Ohm·Tang

OhmTang CFT is a comprehensive WordPress security plugin that seamlessly integrates Cloudflare Turnstile’s advanced CAPTCHA protection into your website. Say goodbye to traditional annoying CAPTCHAs and embrace a frictionless, privacy-focused security solution that effectively blocks bots while providing a smooth user experience. Completely free Cloudflare Turnstile integration for WordPress and WooCommerce – no premium features, no hidden costs, just powerful spam protection.
📢 DISCLAIMER: Trademarks and brands are the property of their respective owners.
<h4>🎛️ Granular Form Control</h4>
Individual Form Toggle and Each verification form supports custom error messages, allowing you to personalize the display when users fail the Turnstile challenge.- Complete Flexibility
Take full control over your security implementation with our granular form management system:
<ul>
<li>Per-Form Enable/Disable – Every supported form can be individually activated or deactivated</li>
<li>WordPress Core Forms:
<ul>
<li>✅ Login Form – Toggle on/off</li>
<li>✅ Registration Form – Toggle on/off </li>
<li>✅ Lost Password Form – Toggle on/off</li>
<li>✅ Comment Form – Toggle on/off ( on/off login or no login user)</li>
</ul>
</li>
<li>WooCommerce Forms:
<ul>
<li>✅ Login Form – Toggle on/off</li>
<li>✅ Registration Form – Toggle on/off</li>
<li>✅ Lost Password Form – Toggle on/off</li>
<li>✅ Checkout Form (Support Full site editting Block Checkout page and Traditional Checkout page) – Toggle on/off ( on/off login or no login user)</li>
</ul>
</li>
</ul>
<h4>🎯 Smart Conditional Protection</h4>
Intelligent Verification Based on User Status
Advanced conditional protection for better user experience:
<ul>
<li>
Checkout Page Smart Settings:
<ul>
<li>🔄 Option to skip verification for logged-in users – Provide seamless checkout experience for returning customers</li>
<li>🔒 Always protect guest checkouts – Secure anonymous transactions</li>
<li>⚡ Reduce friction for trusted customers while maintaining security</li>
</ul>
</li>
<li>
Comment Form Intelligent Protection:
<ul>
<li>🔄 Toggle verification for logged-in users – Choose whether authenticated users need CAPTCHA</li>
<li>🛡️ Always protect guest comments – Prevent spam from anonymous visitors</li>
<li>📝 Respect trusted commenters – Regular commentators can enjoy streamlined experience</li>
</ul>
</li>
<li>
Flexible User-Based Rules:
<ul>
<li>🎪 Customize protection based on user roles and status</li>
<li>🔐 Balance security and usability intelligently</li>
<li>📊 Reduce unnecessary verification for trusted users</li>
</ul>
</li>
</ul>
<h4>🛡️ Complete WordPress Core Protection</h4>
Protect every aspect of your WordPress site with comprehensive form security:
<ul>
<li>Login Security – Prevent brute force attacks on wp-login.php and admin areas (toggleable)</li>
<li>User Registration – Stop spam registrations and fake account creation (toggleable)</li>
<li>Comment Moderation – Eliminate spam comments automatically with smart user detection</li>
<li>Password Recovery – Secure lost password forms against abuse (toggleable)</li>
<li>Contact Forms – Compatible with popular contact form plugins</li>
<li>Your favorite Contact Forms – If you need to integrate your preferred form, contact me: ohmtang@outlook.com</li>
</ul>
<h4>🛒 Advanced WooCommerce Integration</h4>
Secure your online store and protect your revenue with dedicated WooCommerce protection:
<ul>
<li>Checkout Security – Prevent fraudulent orders and fake transactions with smart user detection</li>
<li>Customer Registration – Ensure genuine customer accounts (toggleable)</li>
<li>Guest Checkout – Protect checkout process for all users with conditional logic</li>
<li>Login Forms – Secure customer login and authentication (toggleable)</li>
<li>Review Systems – Block fake product reviews and ratings</li>
</ul>
<h4>⚙️ Advanced Features & Customization</h4>
<ul>
<li>Smart Theme Options – Light, dark, and auto themes that adapt to your site design</li>
<li>Flexible Styles – Normal, Flexible and Compact 3 styles where Turnstile appears on each form</li>
<li>Granular Control – Enable/disable protection for individual forms with one click</li>
<li>Conditional Logic – Smart rules based on user login status</li>
<li>Performance Optimized – Minimal impact on page load times</li>
<li>Mobile Responsive – Perfectly adapted for all devices</li>
<li>Accessibility Ready – Designed with accessibility in mind</li>
</ul>
<h4>🔧 Developer Friendly</h4>
<ul>
<li>Extensive hooks and filters for customization</li>
<li>Clean, well-documented codebase</li>
<li>WordPress coding standards compliant</li>
<li>Easy integration with custom themes and plugins</li>
<li>Comprehensive error logging and debugging</li>
</ul>
<h4>🌍 Multi-language Ready</h4>
<ul>
<li>Full translation support with .pot file</li>
</ul>
<h4>Why Cloudflare Turnstile?</h4>
<ul>
<li>User-Friendly – No annoying puzzles, image recognition, or text challenges</li>
<li>Privacy-First – GDPR compliant and privacy-respecting</li>
<li>Free Forever – Cloudflare’s free tier provides robust protection</li>
<li>Advanced Detection – Machine learning and behavioral analysis</li>
<li>Fast Implementation – Simple setup with Site Key and Secret Key</li>
</ul>
Experience the perfect balance of security and usability! With individual form controls and smart conditional protection, you can secure your site without frustrating your legitimate users.

