LukaCodes

LukaCodes AntiSpam Shield is a lightweight, no-bloat plugin that protects your WordPress comment section and contact forms from spam. Five independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.
<ul>
<li>Disable Website Field — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li>Strip Links from Comments — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li>reCAPTCHA v3 — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li>Cloudflare Turnstile — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li>Login Shield — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li>Registration Shield — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li>WPForms Integration — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
</ul>
All features are independent — enable only what you need.
<h4>Login & Registration Shield</h4>
Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:
<ul>
<li>Login Shield — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li>Registration Shield — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
Both are independently togglable in the settings panel. Admins already logged in are never affected.
<h4>WPForms Integration</h4>
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
<h4>Why AntiSpam Shield?</h4>
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes AntiSpam Shield is different:
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li>Link stripping preview — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li>Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
<h4>Cloudflare Turnstile — How it works</h4>
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
<h3>Third-Party Services</h3>
This plugin optionally uses the following third-party services:
<h4>Google reCAPTCHA v3</h4>
A service provided by Google LLC.
<ul>
<li>What it does: Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li>When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a reCAPTCHA token.</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
A service provided by Cloudflare, Inc.
<ul>
<li>What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li>When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a Turnstile token.</li>
<li>Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

LukaCodes AntiSpam Shield

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

Freemius

Emil Simunovic

Authica™ upgrades the default WordPress login into a polished, on-brand experience with practical, layered security. It is built for agencies, developers, and site owners who want professional design control without sacrificing protection.
Creator Program: We invite WordPress creators to publish an honest Authica walkthrough on YouTube (no positive review required). 
Find out more: <a href="https://authica.net/creator-program/" rel="nofollow ugc">authica.net/creator-program</a>
Highlights:
<ul>
<li>
Customizer Login Design 
Brand every key element: logo, background, overlays, layout, and typography (including Google Fonts).
</li>
<li>
Email Verification 
Require users to confirm their email address before they can sign in.
</li>
<li>
Bot Protection 
Supports privacy-focused Cloudflare Turnstile.
</li>
<li>
Hide / Rename wp-login.php 
Reduce automated attacks by moving the login URL away from the default target.
</li>
<li>
Login & Logout Redirects 
Send users to the right page after login/logout (dashboard, custom URL, or role-based flows).
</li>
<li>
IP Restriction 
Allow/deny access to the login screen using IP rules.
</li>
<li>
Brute Force Protection 
Automatically rate-limit and block repeated failed login attempts.
</li>
<li>
Two-Factor Authentication (TOTP) 
Add app-based 2FA for stronger account security.
</li>
<li>
Security Logs & Alerts 
Monitor login activity and suspicious events from a single place.
</li>
<li>
Login Methods 
Social Login, Passkeys section foundation, and Magic Links with per-user passwordless link controls.
</li>
</ul>
Authica Free includes full visual branding tools plus core security features. Upgrade to Authica Pro for advanced controls and premium protections.
Learn more: <a href="https://authica.net" rel="nofollow ugc">https://authica.net</a>
<h3>Contributors</h3>
emilsim (Emil Simunovic)
<h3>Privacy</h3>
This plugin uses an optional opt-in to collect non-sensitive diagnostic data and plugin usage information to help improve the product. The opt-in is presented on first use and can be changed at any time under Authica → Account.
Collected data may include: WordPress/site version, language, plugin/theme list and versions, admin email (for license/updates), and anonymized site URL. No personal content or passwords are collected.
Data is processed by our licensing/telemetry provider and by us for support and update delivery. 
• Provider’s Privacy & Terms: https://freemius.com/privacy/ , https://freemius.com/terms/
If you choose not to opt in, only the information required to deliver updates to your site is stored (license/installation ID, if you activate a license).
<h3>Current Features</h3>
Branding & Design 
– Upload your own logo 
– Customize colors, backgrounds, and overlays 
– Google Fonts 
– Live preview via WordPress Customizer
Security & Protection 
– Cloudflare Turnstile CAPTCHA integration 
– Email verification (Pro) 
– Hide/Rename wp-login.php (Pro) 
– Redirect Rules
User Experience 
– Custom welcome/error messages 
– Login & logout redirects 
– AJAX-powered login form 
– Mobile-first responsive design
<h3>External services</h3>
<h4>Cloudflare Turnstile (human verification)</h4>
This plugin can integrate with Cloudflare Turnstile to protect login, registration, and password-reset forms from automated abuse.
• What is it used for? 
 Turnstile provides a human verification widget to reduce bot signups and credential-stuffing attempts.
• What data is sent and when? 
 – On pages where the widget is shown, the Turnstile JavaScript file is loaded from 
 https://challenges.cloudflare.com/turnstile/v0/api.js. When loaded, Cloudflare 
 may receive standard browser/connection data (e.g., IP address, user agent, referrer) 
 and evaluate device/browser signals to determine risk, per Cloudflare’s documentation. 
 – When a verification token is produced by the widget, your WordPress site makes a 
 server-to-server request to: 
 https://challenges.cloudflare.com/turnstile/v0/siteverify 
 The server-to-server verification includes the user’s response token and your secret key. 
 When a valid client IP is available, the optional remoteip value may also be sent to Cloudflare to improve verification accuracy.
• Where can I learn more? 
 – Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/ 
 – Turnstile docs: https://developers.cloudflare.com/turnstile/ 
 – Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/ 
 – Cloudflare Terms of Service: https://www.cloudflare.com/terms/
• How do I disable it? 
 Turnstile integrations can be disabled at Authica → Turnstile & Edge Security, which stops the 
 widget from loading and the verification endpoint from being called.
<h4>jsDelivr (Chart.js fallback, admin-only)</h4>
For the admin “Captcha Statistics” chart, this plugin prefers a local copy of Chart.js 
(bundled in <code>assets/vendor/chart.js/</code>). If the local file is not present, it falls back to 
loading Chart.js from: 
 https://cdn.jsdelivr.net/npm/chart.js@4.4.3/dist/chart.umd.min.js
• What data is sent? 
 Only the administrator’s browser requests the static script file from the CDN. 
 No user content or personal data is transmitted by this plugin as part of that request.
• How do I avoid the CDN? 
 Keep the local file at <code>assets/vendor/chart.js/chart.umd.min.js</code> so the fallback is not used.
<h4>Email delivery</h4>
This plugin uses WordPress <code>wp_mail()</code> to send email verification messages. Mail delivery 
is handled by your hosting provider or any SMTP/email plugin you configure. If you connect 
a third-party email service (e.g., via an SMTP plugin), that service’s privacy terms apply. 
This plugin does not send verification data to any email vendor on its own.
<h3>Trademark</h3>
Authica™ is a trademark claimed by Emil Simunovic. Registration pending. 
WordPress is a registered trademark of the WordPress Foundation, used under license.

Authica

Authica™ gives your WordPress site a fully branded and secure login experience.

LukaCodes AntiSpam Shield vs Authica