LukaCodes

LukaCodes AntiSpam Shield is a lightweight, no-bloat plugin that protects your WordPress comment section and contact forms from spam. Five independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.
<ul>
<li>Disable Website Field — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li>Strip Links from Comments — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li>reCAPTCHA v3 — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li>Cloudflare Turnstile — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li>Login Shield — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li>Registration Shield — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li>WPForms Integration — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
</ul>
All features are independent — enable only what you need.
<h4>Login & Registration Shield</h4>
Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:
<ul>
<li>Login Shield — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li>Registration Shield — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
Both are independently togglable in the settings panel. Admins already logged in are never affected.
<h4>WPForms Integration</h4>
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
<h4>Why AntiSpam Shield?</h4>
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. LukaCodes AntiSpam Shield is different:
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li>Link stripping preview — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li>Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
<h4>Cloudflare Turnstile — How it works</h4>
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
<h3>Third-Party Services</h3>
This plugin optionally uses the following third-party services:
<h4>Google reCAPTCHA v3</h4>
A service provided by Google LLC.
<ul>
<li>What it does: Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li>When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a reCAPTCHA token.</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
A service provided by Cloudflare, Inc.
<ul>
<li>What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li>When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a Turnstile token.</li>
<li>Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

LukaCodes AntiSpam Shield

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

Mayank Majeji

S P Pramodh

Smart CAPTCHA Alternative with Cloudflare Turnstile helps you block spam and bots without hurting user experience.
Instead of frustrating image puzzles or invasive tracking, this plugin integrates Cloudflare Turnstile, a modern CAPTCHA alternative that silently verifies real users while respecting privacy.
The plugin is lightweight, loads only when required, and performs server-side verification against Cloudflare’s API.
<h3>Supported Forms</h3>
WordPress: 
* Login Form 
* Registration Form 
* Password Reset Form 
* Comments Form
WooCommerce: 
* Checkout 
* Pay For Order 
* Login Form 
* Registration Form 
* Password Reset Form
Form Plugins: 
* Contact Form 7 
* WPForms 
* Fluent Forms 
* Formidable Forms 
* Ninja Forms 
* Forminator Forms 
* Everest Forms 
* SureForms 
* Kadence Forms
Other Integrations: 
* MailPoet Forms 
* BuddyPress Registration Form 
* bbPress Create Topic & Reply Forms
Why Choose This Plugin: 
* Zero user friction — no puzzles or image challenges 
* Privacy-focused — respects user privacy while providing security 
* Performance optimized — scripts load only when forms are present 
* Currently free — no premium version, no hidden costs, no tracking 
* Server-side validation — secure verification through Cloudflare’s API
<h3>Features</h3>
The plugin includes several features and options:
<ul>
<li>Easy Setup: Simple key configuration (Site Key & Secret Key)</li>
<li>Per-Form Control: Toggle Turnstile on/off for each integration individually</li>
<li>WooCommerce Options: Configurable placement options for checkout forms</li>
<li>Customization:
<ul>
<li>Theme selection (Auto/Light/Dark)</li>
<li>Widget size controls (Normal/Compact/Flexible)</li>
<li>Language settings</li>
<li>Appearance mode (Always visible or interaction-only)</li>
</ul>
</li>
<li>Performance: Optional script defer for improved page load times</li>
<li>Debugging: Debug logging to help troubleshoot form submission issues</li>
</ul>
<h3>Getting Started</h3>
Setting up Cloudflare Turnstile protection is straightforward:
<ol>
<li>Create your Turnstile keys in the Cloudflare dashboard (Site Key and Secret Key)</li>
<li>Navigate to Dashboard → Smart Cloudflare Turnstile in your WordPress admin</li>
<li>Enter your keys and choose which forms to protect</li>
<li>Save your settings — Turnstile will now appear on your selected forms</li>
</ol>
That’s it! Your forms are now protected from spam and bots.
Need help? Check our documentation or visit the support forum for detailed guides.
<h3>Plugin Languages</h3>
The plugin is currently available in English. If you’d like to help translate the plugin into your language, please visit our <a href="https://translate.wordpress.org/projects/wp-plugins/smart-captcha-alternative-with-cloudflare-turnstile/" rel="nofollow ugc">translation page</a>.
<h3>Other Information</h3>
<ul>
<li>For help & suggestions, please create a support topic in our <a href="https://wordpress.org/support/plugin/smart-captcha-alternative-with-cloudflare-turnstile/" rel="ugc">support forum</a></li>
<li>Follow the developer <a href="https://x.com/mayankmajeji" rel="nofollow ugc">@mayankmajeji</a></li>
<li><a href="https://github.com/mayankmajeji/smart-captcha-alternative-with-cloudflare-turnstile" rel="nofollow ugc">View on GitHub</a></li>
</ul>
<h3>Support The Plugin</h3>
Special thanks to all contributors who help support the continued development of this plugin.
The plugin is currently free to use. If you find it useful and would like to support its continued development, maintenance, and support, you can make a donation. Your support is greatly appreciated and helps keep the plugin actively maintained.
<a href="https://buymeacoffee.com/mayankmajeji" rel="nofollow ugc">Make a donation</a>
<h3>Trademark Notice</h3>
Cloudflare, the Cloudflare logo, and Cloudflare Workers are trademarks and/or registered trademarks of Cloudflare, Inc. in the United States and other jurisdictions.
This plugin is not affiliated with, endorsed by, or sponsored by Cloudflare, Inc. Cloudflare® and Turnstile® are trademarks of Cloudflare, Inc.
<h3>Third Party Services</h3>
This plugin connects to Cloudflare Turnstile service to provide CAPTCHA verification.
What data is transmitted: 
– Form submission tokens for verification 
– IP addresses for bot detection 
– Browser fingerprints for security analysis
When data is sent: 
– Only when users submit forms with Turnstile protection enabled 
– Data is sent securely via HTTPS to Cloudflare’s servers
External Services: 
– Cloudflare Turnstile API: https://developers.cloudflare.com/turnstile/ 
– Cloudflare Terms of Service: https://www.cloudflare.com/terms/ 
– Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/

Smart CAPTCHA Alternative with Cloudflare Turnstile

Protect WordPress forms from spam using Cloudflare Turnstile. A privacy-friendly CAPTCHA alternative.

LukaCodes AntiSpam Shield vs Smart CAPTCHA Alternative with Cloudflare Turnstile