CaptchaFlow – CAPTCHA & Spam Protection for Forms

🛡️ Stop form spam across your whole site with one switch CaptchaFlow protects every form on your WordPress site with one switch. Choose a CAPTCHA provider — or a self-hosted challenge that needs no signup at all — and CaptchaFlow attaches it to your login page, comment form, checkout, and every supported form plugin automatically. No template editing, no per-form configuration, no code. 🔗 Plugin home · Live demo · All features · Documentation · FAQ · Changelog 🧪 Try it before you install it You do not have to take any of this on trust. There is a live demo that runs in your browser with nothing to install:

• Answer a math or question challenge and watch the submission pass.
• Press Submit like a bot and watch the honeypot stop it, with the same reason code the plugin writes to your activity log.
• Submit instantly and watch the timing trap catch it.
• Load a Cloudflare Turnstile, reCAPTCHA or hCaptcha widget — only if you choose to; nothing third-party loads until you press a button that names the host.

✨ Why choose CaptchaFlow? 🧩 Every Form, One Switch – CaptchaFlow detects the forms on your site and protects them all. New forms are covered the moment you create them. 🪤 Three Layers on Every Submission – A honeypot field with a randomized name, a time trap that catches inhumanly fast submissions, and your chosen challenge. Obvious bots are rejected by the first two layers without ever reaching your provider, which keeps your pages fast and your provider quota low. 🎛️ Six Challenge Types – Cloudflare Turnstile, Google reCAPTCHA v2 and v3, hCaptcha, or a self-hosted Math or Question challenge that needs no account at all. ⚡ Built for Fast Sites – Zero assets on pages without a protected form, a dependency-free public script under 3 KB compressed, and under 5 ms of server time per verification. 🗄️ Works With Page Caching – Challenge data is never baked into cached HTML, so a cached page stays correct for every visitor. 🔒 Privacy First – No telemetry, no account, and nothing sent to us. IP addresses are shortened before logging and email addresses stored only as one-way hashes. 🩺 Diagnostics You Can Trust – One click tests your keys, latency, REST, cron, and cache setup, and warns you before another plugin double-injects a CAPTCHA. 🌍 Translation Ready – Every string is translatable, a POT file ships with the plugin, and the admin fully supports RTL languages. ♿ Accessible by Default – Challenges are keyboard-operable, labelled for screen readers, and respect reduced-motion preferences. The no-JavaScript fallback is plain accessible HTML. 🧑‍💻 Developer Friendly – Documented hooks and filters, a PHP SDK for custom forms, and a CSS-selector adapter for anything hand-built. 📋 Supported forms

• WordPress login, registration, password reset, and comments
• WooCommerce login, registration, and password reset
• Contact Form 7
• WPForms
• Fluent Forms
• Forminator
• Ninja Forms
• Gravity Forms
• Elementor Pro forms
• Any other form, via a CSS selector

🔐 Supported challenges

• Cloudflare Turnstile — free, privacy-friendly, usually invisible (recommended)
• Google reCAPTCHA v2 — the familiar checkbox
• Google reCAPTCHA v3 — invisible, score-based
• hCaptcha — privacy-focused alternative
• Math challenge — a simple sum; no account, no external service
• Question challenge — your own question and answer; no external service

