CaptchaFlow – CAPTCHA & Spam Protection for Forms

CaptchaFlow protects every form on your WordPress site with one switch. Choose a CAPTCHA provider — or a self-hosted challenge that needs no signup at all — and CaptchaFlow attaches it to your login page, comment form, checkout, and every supported form plugin automatically. No template editing, no per-form configuration, no code.

Every form, one switch. CaptchaFlow detects the forms on your site and protects them all: new forms are covered the moment you create them.

Three layers of protection on every submission:

1. A honeypot field with a randomized name that bots fill and humans never see.
2. A time trap that catches submissions completed faster than any human types.
3. Your chosen challenge — Cloudflare Turnstile, Google reCAPTCHA v2/v3, hCaptcha, or a self-hosted Math or Question challenge.

Obvious bots are rejected by the first two layers without ever reaching your CAPTCHA provider, which keeps your pages fast and your provider quota low.

Supported forms

• WordPress login, registration, password reset, and comments
• WooCommerce login, registration, and password reset
• Contact Form 7
• WPForms
• Fluent Forms
• Forminator
• Ninja Forms
• Gravity Forms
• Elementor Pro forms
• Any other form, via a CSS selector

Supported challenges

• Cloudflare Turnstile — free, privacy-friendly, usually invisible (recommended)
• Google reCAPTCHA v2 — the familiar checkbox
• Google reCAPTCHA v3 — invisible, score-based
• hCaptcha — privacy-focused alternative
• Math challenge — a simple sum; no account, no external service
• Question challenge — your own question and answer; no external service

60-second setup

Activate the plugin, pick a challenge in the setup wizard, paste your keys (or skip that step with a self-hosted challenge), and you are protected. The wizard ends with a live test so you can see your site issuing challenges before you close it.

Built for fast sites

• Zero assets load on pages without a protected form.
• The public script is under 3 KB compressed, with no dependencies.
• Full compatibility with page caching: challenge data is never baked into cached HTML.
• Verification adds under 5 ms on your server; log writes are deferred until after the response is sent.

Privacy first

CaptchaFlow sends no data to us — there is no phoning home, no telemetry, and no account. The only external requests are the verification calls to the CAPTCHA provider you choose, and the self-hosted Math and Question challenges make no external requests at all. Visitor email addresses are stored only as one-way hashes in your own database, and the event log trims itself on the schedule you set.

Visitor IP addresses are shortened to the network they came from before they are logged — enough to spot a flood from one place, not enough to single out a person. You can turn that off if you need exact addresses for investigating abuse. CaptchaFlow also writes suggested wording for your privacy policy that describes your actual configuration, and plugs into Tools → Export Personal Data and Erase Personal Data so a visitor's request covers the spam log too.

CaptchaFlow uses the official public APIs of Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha. Those names are trademarks of their respective owners; CaptchaFlow is not affiliated with or endorsed by Cloudflare, Google, or Intuition Machines.

Diagnostics you can trust

One click runs a full self-test: provider reachability and key validity with round-trip latency, REST availability, cron health, cache-plugin detection with copy-paste exclusion rules, and a curated list of plugins known to double-inject CAPTCHAs. Export the whole report as text and attach it to a support ticket.

External services

CaptchaFlow contacts an external service only when you have chosen a challenge that is hosted by one — Cloudflare Turnstile, Google reCAPTCHA v2, Google reCAPTCHA v3, or hCaptcha. If you choose the Math or Question challenge, CaptchaFlow makes no external requests at all and nothing on this list applies to your site.

CaptchaFlow itself is not a service. It has no servers, no account, and no telemetry: nothing is ever sent to CaptchaFlow or to TemplateSell.

Cloudflare Turnstile

Used only when Turnstile is the selected challenge.

• The visitor's browser loads the challenge widget from https://challenges.cloudflare.com/turnstile/v0/api.js on any page showing a protected form. Cloudflare receives whatever a browser sends when requesting a script, including the visitor's IP address and user agent.
• When the form is submitted, your server sends the challenge token, your Turnstile secret key, and the visitor's IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://www.cloudflare.com/website-terms/ — Privacy policy: https://www.cloudflare.com/privacypolicy/

Google reCAPTCHA (v2 and v3)

Used only when reCAPTCHA v2 or v3 is the selected challenge.

• The visitor's browser loads the challenge widget from https://www.google.com/recaptcha/api.js on any page showing a protected form. Google receives whatever a browser sends when requesting a script, including the visitor's IP address and user agent, and reCAPTCHA additionally observes visitor interaction in order to score the request.
• When the form is submitted, your server sends the challenge token, your reCAPTCHA secret key, and the visitor's IP address to https://www.google.com/recaptcha/api/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy

hCaptcha

Used only when hCaptcha is the selected challenge.

• The visitor's browser loads the challenge widget from https://js.hcaptcha.com/1/api.js on any page showing a protected form. hCaptcha receives whatever a browser sends when requesting a script, including the visitor's IP address and user agent.
• When the form is submitted, your server sends the challenge token, your hCaptcha secret key, and the visitor's IP address to https://api.hcaptcha.com/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://www.hcaptcha.com/terms — Privacy policy: https://www.hcaptcha.com/privacy

Cloudflare, Google, and hCaptcha are trademarks of their respective owners. CaptchaFlow is not affiliated with or endorsed by Cloudflare, Google, or Intuition Machines, and uses only each provider's official public API.