LukaCodes

AntiSpam Shield by LukaCodes is a lightweight, no-bloat plugin that protects your WordPress comment section and contact forms from spam. Six independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.
<ul>
<li>Disable Website Field — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li>Strip Links from Comments — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li>reCAPTCHA v3 — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li>Cloudflare Turnstile — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li>Login Shield — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li>Registration Shield — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li>WPForms Integration — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
<li>Easy Contact Form by LukaCodes Integration — Apply the same CAPTCHA protection to forms created with the companion Easy Contact Form plugin.</li>
</ul>
All features are independent — enable only what you need.
<h4>Login & Registration Shield</h4>
Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:
<ul>
<li>Login Shield — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li>Registration Shield — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
Both are independently togglable in the settings panel. Admins already logged in are never affected.
<h4>WPForms Integration</h4>
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
<h4>Easy Contact Form by LukaCodes Integration</h4>
Version 1.1.4 adds CAPTCHA protection for forms created with <a href="https://wordpress.org/plugins/lukacodes-easy-contact-form/" rel="ugc">Easy Contact Form by LukaCodes</a>:
<ul>
<li>Injects the CAPTCHA widget (Turnstile) or invisible token (reCAPTCHA v3) into every Easy Contact Form on the page.</li>
<li>Hooks into Easy Contact Form’s <code>lukacodes_comment_shield_check</code> filter for server-side token verification before the submission is processed or emails are sent.</li>
<li>Uses the same CAPTCHA keys you already configured — no extra setup.</li>
<li>When a token fails, the user sees a CAPTCHA-specific error message inline; the submission is never stored or emailed.</li>
</ul>
<h4>Why AntiSpam Shield?</h4>
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. AntiSpam Shield by LukaCodes is different:
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li>Link stripping preview — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li>Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
<h4>Cloudflare Turnstile — How it works</h4>
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
<h3>Third-Party Services</h3>
This plugin optionally uses the following third-party services:
<h4>Google reCAPTCHA v3</h4>
A service provided by Google LLC.
<ul>
<li>What it does: Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li>When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a reCAPTCHA token.</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
A service provided by Cloudflare, Inc.
<ul>
<li>What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li>When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a Turnstile token.</li>
<li>Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

