CaptchaFlow – CAPTCHA & Spam Protection for Forms
Protect every form on your site — Contact Form 7, WPForms, WooCommerce, login and comments — with Cloudflare Turnstile, reCAPTCHA, hCaptcha, or a self-hosted challenge that needs no signup.
Updated August 25, 2026 Version 1.1.1 WordPress Plugin
Overview
CaptchaFlow protects every form on your WordPress site with one switch. Choose a CAPTCHA provider — or a self-hosted challenge that needs no signup at all — and CaptchaFlow attaches it to your login page, comment form, checkout, and every supported form plugin automatically. No template editing, no per-form configuration, no code.
Features
- Every form, one switch — detected forms are protected automatically, including ones you add later
- Three layers on every submission — a randomized honeypot, a timing trap, then your chosen challenge
- Six challenge types — Cloudflare Turnstile, reCAPTCHA v2 and v3, hCaptcha, Math or Question
- Self-hosted Math and Question challenges that need no third-party account
- Works with Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Forminator, Elementor and Ninja Forms
- Protects WordPress login, registration, lost-password, comments and WooCommerce
- Zero assets on pages without a protected form
- Dependency-free public script under 3 KB compressed
- Under 5 ms of server time per verification
- Page-cache safe — challenge data is never baked into cached HTML
- No telemetry and no account; IP addresses are shortened before logging
- Email addresses stored only as one-way hashes
- One-click diagnostics for keys, latency, REST, cron and cache
- Theme compatibility checker that warns before another plugin double-injects a CAPTCHA
- Activity log with a reason code for every block
- Full dark mode across the admin
- Translation-ready, and accessible to keyboard and screen-reader users
Requirements
- WordPress 6.5 or higher
- PHP 7.4 or higher
Features
- Every form, one switch — detected forms are protected automatically, including ones you add later
- Three layers on every submission — a randomized honeypot, a timing trap, then your chosen challenge
- Six challenge types — Cloudflare Turnstile, reCAPTCHA v2 and v3, hCaptcha, Math or Question
- Self-hosted Math and Question challenges that need no third-party account
- Works with Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Forminator, Elementor and Ninja Forms
- Protects WordPress login, registration, lost-password, comments and WooCommerce
- Zero assets on pages without a protected form
- Dependency-free public script under 3 KB compressed
- Under 5 ms of server time per verification
- Page-cache safe — challenge data is never baked into cached HTML
- No telemetry and no account; IP addresses are shortened before logging
- Email addresses stored only as one-way hashes
- One-click diagnostics for keys, latency, REST, cron and cache
- Theme compatibility checker that warns before another plugin double-injects a CAPTCHA
- Activity log with a reason code for every block
- Full dark mode across the admin
- Translation-ready, and accessible to keyboard and screen-reader users
Specifications
- Version
- 1.1.1
- Product type
- WordPress Plugin
Documentation
Getting started
- 1 Request the download on this page — the link is emailed to you straight away.
- 2 In WordPress go to Plugins → Add New → Upload Plugin.
- 3 Choose the zip, then select Install Now and Activate.
- 4 Open the setup notes bundled in the download for configuration details.
Setup notes ship inside the download itself, so the documentation always matches the version you have.
Read the documentation (opens in a new tab)Changelog
-
1.1.1
- Fixed: a site whose reCAPTCHA key was not registered for its domain could lock everyone out of the login screen, including administrators. Provider and configuration errors are now treated as the provider being unavailable.
- Fixed: challenges now appear in forms added to the page after it loads - popups, modals, AJAX tabs and anything loaded on scroll.
- Fixed: forms that are not HTML forms, such as React-driven checkouts, now receive the challenge fields they need.
-
1.1.0
- Added: theme compatibility checker.
- Added: one-click diagnostics for keys, latency, REST, cron and cache.
-
1.0.0
- Initial release.
Frequently asked questions
Is this really free?
Yes. Download it and use it on your own site at no cost. Where a Pro edition exists it adds more features, layouts and support — the free build is never time-limited.
Can I try it before I commit?
Yes — the live preview is the real product running, not a mockup. Click through it as much as you like before deciding.
What do I need to run it?
A self-hosted WordPress site. Upload the zip from your WordPress dashboard and activate it — no extra build tools required.
Where do I get help?
Setup notes ship inside the download, and you can contact us directly for anything else — every product is built and supported in-house by TemplateSell.
You might also like
More from Free Items
Ready to build with CaptchaFlow – CAPTCHA & Spam Protection for Forms?
Download it now — the files land in your inbox and on screen straight away.