Try it before you install it
Not a screenshot and not a video. Fill the form in and it passes; press “Submit like a bot” and watch it get stopped, with the same reason code the plugin writes to your activity log.
Submit the form and the result of every check appears here.
What you are actually looking at
Really running
The honeypot, the timing trap and both self-hosted challenges genuinely execute, and the verdict reports what actually happened. The provider widgets are the providers’ own.
Running in your browser
In the plugin every decision is made on your server, where a visitor cannot reach or rewrite it. On a static page there is no server to use, so the checks run here instead.
Nothing loads unasked
The self-hosted challenges make no network request at all. The three managed providers each name their host and wait for you to click before loading anything.
The Pro checks, hands on
Write something spammy and watch the score fall. Press submit six times in thirty seconds. Try a throwaway address.
These four run on your server in the real plugin, against state a visitor cannot see or reach. What follows is the same logic on the same signals, running here so you can try it — a faithful model of the check, not the check itself.
Spam scoring
Every message starts trusted and loses points for what it contains. Below 50 and it is held.
Trust score 100 — accepted
Disposable address check
Throwaway inboxes are how one person becomes a hundred signups. Try
[email protected].
Rate limiting
5 submissions per 30 seconds from one visitor. Press it faster than that and see what happens.
0 of 5 used in this window.
Country rules
You choose what to block — the plugin ships no list and judges no country. Pick any, then arrive from one.
Blocked countries
Self-hosted or managed
CaptchaFlow ships 6 challenge types and does not much mind which you pick. They are a genuine trade, so here is both halves of it.
Math and Question
- No account with anyone, and no site keys to paste in
- No third-party script on your pages, so nothing to slow them down
- No visitor data leaves your server — the whole check happens locally
- Nothing to break when a provider has an outage
Turnstile, reCAPTCHA, hCaptcha
- Far harder for a determined bot than a sum or a question
- Adapts as attack patterns change, without you doing anything
- Costs a third-party script, cookies, and a request per visitor
- Needs an account and a pair of site keys
reCAPTCHA v3 has no tab above, on purpose. It renders no widget at all — it scores visitors silently in the background and shows only a badge. There is nothing to press, so a tab for it would be a paragraph pretending to be a demo. It is fully supported in the plugin.
Seen enough?
The free plugin covers every form on your site, all 6 challenge types, and both silent checks you just tried. 2.6 KB on the pages that need it, nothing on the ones that do not.