LukaCodes

<p><strong>LukaCodes AntiSpam Shield</strong> is a lightweight, no-bloat plugin that protects your WordPress comment section <strong>and contact forms</strong> from spam. Five independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.</p>
<ul>
<li><strong>Disable Website Field</strong> — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li><strong>Strip Links from Comments</strong> — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li><strong>reCAPTCHA v3</strong> — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li><strong>Cloudflare Turnstile</strong> — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li><strong>Login Shield</strong> — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li><strong>Registration Shield</strong> — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li><strong>WPForms Integration</strong> — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
</ul>
<p>All features are <strong>independent</strong> — enable only what you need.</p>
<h4>Login & Registration Shield</h4>
<p>Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:</p>
<ul>
<li><strong>Login Shield</strong> — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li><strong>Registration Shield</strong> — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
<p>Both are independently togglable in the settings panel. Admins already logged in are never affected.</p>
<h4>WPForms Integration</h4>
<p>Version 1.1.0 introduces CAPTCHA protection for <strong>WPForms Lite</strong>:</p>
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
<p>Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for <strong>WPForms Lite</strong> users only.</p>
<h4>Why AntiSpam Shield?</h4>
<p>Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes AntiSpam Shield is different:</p>
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with <strong>live key testing</strong> — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li><strong>Link stripping preview</strong> — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li><strong>Mutual exclusion</strong>: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
<p>When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.</p>
<h4>Cloudflare Turnstile — How it works</h4>
<p>A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.</p>
<h3>Third-Party Services</h3>
<p>This plugin optionally uses the following third-party services:</p>
<h4>Google reCAPTCHA v3</h4>
<p>A service provided by Google LLC.</p>
<ul>
<li><strong>What it does:</strong> Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li><strong>When data is sent:</strong> Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a reCAPTCHA token.</li>
<li><strong>Google Privacy Policy:</strong> https://policies.google.com/privacy</li>
<li><strong>Google Terms of Service:</strong> https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<p>A service provided by Cloudflare, Inc.</p>
<ul>
<li><strong>What it does:</strong> Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li><strong>When data is sent:</strong> Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a Turnstile token.</li>
<li><strong>Cloudflare Privacy Policy:</strong> https://www.cloudflare.com/privacypolicy/</li>
<li><strong>Cloudflare Terms of Service:</strong> https://www.cloudflare.com/website-terms/</li>
</ul>
<p>Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.</p>


LukaCodes AntiSpam Shield

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

timh

bostonwebgroup

<p>BWG CF Turnstile integrates Cloudflare’s Turnstile service with Gravity Forms to provide an effective and user-friendly way to block spam and bot submissions. Turnstile is Cloudflare’s privacy-focused alternative to CAPTCHA that offers better user experience while still providing strong protection.</p>
<h3>Features</h3>
<ul>
<li><strong>Automatic Integration</strong>: Adds Turnstile protection to all your Gravity Forms or just the ones you select</li>
<li><strong>Manual Mode</strong>: For custom placement of the Turnstile widget within your forms</li>
<li><strong>Server-Side Validation</strong>: Securely validates submissions with Cloudflare’s API</li>
<li><strong>Theme Compatibility</strong>: Works with all Gravity Forms themes, including Orbital</li>
<li><strong>Easy Setup</strong>: Simple configuration with minimal settings</li>
</ul>
<h3>Requirements</h3>
<ul>
<li>WordPress 5.0 or higher</li>
<li>Gravity Forms 2.4 or higher</li>
<li>A Cloudflare account to obtain Turnstile site and secret keys</li>
</ul>
<h3>Privacy Considerations</h3>
<p>Cloudflare Turnstile is designed with privacy in mind. Unlike traditional CAPTCHA services, Turnstile is designed to respect user privacy while still providing effective protection. For more information about Turnstile’s privacy practices, please refer to <a href="https://developers.cloudflare.com/turnstile/get-started/client-side-rendering/" rel="nofollow ugc">Cloudflare’s documentation</a>.</p>
<h3>External Services</h3>
<p>This plugin integrates with Cloudflare Turnstile, an external service provided by Cloudflare. The plugin communicates with Cloudflare’s services for form protection functionality.</p>
<h3>What is Cloudflare Turnstile?</h3>
<p>Cloudflare Turnstile is a privacy-preserving alternative to CAPTCHAs that helps protect forms from bots and automated attacks. It challenges visitors in a way that doesn’t disrupt the user experience.</p>
<h3>When does this plugin connect to Cloudflare?</h3>
<ol>
<li>
<p><strong>JavaScript Widget Loading</strong>: When a page containing a protected Gravity Form is loaded, the plugin loads the Turnstile JavaScript widget from <code>https://challenges.cloudflare.com/turnstile/v0/api.js</code>. This happens on every page load where a protected form is displayed.</p>
</li>
<li>
<p><strong>Token Verification</strong>: When a form is submitted, the plugin sends a verification request to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> to validate the Turnstile token.</p>
</li>
</ol>
<h3>What data is sent to Cloudflare?</h3>
<ol>
<li>
<p><strong>During Widget Loading</strong>:</p>
<ul>
<li>Your site key (public identifier)</li>
<li>Standard browser information (user agent, IP address)</li>
</ul>
</li>
<li>
<p><strong>During Token Verification</strong>:</p>
<ul>
<li>The Turnstile response token</li>
<li>Your secret key (for authentication)</li>
<li>The user’s IP address (optional, for additional validation)</li>
</ul>
</li>
</ol>
<h3>Legal and Privacy Information</h3>
<p>By using this plugin, you agree to Cloudflare’s terms and privacy policies:<br />
– <a href="https://www.cloudflare.com/terms/" rel="nofollow ugc">Cloudflare Terms of Service</a><br />
– <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare Privacy Policy</a><br />
– <a href="https://developers.cloudflare.com/turnstile/" rel="nofollow ugc">Cloudflare Turnstile Documentation</a></p>
<p>It is your responsibility to ensure that your use of this plugin complies with all applicable laws and regulations, including data protection laws in your jurisdiction. We recommend reviewing Cloudflare’s privacy policy and terms of service, and updating your own privacy policy to inform users about the use of Cloudflare Turnstile on your website.</p>


BWG CF Turnstile

Add Cloudflare Turnstile protection to your Gravity Forms to prevent spam and bot submissions.

LukaCodes AntiSpam Shield vs BWG CF Turnstile