Antispam & Captcha

Layered spam protection for every form on your site — a modern captcha, stop words and an IP blocklist. The last two work even before you enter any keys.

What it protects

• Comments on news posts
• Customer account sign-in and registration
• Admin panel sign-in (optional, with a safety net)
• Lead forms (the leads plugin)

Pick any subset — checks run server-side on every submission via the core's form.spam_check hook.

Captcha providers

• Cloudflare Turnstile (recommended) — free, invisible for most visitors, no picture puzzles.
• hCaptcha — classic checkbox.
• Google reCAPTCHA v2 — checkbox.
• Google reCAPTCHA v3 — fully invisible, score-based with a configurable threshold.

Enter the site key and secret key — widgets appear in the protected forms automatically, no theme edits. The provider script is loaded only on pages that actually contain a form.

Fail-safe by design

If the captcha API is down — or the secret key has a typo — the plugin can let visitors through instead of rejecting them. An external outage never locks your own forms, including the admin sign-in.

Works without any keys

• Stop words — one word or phrase per line, case-insensitive, matched against all text fields. Kills link spam instantly.
• IP blocklist — single IPs or CIDR subnets (203.0.113.0/24).

Statistics

Blocked submissions are counted per day, form and reason — a 30-day summary lives right on the settings page. No personal data is ever stored.