LukaCodes

AntiSpam Shield by LukaCodes is a lightweight, no-bloat plugin that protects your WordPress comment section and contact forms from spam. Six independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.
<ul>
<li>Disable Website Field — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li>Strip Links from Comments — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li>reCAPTCHA v3 — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li>Cloudflare Turnstile — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li>Login Shield — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li>Registration Shield — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li>WPForms Integration — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
<li>Easy Contact Form by LukaCodes Integration — Apply the same CAPTCHA protection to forms created with the companion Easy Contact Form plugin.</li>
</ul>
All features are independent — enable only what you need.
<h4>Login & Registration Shield</h4>
Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:
<ul>
<li>Login Shield — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li>Registration Shield — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
Both are independently togglable in the settings panel. Admins already logged in are never affected.
<h4>WPForms Integration</h4>
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
<h4>Easy Contact Form by LukaCodes Integration</h4>
Version 1.1.4 adds CAPTCHA protection for forms created with <a href="https://wordpress.org/plugins/lukacodes-easy-contact-form/" rel="ugc">Easy Contact Form by LukaCodes</a>:
<ul>
<li>Injects the CAPTCHA widget (Turnstile) or invisible token (reCAPTCHA v3) into every Easy Contact Form on the page.</li>
<li>Hooks into Easy Contact Form’s <code>lukacodes_comment_shield_check</code> filter for server-side token verification before the submission is processed or emails are sent.</li>
<li>Uses the same CAPTCHA keys you already configured — no extra setup.</li>
<li>When a token fails, the user sees a CAPTCHA-specific error message inline; the submission is never stored or emailed.</li>
</ul>
<h4>Why AntiSpam Shield?</h4>
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. AntiSpam Shield by LukaCodes is different:
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li>Link stripping preview — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li>Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
<h4>Cloudflare Turnstile — How it works</h4>
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
<h3>Third-Party Services</h3>
This plugin optionally uses the following third-party services:
<h4>Google reCAPTCHA v3</h4>
A service provided by Google LLC.
<ul>
<li>What it does: Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li>When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a reCAPTCHA token.</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
A service provided by Cloudflare, Inc.
<ul>
<li>What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li>When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a Turnstile token.</li>
<li>Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

