Simple CAPTCHA

Summarize with AI

Simple CAPTCHA is a freemium WP PowerSuite security module that asks a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on your server — no Google, Cloudflare, or other CAPTCHA account required.

Product overview: Simple CAPTCHA.

Bot checks without a third-party CAPTCHA account

Core WordPress and WooCommerce coverage is free. Unlock form integrations, honeypot/timing, and skip rules with WP PowerSuite Pro.

View pricing

Why teams choose it

Automated signups, comment spam, and checkout abuse still hit WordPress sites every day. Managed CAPTCHA services need accounts, domains, and outbound API calls. Simple CAPTCHA inside WP PowerSuite gives you:

Self-hosted challenges (math, custom text, or image) with no external keys
Free coverage for WordPress core and WooCommerce
Pro coverage for the form and membership plugins agencies already ship
Honeypot + timing anti-bot layers and skip rules for trusted traffic
One license, one Modules hub, enable only what you need

Who it is for

Sites that cannot or will not use Google reCAPTCHA or Cloudflare Turnstile
Privacy-sensitive or region-restricted environments that block third-party CAPTCHA scripts
Stores that need a lightweight checkout challenge without an external siteverify call
Membership and community sites protecting registration and login
Agencies standardizing spam protection across client sites under one suite

What it does

CAPTCHA types

Type	Behavior
Math	Addition / subtraction / multiplication with Easy, Medium, or Hard difficulty
Text	Custom question/answer pairs (multiple accepted answers separated with `\|`)
Image	Distorted or simple character image; optional case sensitivity; AJAX refresh

Challenges are stored as short-lived server transients and verified once per submission. Optional custom error message overrides the default failure copy.

Free — WordPress core

Protect any combination of:

Login — wp-login.php and custom login URLs
Registration
Password reset — lost-password request and set-new-password
Comments — with a clear error redirect when verification fails

Optional skip for logged-in visitors so staff and members are not challenged on every comment.

Free — WooCommerce

Login, registration, and lost password
Checkout — classic shortcode checkout and block checkout (Store API)
Product reviews (when Comments protection is off)
HPOS and cart/checkout Blocks compatibility declared
Challenge mounts before Place Order on block checkout (not after the button)

Pro — form integrations (auto-inject)

When the matching plugin is active and the integration is enabled:

Basic Forms (WP PowerSuite)
Contact Form 7
WPForms
Formidable Forms
Fluent Forms
Elementor Pro Forms — add a Simple CAPTCHA field in the Form widget (place it before Submit)
Gravity Forms (final page only on multi-page forms)
Jetpack forms
bbPress (topics and replies)
BuddyPress registration (inline error, not a hard 403 page)
Ultimate Member (login, register, reset)
MemberPress (login and checkout)
Easy Digital Downloads (login, register, checkout)
Paid Memberships Pro (checkout, frontend login, lost password, reset password)

Pro — MC4WP (shortcode only)

Mailchimp for WordPress does not auto-inject a challenge. After you enable the MC4WP integration:

Open MC4WP → Forms and edit your form.
Place this shortcode above the submit button:

[wpps-mc4wp-simple-captcha]

Save the form and hard-refresh the front end.

Verification runs only when that shortcode is present in the form. If you see the shortcode as plain text, the integration is off at runtime (usually missing WP PowerSuite Pro license) or the form has not been saved with the shortcode.

CAPTCHA options

Option	What it controls
CAPTCHA type	Math, Text, or Image
Math difficulty	Easy, Medium, or Hard
Text questions	Custom Q&A pairs (built-in defaults available)
Image style / length / case	Distorted vs simple, character count, case sensitivity
Skip logged-in	Do not challenge signed-in visitors
Error message	Optional custom failure copy for all protected forms

Advanced options (Pro)

Honeypot field — hidden trap that bots fill; humans leave empty (works on classic POST and Woo Blocks Store API)
Reject submissions that are too fast — minimum seconds before submit (1–30)
AJAX comment reset — clear / refresh the challenge when replying to comments via AJAX
Canonical-only login / registration — protect only the real wp-login.php paths
WooCommerce checkout: guests only — skip logged-in shoppers

Skip rules (Pro)

Skip both the challenge and verification for trusted traffic:

WordPress roles
IP addresses / CIDR ranges (IPv4 and IPv6)
User-Agent substrings

Use this for staff, office networks, or monitoring bots — not as a substitute for real access control.

Free vs Pro at a glance

Capability	Free	Pro
Math / Text / Image types	✅	✅
WordPress login, register, reset, comments	✅	✅
WooCommerce login, register, reset, checkout, reviews	✅	✅
Form-plugin integrations	—	✅
MC4WP shortcode	—	✅
Honeypot / timing / skip rules / AJAX comment reset	—	✅
Canonical-only login/register / guest-only checkout	—	✅

Without WP PowerSuite Pro, Pro-tier toggles are forced off at runtime even if they still appear saved in the UI. Install WP PowerSuite Pro and activate under WP PowerSuite → License.

