R.Sabbir

<p><strong>SecureGate Captcha Lite</strong> is a high-performance security suite built to safeguard your WordPress site from intrusive spam, malicious bots, and brute-force attacks. Leveraging professional-grade tools like Cloudflare Turnstile alongside our unique Math and Character CAPTCHA fallback system, we ensure your site remains impenetrable while maintaining a seamless, privacy-first experience for legitimate users.</p>
<p>Protect Your Store – <strong><a href="https://woocommerce.com/products/securegate-captcha/" rel="nofollow ugc">Upgrade to Pro Now</a></strong></p>
<h4>Why Choose SecureGate Captcha Lite?</h4>
<p><strong>Complete Protection</strong><br />
Secure all critical WordPress forms including admin login, user registration, password reset, and comment submissions. Each form can be individually enabled or disabled based on your needs.</p>
<p><strong>Privacy-First Approach</strong><br />
Built with GDPR compliance in mind. Uses Cloudflare Turnstile for privacy-focused bot detection and includes a self-hosted fallback CAPTCHA that requires zero external API connections.</p>
<p><strong>Lightning Fast Performance</strong><br />
Optimized code that loads only when needed. No bloat, no unnecessary requests, and fully compatible with all major caching plugins to ensure your site remains fast.</p>
<p><strong>Smart Rate Limiting</strong><br />
Intelligent rate limiting prevents brute-force attacks by tracking failed login attempts and automatically locking out suspicious IP addresses temporarily.</p>
<p><strong>Easy to Configure</strong><br />
Intuitive admin interface with clear settings for CAPTCHA providers, protected forms, and security rules. Get started in minutes with sensible defaults.</p>
<h4>Core Features</h4>
<p><strong>CAPTCHA Providers</strong></p>
<ul>
<li>
<p><strong>Cloudflare Turnstile</strong> – Modern, privacy-focused CAPTCHA with excellent UX</p>
<ul>
<li>Free forever with generous limits</li>
<li>Invisible verification for most users</li>
<li>No user frustration with image puzzles</li>
<li>Privacy-compliant (no cookies or tracking)</li>
<li>Easy API key setup</li>
</ul>
</li>
<li>
<p><strong>Built-in Fallback CAPTCHA</strong> – Self-hosted protection that works always</p>
<ul>
<li>Math challenges (simple arithmetic)</li>
<li>Warped text recognition challenges</li>
<li>No external dependencies or API keys</li>
<li>GDPR compliant by design</li>
<li>Perfect for restricted networks</li>
</ul>
</li>
</ul>
<p><strong>Protected Forms</strong></p>
<ul>
<li><strong>WordPress Login</strong> – Protect admin and frontend login forms from credential stuffing</li>
<li><strong>User Registration</strong> – Stop spam bot registrations instantly</li>
<li><strong>Password Reset</strong> – Prevent password reset abuse and email flooding</li>
<li><strong>Comment Forms</strong> – Block spam comments without moderation queues</li>
</ul>
<p><strong>Security Features</strong></p>
<ul>
<li><strong>Rate Limiting</strong> – Configure maximum failed attempts before temporary lockout</li>
<li><strong>Automatic IP Blocking</strong> – Temporary bans for suspicious IPs based on behavior</li>
<li><strong>Customizable Thresholds</strong> – Set your own limits for attempts and lockout duration</li>
<li><strong>Admin Exemptions</strong> – Administrators are automatically exempt to prevent lockouts</li>
<li><strong>IP Allowlisting</strong> – Bypass CAPTCHA for trusted IP addresses</li>
</ul>
<p><strong>Privacy & Compliance</strong></p>
<ul>
<li><strong>GDPR Ready</strong> – Anonymized IP logging with automatic expiration</li>
<li><strong>Data Minimization</strong> – Only essential data is stored as transients</li>
<li><strong>7-Day Auto-Cleanup</strong> – All logs automatically deleted after 7 days</li>
<li><strong>No External Tracking</strong> – Built-in CAPTCHA requires no third-party services</li>
<li><strong>User Control</strong> – Administrators can disable all logging if desired</li>
</ul>
<p><strong>Performance Optimizations</strong></p>
<ul>
<li><strong>Conditional Loading</strong> – Scripts load only on protected pages</li>
<li><strong>Zero Impact</strong> – No performance degradation on unprotected pages</li>
<li><strong>Cache Friendly</strong> – Works seamlessly with WP Rocket, W3 Total Cache, LiteSpeed Cache</li>
<li><strong>Lightweight Assets</strong> – Optimized CSS and JavaScript for minimal footprint</li>
<li><strong>Database Efficiency</strong> – Uses WordPress transients instead of permanent database rows</li>
</ul>
<h4>Perfect For</h4>
<ul>
<li><strong>Bloggers</strong> – Protect comments from spam without moderation</li>