AntiSpam Shield by LukaCodes

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

Bill Minozzi

★★★★★
This reCAPTCHA For All plugin’s key advantage is that it blocks page content from being sent to the browser until the user passes the challenge. Unlike most plugins that load the full page and use an overlay to block interaction—allowing bots to scrape content from the source code and overload your server—this plugin ensures the page remains blank for bots. No content is sent from the server until a human is verified, leaving nothing for bots to steal, process, or use to overburden your server.
This plugin provides advanced protection against bots, spam, hackers, fake users, and other types of automated abuse on any selected Page on your site. Utilize invisible reCaptcha V3 (Google) or Turnstile (Cloudflare) to secure your site without disrupting the user experience. Customize the template (Appearance) and messages/language to fit your needs. The plugin also allows you to block visitors from China. Translation ready. Files included: Dutch, English, French, Italian, Portuguese, Spanish, and German. 
 Additionally, it features analytics charts to monitor your site’s protection. 
Installing and getting started with the plugin is quick and easy—even for beginners. Just a few simple steps and you’re up and running!
<a href="https://recaptchaforall.com/espanol/" rel="nofollow ugc">Spanish</a> 
<a href="https://recaptchaforall.com/it/italiano-home/" rel="nofollow ugc">Italiano</a> 
<a href="https://recaptchaforall.com/pt/portugues-iniciar/" rel="nofollow ugc">Portuguese</a>
Revolutionize reCAPTCHA:
<li>Free for commercial use. Turnstyle is 100% free, while Google has certain usage limits.</li>
<li>Test Button to easily check your keys.</li>
<li>Only reveal page content to humans, preventing bots from stealing content and damaging your SEO.</li>
<li>Customize the box design: color, text, background, image, and more.</li>
<li>Display the box exclusively during the initial visit for a seamless user experience.</li>
<li>Identify humans and bots right from the first visit.</li>
<li>Choose specific pages for protection or opt to secure all pages.</li>
<li>If using Cloudflare Turnstile, select from three types (Managed, Non-interactive, Invisible).</li>
Enhanced User Experience: 
The box, featuring a tailored message and button, appears only once during the user’s initial site visit. Manage the message’s design, text, and button – ideal for introducing cookie policies or any initial communication.
For example:
<li> By continuing to browse, you consent to our use of cookies for a better website experience.</li>
<li> Click ‘OK’ to verify browser compatibility.</li>
<li> Human? Simply click ‘Yes’…</li>
<li> Click Yes if you have more than X years old … </li>
<li> Subscribe to our newsletter for the latest updates and stay informed! Click … </li>
<li> Connect with us on social media and stay tuned for exciting updates and content! </li>
<li> After your visit, kindly share your feedback with us.</li>
<li> Sorry, we just need to make sure you’re not a robot. For best results, please make sure your browser is accepting cookies.</li>
<li> And anything else you’d like to write…</li>
If you choose Google Recaptcha, after the user click the button, the plugin will send a request to google check that visitor reputation and google sends a immediate response with an score*. 
(*) Cloudflare don’t have the score feature. 
Then, the plugin will allow the user with required score (the score filter rate is up to you) load the page otherwise will block with a forbidden error.
The user browser needs accept cookies and be with javascript enabled. WordPress system also request that, then, it is not a big deal.
This can avoid the bots from stealing your content, consume your bandwidth and overload your server.
Widely Trusted Compatibility: 
The plugin seamlessly accommodates major search engine bots, including Google, Bing (Microsoft), Facebook, Slurp (Yahoo), and Twitter, ensuring uninterrupted access for these reputable entities. 
Expand the whitelist beyond major search engines to include essential services such as site uptime monitoring, PayPal, Stripe, and more. Tailor the whitelist table to suit your specific needs.
Note: This plugin requires Google or CloudFlare site key and secret key to work. 
Look the FAQ how to get that. 
This plugin conveniently provides a “Manage keys” tab within the plugin dashboard, enabling you to effortlessly test your keys.
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/VY9cbONlrJo?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
<a href="https://recaptchaforall.com/" rel="nofollow ugc">Plugin Site</a>
<h3>Block visitors from China</h3>
If you are getting a lot of spam and malicious traffic from China, with our plugin 
you can block it without worry about install (and mantain) huge databases of IP address. 
Just let our plugin take care that.
This plugin is multi language ready. It also include files for Italian and Portuguese languages. 
If you like to translate the plugin on your language, please, visit: 
https://make.wordpress.org/polyglots/handbook/translating/glotpress-translate-wordpress-org/
<h3>External service (1)</h3>
When using our chat, only some information about issues, such as your language and data from the Diagnose tab, may be sent to our server. We do not share, publish, or disclose any information with third parties. 
domain: https://BillMinozzi.com/chat/api/api.php
<h3>External service (2)</h3>
The plugin will retrieve tips and news from our site BillMinozzi.com. This information will be displayed in the plugin dashboard, in the right-hand column under the title “Tips and News.” No data is sent to our server. 
domain: https://billminozzi.com/API/bill-api.php
<h3>Advanced Site Health</h3>
WordPresss built-in Site Health feature provides a great baseline for your sites well-being. However, in todays digital landscape, true health goes beyond server configuration. A site can have a perfect score and still be slow, vulnerable, or plagued by critical errors.
Our plugin extends the core Site Health concept to provide a truly holistic analysis of what keeps your site fast, stable, and secure. We dont just check the basics; we diagnose critical issues that directly impact your visitors experience and your sites operational integrity.
Our enhanced checks include:Performance & Memory Analysis, Proactive Error Detection, Modern Security Monitoring. 
That involves querying public, authoritative services like rdap.db.ripe.net with visitor IP addresses for security analysis. 
domain: https://rdap.db.ripe.net/ip/
For a complete overview of all features, our data handling practices, and the full terms governing our software, please visit our official website: 
https://siterightaway.net/terms-of-use-of-our-plugins-and-themes/
<h3>Legal Advise about Cookies</h3>
We can’t give legal advise about Cookies (neither other things). We suggest you contact a lawyer regards that.

Integrator for Turnstile and reCAPTCHA.

Revolutionize reCAPTCHA or Cloudflare Turnstile. Enjoy an analytics chart. Protect all or selected pages against spam and bots.Free!

AntiSpam Shield by LukaCodes vs Integrator for Turnstile and reCAPTCHA.