When to enable it

Turn it on when you want to:

Stop bots on login, registration, comments, or checkout without a third-party CAPTCHA account
Keep verification fully on your WordPress server
Cover classic and block checkout in one module
Use custom brand-friendly questions instead of a vendor widget

When to leave it off

How to get started

Go to WP PowerSuite → Modules → Security and enable Simple CAPTCHA.
Open module settings → choose Math, Text, or Image.
Enable WordPress core and WooCommerce surfaces you need.
With a WP PowerSuite Pro, enable form integrations. For Elementor Pro, add the Simple CAPTCHA field to each form. For MC4WP, also add [wpps-mc4wp-simple-captcha] in the form editor.
Hard-refresh protected front-end pages (and purge page cache if you use one).

How to verify it works

Set type to Math, enable Login, open wp-login.php in a private window.
✅ Challenge appears; wrong answer blocks login; correct answer allows login with valid credentials.
For Image, confirm the image loads and refresh works.
✅ New image and new session after refresh.
Enable Checkout, add a product, and place an order on classic and block checkout.
✅ Challenge appears before Place Order; failing verification blocks the order.
Enable a Pro form (for example Contact Form 7), submit without solving.
✅ The form is rejected for captcha.
For MC4WP, confirm the shortcode renders a challenge (not literal text), then submit without solving.
✅ Subscription is rejected with the Simple CAPTCHA error message.
For Paid Memberships Pro, open checkout, login, and lost-password pages.
✅ Challenges appear on each; checkout does not show an error before you submit.
For Gravity Forms multi-page forms, advance pages without solving until the final submit.
✅ Verification runs only on the last page.

Troubleshooting

No challenge for admins. Skip logged-in or skip rules may match — test logged out / from another IP.
Image blank. PHP GD may be missing on the server.
Blocks checkout challenge after Place Order / React errors. Update to the latest Simple CAPTCHA build; the widget mounts before Place Order outside React-owned rows.
MC4WP shows [wpps-mc4wp-simple-captcha] as text. Enable the MC4WP integration with a valid WP PowerSuite Pro, keep the shortcode in the form editor, save, and hard-refresh.
PMP shows a verification error before submit. Update the module; validation belongs on submit (pmpro_registration_checks), not page load.
Elementor field missing. Enable the Elementor Pro Forms integration (Pro + Elementor Pro active), then add Field type Simple CAPTCHA in the Form widget.
Two CAPTCHAs on one form. Disable the overlapping toggle in Turnstile or reCAPTCHA.
Pro section locked or ignored. Install WP PowerSuite Pro and activate under WP PowerSuite → License, then re-save settings.

Manage with WP-CLI

Prefer the command line? You can turn this module on or off with WP-CLI instead of the dashboard:

# Turn the module on
wp powersuite module enable simple-captcha

# Turn the module off
wp powersuite module disable simple-captcha

# Check whether it is on, its category, and where its settings live
wp powersuite module get simple-captcha

Managing more than one site? Add --url=https://example.com to point a command at one site. If this is a Pro module, install WP PowerSuite Pro and activate your license first. New to WP-CLI? See the full command guide.

FAQ

What does Simple CAPTCHA do in WP PowerSuite?

It adds a self-hosted math, text, or image challenge to WordPress core forms, WooCommerce surfaces, and Pro form-plugin integrations — verified entirely on your server.

Is Simple CAPTCHA free in WP PowerSuite?

Yes. Core WordPress and WooCommerce protection is free. Form integrations, anti-bot extras, and skip rules require an active WP PowerSuite Pro license.

Do I need a Google or Cloudflare account?

No. Challenges are generated and verified on your WordPress server with no third-party CAPTCHA service.

Does it protect WooCommerce Blocks checkout?

Yes. Classic checkout and block checkout (including Store API) are supported. The challenge mounts before Place Order.

How do I add Simple CAPTCHA to MC4WP forms?

Enable the MC4WP integration (Pro), then place [wpps-mc4wp-simple-captcha] in the MC4WP form editor above the submit button. There is no auto-injection.

Can I use custom questions?

Yes. Choose Text type and add question/answer pairs. Multiple accepted answers can be separated with a pipe (|).

Can I use Simple CAPTCHA with Turnstile or reCAPTCHA?

You can enable the modules side by side, but do not protect the same form in more than one. Overlapping challenges create a poor login or checkout experience.

How do I turn Simple CAPTCHA off?

Go to WP PowerSuite → Modules, find Simple CAPTCHA, and toggle it off. Disabled modules do not load at runtime.

Developer notes (hooks & filters)

Source: modules/simple-captcha/module.php, ExtendedIntegrations.php, FeatureGate.php.
Boot: critical · context: both.

Verify filter: wpps_verify_simple_captcha
Basic Forms: wpps_verify_basic_forms_captcha
Error copy filter: wpps_captcha_error_message
Woo Store API namespace: wp-powersuite-simple-captcha (extension fields key, answer, hp, hp_value)
Blocks mount: render_block_woocommerce/checkout-actions-block + assets/woo-checkout.js
MC4WP shortcode: wpps-mc4wp-simple-captcha (expanded via mc4wp_form_content + do_shortcode)
Elementor Pro field type: wpps_simple_captcha
Successful verifies are memoized per request so one-time challenges survive WordPress double-validation paths

Ready for self-hosted bot checks?

Enable Simple CAPTCHA in WP PowerSuite, protect the forms that matter, and keep verification on your server.

Get WP PowerSuite