<li><strong>Membership Sites</strong> – Secure registration and login processes</li>
<li><strong>Business Websites</strong> – Prevent fake registrations and form abuse</li>
<li><strong>Personal Blogs</strong> – Simple setup with powerful protection</li>
<li><strong>Portfolio Sites</strong> – Keep contact forms and comments spam-free</li>
</ul>
<h4>Technical Specifications</h4>
<ul>
<li><strong>WordPress Version</strong>: 5.8 or higher</li>
<li><strong>PHP Version</strong>: 7.4 or higher (PHP 8.0+ recommended)</li>
<li><strong>Multisite Compatible</strong>: Yes</li>
<li><strong>Translation Ready</strong>: Yes (with .pot file included)</li>
<li><strong>Performance Impact</strong>: Negligible (loads only on protected forms)</li>
<li><strong>Browser Support</strong>: All modern browsers (Chrome, Firefox, Safari, Edge)</li>
</ul>
<h4>Supported CAPTCHA Providers</h4>
<p><strong>Cloudflare Turnstile</strong><br />
Turnstile is Cloudflare’s modern, privacy-preserving alternative to traditional CAPTCHAs. It uses sophisticated browser challenges that are invisible to most legitimate users while effectively blocking bots.</p>
<p><strong>Built-in Fallback CAPTCHA</strong><br />
Our self-hosted CAPTCHA system offers two challenge types:<br />
– <strong>Math Challenges</strong>: Simple arithmetic problems (e.g., “What is 7 + 3?”)<br />
– <strong>Text Recognition</strong>: Warped text characters requiring human recognition</p>
<p>Both are effective against automated bots while remaining accessible to humans.</p>
<h4>Comparison with Other CAPTCHA Plugins</h4>
<p>Unlike many CAPTCHA plugins that rely solely on external services, SecureGate Captcha Lite provides:<br />
– Multiple provider support with automatic fallback<br />
– Self-hosted option for complete independence<br />
– Advanced rate limiting built-in<br />
– Modern, user-friendly admin interface<br />
– Regular updates and active development<br />
– Clean, well-documented code</p>
<h3>Privacy & Data Collection</h3>
<p><strong>What Data Does This Plugin Collect?</strong></p>
<p>SecureGate Captcha Lite is designed with privacy as a core principle:</p>
<p><strong>Stored Locally (in your WordPress database as transients):</strong><br />
* Anonymized IP addresses (last octet removed)<br />
* Timestamp of verification attempts<br />
* Success/failure status of CAPTCHA verifications<br />
* Failed attempt counters for rate limiting</p>
<p><strong>NOT Stored:</strong><br />
* User emails or usernames<br />
* Personal identifying information<br />
* Browser fingerprints<br />
* Tracking cookies (plugin-side)<br />
* Permanent user profiles</p>
<p><strong>External Service Data:</strong><br />
When Cloudflare Turnstile is enabled, user browser data is sent to Cloudflare for bot detection. Please review <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Cloudflare’s Privacy Policy</a> for details.</p>
<p>When using the Built-in CAPTCHA, NO external services are contacted.</p>
<p><strong>Data Retention:</strong><br />
All logs are stored as WordPress transients and automatically deleted after 7 days. Administrators can disable logging entirely in settings.</p>
<p><strong>Right to Erasure:</strong><br />
No personal data is collected that would require manual erasure requests under GDPR.</p>
<h3>Support & Documentation</h3>
<p><strong>Need Help?</strong></p>
<ul>
<li><strong>Documentation</strong>: Visit the <a href="https://wordpress.org/plugins/securegate-captcha-lite/" rel="ugc">plugin page</a> for guides and tutorials</li>
<li><strong>Support Forum</strong>: Get help from the community at <a href="https://wordpress.org/support/plugin/securegate-captcha-lite/" rel="ugc">WordPress.org Support</a></li>
<li><strong>Bug Reports</strong>: Report issues on the support forum</li>
<li><strong>Feature Requests</strong>: Share your ideas on the support forum</li>
</ul>
<p><strong>Response Time:</strong><br />
We monitor the support forum regularly and aim to respond within 24-48 hours for most queries.</p>
<h3>Credits & Acknowledgments</h3>
<p><strong>Developed with ❤️ by R.Sabbir</strong></p>
<p><strong>Third-Party Services:</strong><br />
When Cloudflare Turnstile is enabled, this plugin connects to Cloudflare’s servers for CAPTCHA verification. By using Turnstile, you agree to Cloudflare’s <a href="https://www.cloudflare.com/website-terms/" rel="nofollow ugc">Terms of Service</a> and <a href="https://www.cloudflare.com/privacypolicy/" rel="nofollow ugc">Privacy Policy</a>.</p>


SecureGate Captcha Lite

Complete site security with Cloudflare Turnstile, Math & Character CAPTCHA. High-performance protection for Login, Registration, and Comment forms.

