you plainly if a cache could not be reached rather than claiming success.