Opens in a new tab
Turquoise abstract wavy W logo on a black background
Turquoise abstract wavy W logo on a black background
White WP PowerSuite logo on a black background
White WP PowerSuite logo on a black background
[wpps_ai_summarize]
On This Page
Last updated: 05/08/2026

Simple CAPTCHA

Ask a quick math question, custom prompt, or image check before someone can submit a form or log in. Everything runs on your server—no third-party CAPTCHA account required.

Overview

Simple CAPTCHA adds self-hosted bot protection to WordPress, WooCommerce, and supported third-party forms. Choose from math questions, custom text questions, or image-based challenges without creating a Google or Cloudflare account.

Challenges are generated and verified directly on your server, with no external CAPTCHA scripts or verification APIs. Core WordPress and WooCommerce protection is available for free, while Premium adds form integrations, honeypot protection, timing checks, skip rules, and advanced behavior controls.

Solid black square
Solid black square
Who is this for?
  • Privacy-sensitive sites that refuse Google/Cloudflare widgets
  • Simple comment/login spam problems
  • Offline or restricted-network environments

Features

Three Challenge Types
Choose between arithmetic questions, custom text questions, and character-based image challenges.
Adjustable Math Difficulty
Use Easy, Medium, or Hard math questions depending on the level of protection your website needs.
Custom Questions and Answers
Create site-specific text questions and allow multiple accepted answers for greater flexibility.
Customizable Image CAPTCHA
Choose a simple or distorted style, set the character length, enable case sensitivity, and allow visitors to refresh the challenge.
WordPress Form Protection
Protect WordPress login, registration, password reset, and comment forms from automated submissions.
WooCommerce Protection
Add CAPTCHA to WooCommerce login, registration, lost password, checkout, and supported product-review forms.
Popular Form Integrations
Premium supports major form builders, membership plugins, community tools, and e-commerce systems.
Honeypot Protection
Add an invisible field that helps catch bots attempting to complete every available input.
Guest-Only Checkout Protection
Require CAPTCHA for WooCommerce guests while allowing logged-in customers to complete checkout without another challenge.

Self-Hosted CAPTCHA Protection

  • Unlike Google reCAPTCHA and Cloudflare Turnstile, Simple CAPTCHA does not depend on an external verification service.
  • The challenge is created inside WordPress and checked directly on your server. There are no external CAPTCHA keys, remote verification requests, or third-party challenge scripts.
  • This makes it a practical option for privacy-sensitive websites and environments where Google or Cloudflare services are restricted, blocked, or unreliable.

Choose the Challenge That Fits Your Website

  • Math CAPTCHA provides a quick arithmetic question and can be adjusted using Easy, Medium, or Hard difficulty.
  • Text CAPTCHA allows you to create custom questions that match your website or audience. Multiple accepted answers can be added when visitors may enter the same response in different ways.
  • Image CAPTCHA generates a character-based challenge using either a clean or distorted style. You can choose a length between four and eight characters, enable case-sensitive answers, and let visitors refresh difficult challenges.
  • Image CAPTCHA requires the PHP GD extension to be available on the server.

Protect WordPress and WooCommerce

  • The free version covers the WordPress forms most commonly targeted by bots, including login, registration, password reset, and comments.
  • WooCommerce protection includes customer login, registration, lost password, checkout, and product reviews.
  • Both classic and block-based checkout are supported. On WooCommerce Blocks, the challenge appears before the Place Order button and is verified through the Store API.
  • Premium can limit checkout protection to guests, helping protect public checkout while keeping the experience faster for returning customers.

Works With Popular WordPress Plugins

  • Premium extends Simple CAPTCHA to supported form, membership, community, and e-commerce plugins.
  • Integrations include Basic Forms, Contact Form 7, WPForms, Formidable Forms, Fluent Forms, Elementor Pro Forms, Gravity Forms, and Jetpack Forms.
  • It also supports bbPress, BuddyPress, Ultimate Member, MemberPress, Easy Digital Downloads, and Paid Memberships Pro.
  • Mailchimp for WordPress is supported through the [wpps-mc4wp-simple-captcha] shortcode, giving you control over exactly which newsletter forms display the challenge.

Use Cases

  • Protect WordPress Without External CAPTCHA Services
    Add bot protection without creating a Google or Cloudflare account or loading third-party verification scripts.
  • Reduce Fake WooCommerce Orders
    Protect classic and block checkout from automated submissions that create invalid orders and unnecessary notifications.
  • Stop Spam Registrations
    Add CAPTCHA to WordPress, WooCommerce, membership, and supported community registration forms.
  • Protect Contact Forms
    Reduce automated enquiries across supported form builders using a self-hosted challenge.
  • Secure Privacy-Focused Websites
    Keep CAPTCHA generation and verification on your own server instead of sending verification data to an outside provider.
  • Protect Membership and Community Sites
    Add verification to supported login, registration, password-reset, checkout, topic, and reply forms.

Frequently Asked Questions

Related Modules

Email Obfuscator

Automatically protects visible email addresses and mailto links from basic spam bots by safely encoding them while keeping them clickable for visitors.
Security
Disabled

Cloudflare Turnstile

Bot protection with Cloudflare Turnstile on logins, forms, comments, and WooCommerce—low hassle for real people.
Security
Disabled

Hide WP Version

Removes WordPress version from public HTML generator tags, feed generator output, and the admin footer. Does not change ver= on script and...
Security
Disabled

Security Headers

Tell modern browsers to enforce sensible safety rules—like blocking sneaky scripts and iframe tricks—with strong defaults you can tighten further for HSTS...
Security
Disabled

Two-Factor Authentication (2FA)

Two-factor login for selected roles—extra proof beyond the password.
Security
Disabled

Google reCAPTCHA

Google reCAPTCHA on logins, forms, comments, and WooCommerce to block bots and spam signups.
Security
Disabled

Disable Password Reset

Turn off public "forgot password" self-service for everyone. Use only when you reset passwords another way (manual admin password, WP-CLI, or admin-sent...
Security
Disabled

Disable File Editing

Remove the dashboard screens that let anyone edit theme or plugin code from the browser—one less disaster if an account is compromised.
Security
Disabled

Force SSL Admin

Always open your dashboard and login screen over a secure https:// link. Anyone using the old http:// address is sent to the...
Security
Disabled

Disable Trackbacks/Pingbacks

Stops old-style trackbacks and pingbacks that often bring spam or junk alerts.
Security
Disabled