Contact forms, login, comments, checkout — protected by one plugin, in under a minute, without writing a line of code.
Works with what you already use
Integrations, not endorsements — these are the form plugins and challenge providers CaptchaFlow talks to.
Not a checklist of buzzwords — each of these is a screen you can open after installing.
Turn on protect-all and CaptchaFlow covers your contact forms, your login, your comments, your checkout — and whatever you install next.
Pick one, change your mind later, and never touch a form to do it.
Honeypot and timing traps run first, so most bots never cost you a network call.
IP addresses shortened before they are written, email addresses stored only as a one-way hash.
One click checks your environment, provider keys, REST API, scheduled tasks and known plugin conflicts — then says what to do about each failure, in a sentence.
No visitor-specific data is ever written into page HTML, so the challenge works the same whether the page came from your server or from cache.
The setup wizard opens by itself. No configuration file to edit, nothing to paste into your theme.
Six to choose from, each explaining its trade-offs. Two are self-hosted and need no account at all.
Every form CaptchaFlow can find is covered, including the ones you add next month.
Every decision is recorded with the reason for it, so you can see exactly what was stopped and why.
12
form sources protected out of the box
6
challenge types, two of them self-hosted
2.5 KB
of JavaScript on the page, gzipped
207
automated tests across Free and Pro
Every figure here is counted from the shipped plugin, not estimated.
Including two that never contact anyone. Every option states its trade-offs before you commit to it — and you can change your mind later without touching a form.
Compare the sixAlmost certainly. Check for yourself.
12 form sources are protected out of the box — plus any other form, by CSS selector.
Turn on “Protect all forms” and CaptchaFlow covers everything it can find — including the forms you add next month. No shortcodes, no per-form setup.
The wizard asks one question — how should visitors be checked — and does the rest. Choose a self-hosted challenge and there is no account to create and no key to paste.
One-click diagnostics check your environment, provider, REST API, scheduled tasks and known plugin conflicts — then tell you how to fix what they find.
Anti-spam plugins are easy to install and miserable to own. These are the decisions that follow from taking the second part seriously.
Every form source, all six challenges, the log and the privacy tools — free forever, on unlimited sites.
No visitor-specific data is ever written into page HTML, so a full-page cache cannot break the challenge.
An expired licence keeps protecting your site. It only stops offering updates.
When something is blocked, the log names the exact check that stopped it — no black box.
No. The Math and Question challenges run entirely on your own site with no signup and no external service. If you would rather use a managed provider, Cloudflare Turnstile is free and needs no Google account either.
Yes, by design. CaptchaFlow never puts visitor-specific data into your page HTML, so cached pages stay correct for every visitor. The challenge is fetched by the browser with caching disabled, and the diagnostics screen confirms it is working through your cache.
Your forms keep working. CaptchaFlow fails open by default: if the provider cannot be reached, submissions are still checked by the honeypot, timing and content checks rather than everyone being locked out. You can switch that off if you would rather fail closed.
None reaches us. There is no telemetry, no phoning home and no account. Verification events are logged in your own database for the retention period you choose. IP addresses are shortened to their network before storage, and email addresses are kept only as one-way hashes.
The public script is 2.5 KB gzipped and loads only on pages that actually contain a protected form. Log writes are deferred until after the response has been sent, so verification adds no database round trips to the submit path.
Install the free plugin and be protected before your coffee gets cold.
Get started free