CaptchaFlow – CAPTCHA & Spam Protection for Forms

🛡️ Stop form spam across your whole site with one switch

CaptchaFlow protects every form on your WordPress site with one switch. Choose a CAPTCHA provider — or a self-hosted challenge that needs no signup at all — and CaptchaFlow attaches it to your login page, comment form, checkout, and every supported form plugin automatically. No template editing, no per-form configuration, no code.

🔗 Plugin home · All features · Documentation · FAQ · Changelog

✨ Why choose CaptchaFlow?

🧩 Every Form, One Switch – CaptchaFlow detects the forms on your site and protects them all. New forms are covered the moment you create them.

🪤 Three Layers on Every Submission – A honeypot field with a randomized name, a time trap that catches inhumanly fast submissions, and your chosen challenge. Obvious bots are rejected by the first two layers without ever reaching your provider, which keeps your pages fast and your provider quota low.

🎛️ Six Challenge Types – Cloudflare Turnstile, Google reCAPTCHA v2 and v3, hCaptcha, or a self-hosted Math or Question challenge that needs no account at all.

⚡ Built for Fast Sites – Zero assets on pages without a protected form, a dependency-free public script under 3 KB compressed, and under 5 ms of server time per verification.

🗄️ Works With Page Caching – Challenge data is never baked into cached HTML, so a cached page stays correct for every visitor.

🔒 Privacy First – No telemetry, no account, and nothing sent to us. IP addresses are shortened before logging and email addresses stored only as one-way hashes.

🩺 Diagnostics You Can Trust – One click tests your keys, latency, REST, cron, and cache setup, and warns you before another plugin double-injects a CAPTCHA.

🌍 Translation Ready – Every string is translatable, a POT file ships with the plugin, and the admin fully supports RTL languages.

♿ Accessible by Default – Challenges are keyboard-operable, labelled for screen readers, and respect reduced-motion preferences. The no-JavaScript fallback is plain accessible HTML.

🧑‍💻 Developer Friendly – Documented hooks and filters, a PHP SDK for custom forms, and a CSS-selector adapter for anything hand-built.

📋 Supported forms

• WordPress login, registration, password reset, and comments
• WooCommerce login, registration, and password reset
• Contact Form 7
• WPForms
• Fluent Forms
• Forminator
• Ninja Forms
• Gravity Forms
• Elementor Pro forms
• Any other form, via a CSS selector

🔐 Supported challenges

• Cloudflare Turnstile — free, privacy-friendly, usually invisible (recommended)
• Google reCAPTCHA v2 — the familiar checkbox
• Google reCAPTCHA v3 — invisible, score-based
• hCaptcha — privacy-focused alternative
• Math challenge — a simple sum; no account, no external service
• Question challenge — your own question and answer; no external service

⏱️ 60-second setup

Activate the plugin, pick a challenge in the setup wizard, paste your keys (or skip that step with a self-hosted challenge), and you are protected. The wizard ends with a live test so you can see your site issuing challenges before you close it.

Step-by-step guides for every provider are in the documentation.

🔏 Privacy first

CaptchaFlow sends no data to us — there is no phoning home, no telemetry, and no account. The only external requests are the verification calls to the CAPTCHA provider you choose, and the self-hosted Math and Question challenges make no external requests at all. Visitor email addresses are stored only as one-way hashes in your own database, and the event log trims itself on the schedule you set.

Visitor IP addresses are shortened to the network they came from before they are logged — enough to spot a flood from one place, not enough to single out a person. You can turn that off if you need exact addresses for investigating abuse. CaptchaFlow also writes suggested wording for your privacy policy that describes your actual configuration, and plugs into Tools → Export Personal Data and Erase Personal Data so a visitor’s request covers the spam log too.

CaptchaFlow uses the official public APIs of Cloudflare Turnstile, Google reCAPTCHA, and hCaptcha. Those names are trademarks of their respective owners; CaptchaFlow is not affiliated with or endorsed by Cloudflare, Google, or Intuition Machines.

