Redeyed Sentinel

Redeyed Sentinel is a free, self-hosted-friendly CAPTCHA and IP-reputation service for WordPress. It protects the forms bots love most — login, registration, lost-password and comments — without tracking your visitors or slowing your site down, and can log every blocked attempt so you can see it working.

The plugin is free to install and does nothing until you enter your keys. With no Site Key and Secret Key configured, Sentinel stays completely inert: no widget is rendered, no requests are made, and your forms behave exactly as before.

What you get

• Drop-in CAPTCHA widget on the WordPress login, registration, lost-password and comment forms.
• Server-side verification on submission — tokens are checked against Sentinel using your site’s Secret Key, which is never exposed in page markup.
• Block log — optionally record every blocked attempt (form, IP, outcome, score, time) and review it under Settings → Sentinel Log.
• Fail-open by design: if your keys are missing the plugin will not block anyone, and an admin notice reminds you that Sentinel is inactive.
• Simple settings screen under Settings → Sentinel with per-form on/off switches.
• Optional widget customization — set a site-wide widget type, theme, colour scheme, minimum difficulty, width and form key. Every field is optional and off by default.
• Lightweight: one small async script, loaded only on the pages where a protected form appears.

Privacy

Your Secret Key is sent only from your server to the Sentinel verification endpoint (/sentinel/siteverify). It is never printed in HTML. The public Site Key is the only key that appears on the page, which is exactly what it is designed for.