OhmTang CFT

Integrate Cloudflare Turnstile CAPTCHA for WordPress & WooCommerce forms with custom error messages, each form controlled individually

LukaCodes

AntiSpam Shield by LukaCodes is a lightweight, no-bloat plugin that protects your WordPress comment section and contact forms from spam. Six independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.
<ul>
<li>Disable Website Field — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li>Strip Links from Comments — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li>reCAPTCHA v3 — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li>Cloudflare Turnstile — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li>Login Shield — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li>Registration Shield — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li>WPForms Integration — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
<li>Easy Contact Form by LukaCodes Integration — Apply the same CAPTCHA protection to forms created with the companion Easy Contact Form plugin.</li>
</ul>
All features are independent — enable only what you need.
<h4>Login & Registration Shield</h4>
Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:
<ul>
<li>Login Shield — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li>Registration Shield — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
Both are independently togglable in the settings panel. Admins already logged in are never affected.
<h4>WPForms Integration</h4>
Version 1.1.0 introduces CAPTCHA protection for WPForms Lite:
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for WPForms Lite users only.
<h4>Easy Contact Form by LukaCodes Integration</h4>
Version 1.1.4 adds CAPTCHA protection for forms created with <a href="https://wordpress.org/plugins/lukacodes-easy-contact-form/" rel="ugc">Easy Contact Form by LukaCodes</a>:
<ul>
<li>Injects the CAPTCHA widget (Turnstile) or invisible token (reCAPTCHA v3) into every Easy Contact Form on the page.</li>
<li>Hooks into Easy Contact Form’s <code>lukacodes_comment_shield_check</code> filter for server-side token verification before the submission is processed or emails are sent.</li>
<li>Uses the same CAPTCHA keys you already configured — no extra setup.</li>
<li>When a token fails, the user sees a CAPTCHA-specific error message inline; the submission is never stored or emailed.</li>
</ul>
<h4>Why AntiSpam Shield?</h4>
Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. AntiSpam Shield by LukaCodes is different:
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with live key testing — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li>Link stripping preview — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li>Mutual exclusion: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.
<h4>Cloudflare Turnstile — How it works</h4>
A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.
<h3>Third-Party Services</h3>
This plugin optionally uses the following third-party services:
<h4>Google reCAPTCHA v3</h4>
A service provided by Google LLC.
<ul>
<li>What it does: Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li>When data is sent: Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a reCAPTCHA token.</li>
<li>Google Privacy Policy: https://policies.google.com/privacy</li>
<li>Google Terms of Service: https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
A service provided by Cloudflare, Inc.
<ul>
<li>What it does: Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li>When data is sent: Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li>What data is sent: The visitor’s IP address and a Turnstile token.</li>
<li>Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/</li>
<li>Cloudflare Terms of Service: https://www.cloudflare.com/website-terms/</li>
</ul>
Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.

AntiSpam Shield by LukaCodes

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

OhmTang CFT vs AntiSpam Shield by LukaCodes