CaptchaFlow

Introduction

CaptchaFlow puts a verification step in front of your forms and records every decision it makes. It ships adapters for 12 form sources and 6 challenge types, plus a generic CSS-selector adapter for everything else.

Two ideas run through the whole plugin. Protection should be the default rather than something you remember to switch on per form; and every block should be explainable — when something is stopped, the log names the check that stopped it.

Requirements

Installation Free

1. In your dashboard, go to Plugins → Add New and search for CaptchaFlow.
2. Click Install, then Activate.
3. The setup wizard opens by itself. If you dismissed it, it is at CaptchaFlow → Setup.

Quick start Free

1. Choose a challenge. Cloudflare Turnstile is free and usually invisible. The Math challenge needs no account at all — pick that if you want to be protected in the next ten seconds.
2. Paste your keys. Skipped entirely for the self-hosted challenges. Keys are tested immediately rather than failing silently later.
3. Leave protect-all on. Every form CaptchaFlow can find is covered, including ones you add later.
4. Confirm. The wizard fetches a real challenge through the same endpoint your visitors use. If that passes, you are done.

Form sources Free

CaptchaFlow → Forms lists every source it detected. The switch at the top covers all of them; turn it off to choose form by form.

• Contact Form 7 Free
• WPForms Free
• Fluent Forms Free
• Forminator Free
• Ninja Forms Free
• Gravity Forms Free
• Elementor Pro Forms Free
• WooCommerce login & registration Free
• WooCommerce checkout & reviews Pro
• WordPress login Free
• WordPress registration Free
• WordPress password reset Free
• WordPress comments Free
• Any other form, by CSS selector Free

Custom forms Free

For a form CaptchaFlow does not recognise, go to Forms → Other forms (by CSS selector) and add a selector that matches it. The challenge is attached and the submission validated for you, with no code.

form.my-newsletter
#booking-form
.wp-block-my-plugin form

Challenges and keys Free

CaptchaFlow → Provider holds the challenge choice and its keys. Secrets are encrypted at rest. Changing challenge does not require touching any form — every protected form picks up the new one.

Silent checks Free

Before any provider is contacted, two cheap checks run on every submission: a honeypot field a person never sees, and a timing trap that rejects submissions completed impossibly fast. Most automated spam is stopped here, which means it never costs you a network call.

Activity log Free

Every decision is recorded with a reason code — provider_ok, honeypot, time_trap and so on. Writes are deferred to the end of the request, so logging never slows a submission down. Retention is yours to set, and the log can be emptied at any time.

Diagnostics Free

Tools → Diagnostics checks your environment, provider keys, REST API, scheduled tasks and known plugin conflicts, and names the fix for anything it finds. Export report produces a text summary containing no keys or secrets — attach it to a support email and you will usually skip a round trip.

Privacy tools Free

IP addresses are shortened to their network before they are written — the last part of an IPv4 address is dropped, and IPv6 is cut harder still. Turn on full anonymisation and no IP data is stored at all. Email addresses are never stored in readable form.

CaptchaFlow also plugs into Tools → Export Personal Data and Tools → Erase Personal Data, and generates suggested privacy-policy wording from the configuration you actually chose.

PHP SDK Free

Render the field where you want it, and verify on submit.

// In your form template.
if ( function_exists( 'tscf_field' ) ) {
	tscf_field( 'my-plugin/contact' );
}

// In your submit handler.
$result = tscf_verify( 'my-plugin/contact' );

if ( ! $result->passed() ) {
	wp_die( esc_html( $result->message() ), '', array( 'response' => 403 ) );
}

$result also carries the reason code, so you can branch on why something failed rather than only on whether it did.

Hooks Free

17 public hooks are documented in the plugin's developer reference. The two you are most likely to want:

// Register your own form adapter.
add_filter( 'tscf_register_integration', function ( $integrations, $pipeline ) {
	$integrations[] = new My_Form_Adapter( $pipeline );
	return $integrations;
}, 10, 2 );

// Add your own check to the verification pipeline.
add_filter( 'tscf_pipeline_middleware', function ( $middleware ) {
	$middleware[] = new My_Middleware();
	return $middleware;
} );

WP-CLI Free

wp tscf status          # configuration and provider health
wp tscf diagnostics     # the same checks as the Tools screen
wp tscf log --limit=20  # recent decisions
wp tscf prune           # apply retention now

Pro features Pro

Pro adds what you need once spam stops being accidental: rate limiting, a firewall, email and phone validation, spam scoring with a threshold you set, country rules, WooCommerce checkout and review protection, a card-testing throttle, analytics, alerts, a developer API with webhooks, settings transfer, white label and multisite support.

See every Pro feature →

Activating a licence Pro

1. Install and activate the CaptchaFlow Pro plugin alongside the free one.
2. Go to CaptchaFlow → Licence and paste your key.
3. Click Activate. The site is bound to that licence and updates begin.

Troubleshooting

Support

Free support happens in the plugin's forum on WordPress.org. Pro licences are supported by email at [email protected] — attach Tools → Diagnostics → Export report and we can usually answer without a second exchange.

Still stuck, or think you found a bug? The FAQ covers the common cases, and contact reaches the people who write the code.