CAPTCHA for WordPress that fails safe

What it does

Bots hammer login, registration and comment forms around the clock. A CAPTCHA makes those forms cheap for humans and expensive for scripts. You pick the provider: Google reCAPTCHA v2 (checkbox), v3 (invisible scoring) or Cloudflare Turnstile (privacy-friendlier, no puzzles).

How it works

Each provider covers WordPress login, registration, password reset and comments, plus WooCommerce login, registration and lost-password forms. Every placement is an individual toggle, off by default, so you enable exactly the forms you want protected.

Two details make it dependable: your keys are verified when you save them, so a typo surfaces immediately instead of as a locked-out login later, and an outage guard watches for provider downtime. There is also a no-conflict mode for sites where another plugin already loads a CAPTCHA, and a priority setting when both providers are configured.

• reCAPTCHA v2 checkbox or v3 invisible scoring (threshold adjustable, default 0.5)
• Cloudflare Turnstile with theme, language and size options
• Per-form toggles for WordPress and WooCommerce auth forms
• Key verifier at save time
• Outage guard and no-conflict mode
• IP and user-agent allowlists, debug logging

Privacy notes

CAPTCHA verification talks to the provider you chose (Google or Cloudflare), sending the visitor's response token together with your secret key, and only on forms where you enabled it. If provider choice matters to you, Turnstile is the lighter-touch option.