🩺 Diagnostics you can trust

One click runs a full self-test: provider reachability and key validity with round-trip latency, REST availability, cron health, cache-plugin detection with copy-paste exclusion rules, and a curated list of plugins known to double-inject CAPTCHAs. Export the whole report as text and attach it to a support ticket.

🚀 CaptchaFlow Pro

Everything above is free and stays free. Pro is for sites where spam has stopped being accidental — see the full comparison and pricing.

🚦 Rate Limiting & IP Firewall – Throttle repeat submitters with a sliding window, and block or allow individual addresses and whole countries.

📧 Email & Phone Validation – Reject disposable mailboxes and malformed numbers before they reach your inbox or your CRM.

🧠 Behaviour Analysis & Spam Scoring – Every submission is scored on how it was filled in, so borderline cases are challenged instead of silently allowed.

🌐 Country Rules & Conditional Challenges – Ask for a harder challenge only where abuse actually comes from, and leave everyone else undisturbed.

🛒 WooCommerce Checkout & Review Protection – Extends protection to checkout and product reviews, where store spam actually costs you money.

📊 Analytics, Alerts & Health Reports – See what is being blocked and why, and get told when something changes rather than finding out later.

🔌 Developer API, Webhooks & White Label – Hook verification into your own systems, and hand clients a plugin that carries your name.

💡 Recommendations & Auto-Optimization – CaptchaFlow watches its own results and suggests the settings that would block more with less friction.

Every Pro plan includes a 14-day trial with no card required.

External services

CaptchaFlow contacts an external service only when you have chosen a challenge that is hosted by one — Cloudflare Turnstile, Google reCAPTCHA v2, Google reCAPTCHA v3, or hCaptcha. If you choose the Math or Question challenge, CaptchaFlow makes no external requests at all and nothing on this list applies to your site.

CaptchaFlow itself is not a service. It has no servers, no account, and no telemetry: nothing is ever sent to CaptchaFlow or to TemplateSell.

Cloudflare Turnstile

Used only when Turnstile is the selected challenge.

• The visitor’s browser loads the challenge widget from https://challenges.cloudflare.com/turnstile/v0/api.js on any page showing a protected form. Cloudflare receives whatever a browser sends when requesting a script, including the visitor’s IP address and user agent.
• When the form is submitted, your server sends the challenge token, your Turnstile secret key, and the visitor’s IP address to https://challenges.cloudflare.com/turnstile/v0/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://www.cloudflare.com/website-terms/ — Privacy policy: https://www.cloudflare.com/privacypolicy/

Google reCAPTCHA (v2 and v3)

Used only when reCAPTCHA v2 or v3 is the selected challenge.

• The visitor’s browser loads the challenge widget from https://www.google.com/recaptcha/api.js on any page showing a protected form. Google receives whatever a browser sends when requesting a script, including the visitor’s IP address and user agent, and reCAPTCHA additionally observes visitor interaction in order to score the request.
• When the form is submitted, your server sends the challenge token, your reCAPTCHA secret key, and the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://policies.google.com/terms — Privacy policy: https://policies.google.com/privacy

hCaptcha

Used only when hCaptcha is the selected challenge.

• The visitor’s browser loads the challenge widget from https://js.hcaptcha.com/1/api.js on any page showing a protected form. hCaptcha receives whatever a browser sends when requesting a script, including the visitor’s IP address and user agent.
• When the form is submitted, your server sends the challenge token, your hCaptcha secret key, and the visitor’s IP address to https://api.hcaptcha.com/siteverify to ask whether the challenge was passed. The request identifies your site in its user-agent string.
• The same verification endpoint is called with a dummy token when you test your keys on the Provider screen.

Terms of service: https://www.hcaptcha.com/terms — Privacy policy: https://www.hcaptcha.com/privacy

Cloudflare, Google, and hCaptcha are trademarks of their respective owners. CaptchaFlow is not affiliated with or endorsed by Cloudflare, Google, or Intuition Machines, and uses only each provider’s official public API.