⏱️ 60-second setup Activate the plugin, pick a challenge in the setup wizard, paste your keys (or skip that step with a self-hosted challenge), and you are protected. The wizard ends with a live test so you can see your site issuing challenges before you close it. Step-by-step guides for every provider are in the documentation. 🔏 Privacy first CaptchaFlow sends no data to us — there is no phoning home, no telemetry, and no account. The only external requests are the verification calls to the CAPTCHA provider you choose, and the self-hosted Math and Question challenges make no external requests at all. Visitor email addresses are stored only as one-way hashes in your own database, and the event log trims itself on the schedule you set. Visitor IP addresses are shortened to the network they came from before they are logged — enough to spot a flood from one place, not enough to single out a person. You can turn that off if you need exact addresses for investigating abuse. CaptchaFlow also writes suggested wording for your privacy policy that describes your actual configuration, and plugs into Tools → Export Personal Data and Erase Personal Data so a visitor's request covers the spam log too. CaptchaFlow uses the official public APIs of Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha. Those names are trademarks of their respective owners; CaptchaFlow is not affiliated with or endorsed by Cloudflare, Google, or Intuition Machines. 🩺 Diagnostics you can trust One click runs a full self-test: provider reachability and key validity with round-trip latency, REST availability, cron health, cache-plugin detection with copy-paste exclusion rules, and a curated list of plugins known to double-inject CAPTCHAs. Export the whole report as text and attach it to a support ticket. 🚀 CaptchaFlow Pro Everything above is free and stays free. Pro is for sites where spam has stopped being accidental — see the full comparison and pricing. 🚦 Rate Limiting & IP Firewall – Throttle repeat submitters with a sliding window, and block or allow individual addresses and whole countries. 📧 Email & Phone Validation – Reject disposable mailboxes and malformed numbers before they reach your inbox or your CRM. 🧠 Behaviour Analysis & Spam Scoring – Every submission is scored on how it was filled in, so borderline cases are challenged instead of silently allowed. 🌐 Country Rules & Conditional Challenges – Ask for a harder challenge only where abuse actually comes from, and leave everyone else undisturbed. 🛒 WooCommerce Checkout & Review Protection – Extends protection to checkout and product reviews, where store spam actually costs you money. 📊 Analytics, Alerts & Health Reports – See what is being blocked and why, and get told when something changes rather than finding out later. 🔌 Developer API, Webhooks & White Label – Hook verification into your own systems, and hand clients a plugin that carries your name. 💡 Recommendations & Auto-Optimization – CaptchaFlow watches its own results and suggests the settings that would block more with less friction. Every Pro plan includes a 14-day trial with no card required.

1. Install and activate CaptchaFlow from the Plugins screen.
2. The setup wizard opens automatically. Choose a challenge — Cloudflare Turnstile if you want the least visitor friction, or the Math challenge if you don't want to create any account.
3. Paste your site key and secret key if your challenge needs them. They are tested the moment you paste them.
4. Leave "Protect every form" on, finish, and watch the live test pass.

That is the whole setup. To fine-tune, the Forms screen lets you protect sources individually, and the Provider screen lets you switch challenges at any time.

1.1.1

• Fixed: a site whose reCAPTCHA key was not registered for its domain could lock everyone out of the login screen, including administrators, even with "let visitors through if the provider is unreachable" switched on. Provider and configuration errors are now treated as the provider being unavailable, so that setting governs them. Errors that are a judgement about the submission still block.
• Fixed: challenges now appear in forms that are added to the page after it loads — popups, modals, AJAX tabs and anything loaded on scroll.
• Fixed: forms that are not HTML forms, such as React-driven checkouts, now receive the challenge fields they need.
• New: the challenge response is checked against the site it was issued for, and reCAPTCHA v3 tokens against the action they were issued for, so a token solved elsewhere with this site's public key cannot be replayed here.
• New: an occasional review request, shown only after CaptchaFlow has actually blocked something, and never more than one notice at a time.
• No changes to what is stored, or to where data is sent.

1.1.0

• New: a Pro screen in the admin describing what CaptchaFlow Pro adds, reachable from the menu.
• The Pro entry is hidden automatically on sites that already run Pro.
• No changes to form protection, providers, or how visitor data is handled.

1.0.0

• Initial release.
• Protection for WordPress core forms (login, registration, password reset, comments), WooCommerce account forms, Contact Form 7, WPForms, Fluent Forms, Forminator, Ninja Forms, Gravity Forms, Elementor Pro, and any form via CSS selector.
• Providers: Cloudflare Turnstile, Google reCAPTCHA v2/v3, hCaptcha, self-hosted Math and Question challenges.
• Honeypot and time-trap pre-checks on every submission.
• Cache-safe challenge delivery; no visitor data in page HTML.
• Setup wizard, one-click diagnostics with text export, theme compatibility checker.
• Dashboard with blocked-spam counters and 30-day trend; daily statistics rollups.
• Encrypted provider secrets at rest; deferred log writes; automatic log retention.
• Privacy: IP addresses shortened to their network before logging, suggested privacy-policy wording generated from your configuration, and export/erase handlers wired into the WordPress privacy tools.