AntiSpam Shield by LukaCodes

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

azizultex

WPPOOL

Md. Al-Shahreyar

wpdarkmode

Mahafuz

Md Sajjadul Islam

farhanmullick

Cloudflare Turnstile for WordPress, WooCommerce, Contact Form 7, BuddyPress, WPForms, and more. Secure your WordPress website with the best reCAPTCHA alternative for WordPress.
“Studies show that 15% of users will abandon a web-based service when they face a traditional CAPTCHA test.”
HOW TO ADD CLOUDFLARE TURNSTILE IN WORDPRESS
<iframe loading="lazy" class="youtube-player" width="750" height="422" src="https://www.youtube.com/embed/2jU2LhkiQQU?version=3&rel=1&showsearch=0&showinfo=1&iv_load_policy=1&fs=1&hl=en-US&autohide=2&wmode=transparent" allowfullscreen="true" style="border:0;" sandbox="allow-scripts allow-same-origin allow-popups allow-presentation allow-popups-to-escape-sandbox"></iframe>
PROTECTS AGAINST SPAM FOR:
<ul>
<li>WordPress Login form</li>
<li>WordPress Signup form</li>
<li>WordPress Reset Password form</li>
<li>WordPress Comment form</li>
<li>WooCommerce forms</li>
<li>Contact Form 7 forms</li>
<li>WPForms contact forms</li>
<li>BuddyPress forms</li>
<li>Elementor forms</li>
</ul>
Say to no user experience nightmare, known as CAPTCHA. It hinders your website experience significantly as it slows down user actions at every step of the website journey. Welcome to Turnstile, the latest alternative to invisible CAPTCHA and honeypot. This anti-spam plugin allows you to easily integrate Turnstile on your website within a few seconds without any coding.
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
WHAT IS CLOUDFLARE TURNSTILE, AND HOW TO ACTIVATE IT ON YOUR WEBSITE?
Turnstile is the latest privacy-focused invisible CAPTCHA technology developed by Cloudflare to create a modern CAPTCHA alternative and reCAPTCHA alternative.
Turnstile helps you identify real website visitors without needing additional actions. Instead, Turnstile automatically runs a series of small non-interactive JavaScript challenges based on telemetry and client behavior displayed during a session. That means the possibility of your users facing CAPTCHA will reduce significantly. <a href="https://www.cloudflare.com/en-gb/products/turnstile/" rel="nofollow ugc">Learn more about Turnstile</a>
Getting started with Turnstile on WordPress is super easy. All you have to do is install and activate our plugin. Then, generate your site and secret keys from Cloudflare (a free and easy process) and input them through the provided field. That’s it. The plugin does everything else and ready to protect your forms from spam. You will no longer have to get frustrated with the poor efficacy of reCAPTCHA ever again!
<a href="https://wordpress.org/support/plugin/wppool-turnstile-captcha-spam-filter/" rel="ugc">👩🏼‍💻 Get support</a>
<h3>EASY SPAM FILTER FEATURES</h3>
<ol>
<li>Automatic deployment: Once you setup Easy Spam Filter with your site key and secret key, the plugin does the rest. It will automatically deploy the required HTML snippet in your website for you.</li>
<li>WordPress spam protection: Spam Filter with Turnstile safeguards your website against spam comments or brute force attacks. It has support for every kind of WordPress form, including
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form spam protection</li>
<li>Reset password form spam protection</li>
<li>Comment spam protection</li>
</ul>
</li>
<li>Disable/enable WordPress login spam protection: You can disable Turnstile at any time from the WordPress login form from the plugin setting.</li>
<li>SEO boost: Spambots often include low-quality or malicious outbound links, risking your website’s ranking. Turnstile prevents these bots from spamming and ensures you continue receiving a good ranking.</li>
<li>Mobile-friendly Anti Spam: Our Turnstile integration is fully optimized for mobile devices and will not break under any circumstances.</li>
<li>WooCommerce spam protection: Protect your WooCommerce store against malicious spam attacks. This reCAPTCHA alternative for WooCommerce provides protection against every kind WooCommerce form.
<ul>
<li>Signup/registration form spam protection</li>
<li>Login form – my account spam protection</li>
<li>Lost/Reset password form spam protection</li>
<li>Checkout billing form spam protection</li>
</ul>
</li>
<li>Contact Form 7 spam protection: Experience flawless Turnstile integration for Contact Form 7 forms. Protect your CF7 forms from spam comments. After configuration, add Turnstile to any Contact Form 7 form.</li>
<li>BuddyPress login spam protection: Keep your BuddyPress groups safe with secured spam protection by Cloudflare Turnstile antispam filter.</li>
<li>WPForms spam protection: Add Cloudflare Turnstile in Contact Form by WPForms and keep your everyday contact forms safe from spam submissions. Activate and enjoy
<ul>
<li>Contact forms spam protection</li>
<li>Payment forms spam protection</li>
<li>Survey forms spam protection</li>
<li>Newsletter forms spam protection</li>
<li>Registration forms spam protection</li>
</ul>
</li>
<li>Elementor forms spam protection: Add Turnstile to Elementor forms. If you are using Elementor Pro, you can now protect your
<ul>
<li>Elementor contact us forms</li>
<li>Elementor multi-step forms</li>
<li>Elementor login form</li>
</ul>
</li>
<li>Turnstile widget theme: Change the outlook of the Turnstile widget according to your wish (Dark or Light).</li>
<li>Submit button restriction: Control whether users need to pass the Cloudflare Turnstile security check to submit the button.</li>
<li>Custom message: Customize the Turnstile widget message and replace the default one (“Please verify you are human”).</li>
</ol>
<h3>Privacy Policy</h3>
Easy Spam Filter uses <a href="https://appsero.com" rel="nofollow ugc">Appsero</a> SDK to collect some telemetry data upon user’s confirmation. This helps us to troubleshoot problems faster & make product improvements.
Appsero SDK does not gather any data by default. The SDK only starts gathering basic telemetry data when a user allows it via the admin notice. We collect the data to ensure a great user experience for all our users.
Integrating Appsero SDK DOES NOT IMMEDIATELY start gathering data, without confirmation from users in any case.
Learn more about how <a href="https://appsero.com/privacy-policy/" rel="nofollow ugc">Appsero collects and uses this data</a>.

Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor

That’s awesome! Integrated CloudFlare Turnstile in my WordPress site in just a few minutes :wink: very lightweight and easy. Thanks for the plugin.

Very lightweight Turnstile WordPress plugin

Very helpful !

Add Cloudflare Turnstile to WordPress, Contact Form 7, WooCommerce, WPForms, BuddyPress & Elementor. A CAPTCHA, reCAPTCHA alternative for WordPress.

AntiSpam Shield by LukaCodes vs Easy Spam Filter – Privacy-Friendly CAPTCHA Alternative with Turnstile for Contact Form 7, WPForms, BuddyPress, Elementor