Freemius

Emil Simunovic

<p>Authica™ is a WordPress login security and login customization plugin built for site owners, agencies, and developers who want a safer, more professional login experience.</p>
<p>Use Authica to customize the WordPress login page, protect login forms with Cloudflare Turnstile, add two-factor authentication, reduce brute force attacks, hide or rename wp-login.php, manage login redirects, restrict login access by IP, and monitor login activity with security logs and reports.</p>
<p>Instead of using separate plugins for login branding, CAPTCHA, 2FA, brute force protection, login redirects, hide login, and activity logs, Authica brings these features together in one polished WordPress admin experience.</p>
<p>Highlights:</p>
<h4>WordPress Login Customization</h4>
<p>Customize the default WordPress login page with your own logo, background, colors, overlays, typography, Google Fonts, welcome messages, error messages, and responsive layout controls.</p>
<h4>Cloudflare Turnstile Bot Protection</h4>
<p>Protect WordPress login, registration, and password reset forms with privacy-focused Cloudflare Turnstile verification.</p>
<h4>Two-Factor Authentication for WordPress</h4>
<p>Add app-based TOTP two-factor authentication to improve account security for administrators, users, and client sites.</p>
<h4>Hide or Rename wp-login.php</h4>
<p>Move the default WordPress login URL away from automated bot targets and reduce noise from common brute force attempts.</p>
<h4>Brute Force Protection</h4>
<p>Limit repeated failed login attempts and help protect accounts from password guessing and credential stuffing attacks.</p>
<h4>Web Application Firewall</h4>
<p>Inspect incoming requests for suspicious patterns such as SQL injection, cross-site scripting, path traversal, remote code execution, sensitive file probes, scanner traffic, and known malicious user-agents.</p>
<h4>IP Restriction</h4>
<p>Create allow, deny, and stealth access rules for login protection based on IP addresses or IP ranges.</p>
<h4>Login Activity Logs and Security Reports</h4>
<p>Monitor login attempts, blocked events, user activity, countries, IP addresses, and suspicious login behavior from the Authica dashboard.</p>
<h4>Login and Logout Redirect Rules</h4>
<p>Send users to the correct page after login or logout with simple redirect controls and role-based flows.</p>
<h4>Email Verification</h4>
<p>Require users to confirm their email address before signing in, helping reduce fake accounts, spam registrations, and bot-created users.</p>
<h4>Modern Authica Admin UI</h4>
<p>Manage login security and login branding from a polished, consistent WordPress admin interface built for agencies and serious site owners.</p>
<p>Authica Free includes full visual branding tools plus core security features. Upgrade to Authica Pro for advanced controls and premium protections.</p>
<p>Learn more: <a href="https://authica.net" rel="nofollow ugc">https://authica.net</a></p>
<h3>Contributors</h3>
<p>emilsim (Emil Simunovic)</p>
<h3>Features</h3>
<h4>Login Branding and Design</h4>
<ul>
<li>Custom logo</li>
<li>Background image and color controls</li>
<li>Overlay controls</li>
<li>Form styling</li>
<li>Button styling</li>
<li>Input styling</li>
<li>Google Fonts</li>
<li>Custom welcome and error messages</li>
<li>Mobile-friendly login layout</li>
<li>Live preview through the WordPress Customizer</li>
</ul>
<h4>Login Security</h4>
<ul>
<li>Cloudflare Turnstile bot protection</li>
<li>Brute force protection</li>
<li>Web Application Firewall</li>
<li>Two-factor authentication / TOTP</li>
<li>Hide or rename wp-login.php</li>
<li>IP restriction rules</li>
<li>Email verification</li>
<li>Login activity logs</li>
<li>Security reports and alerts</li>
</ul>
<h4>Login Flow Controls</h4>
<ul>
<li>Login redirects</li>
<li>Logout redirects</li>
<li>Role-based redirect support</li>
<li>Magic link controls</li>
<li>Passkey</li>
<li>Social Login</li>
<li>AJAX-powered login form</li>
</ul>
<h4>Agency and Professional Features</h4>
<ul>
<li>Polished Authica admin interface</li>
<li>Client-friendly login branding</li>
<li>Security reporting</li>
<li>White-label mode in Pro</li>
<li>Premium support in Pro</li>
</ul>
<h3>Privacy</h3>
<p>This plugin uses an optional opt-in to collect <strong>non-sensitive diagnostic data</strong> and plugin usage information to help improve the product. The opt-in is presented on first use and can be changed at any time under <strong>Authica <span aria-hidden="true" class="wp-exclude-emoji">→</span> Account</strong>.<br />
Collected data may include: WordPress/site version, language, plugin/theme list and versions, admin email (for license/updates), and anonymized site URL. <strong>No personal content or passwords are collected.</strong></p>
<p>Data is processed by our licensing/telemetry provider and by us for support and update delivery.<br />
• Provider’s Privacy & Terms: https://freemius.com/privacy/ , https://freemius.com/terms/</p>
<p>If you choose not to opt in, only the information required to deliver updates to your site is stored (license/installation ID, if you activate a license).</p>
<h3>External services</h3>
<h4>Cloudflare Turnstile (human verification)</h4>
<p>This plugin can integrate with Cloudflare Turnstile to protect login, registration, and password-reset forms from automated abuse.</p>
<p>• What is it used for?<br />
  Turnstile provides a human verification widget to reduce bot signups and credential-stuffing attempts.</p>
<p>• What data is sent and when?<br />
  – On pages where the widget is shown, the Turnstile JavaScript file is loaded from<br />
    https://challenges.cloudflare.com/turnstile/v0/api.js. When loaded, Cloudflare<br />
    may receive standard browser/connection data (e.g., IP address, user agent, referrer)<br />
    and evaluate device/browser signals to determine risk, per Cloudflare’s documentation.<br />
  – When a verification token is produced by the widget, your WordPress site makes a<br />
    server-to-server request to:<br />
      https://challenges.cloudflare.com/turnstile/v0/siteverify<br />
    The server-to-server verification includes the user’s response token and your secret key.<br />
    When a valid client IP is available, the optional remoteip value may also be sent to Cloudflare to improve verification accuracy.</p>
<p>• Where can I learn more?<br />
  – Cloudflare Turnstile: https://www.cloudflare.com/products/turnstile/<br />
  – Turnstile docs: https://developers.cloudflare.com/turnstile/<br />
  – Cloudflare Privacy Policy: https://www.cloudflare.com/privacypolicy/<br />
  – Cloudflare Terms of Service: https://www.cloudflare.com/terms/</p>
<p>• How do I disable it?<br />
  Turnstile integrations can be disabled at <strong>Authica <span aria-hidden="true" class="wp-exclude-emoji">→</span> Turnstile & Edge Security</strong>, which stops the<br />
  widget from loading and the verification endpoint from being called.</p>
<h4>jsDelivr (Chart.js fallback, admin-only)</h4>
<p>For the admin “Captcha Statistics” chart, this plugin prefers a local copy of Chart.js<br />
(bundled in <code>assets/vendor/chart.js/</code>). If the local file is not present, it falls back to<br />
loading Chart.js from:<br />
  https://cdn.jsdelivr.net/npm/chart.js@4.4.3/dist/chart.umd.min.js</p>
<p>• What data is sent?<br />
  Only the administrator’s browser requests the static script file from the CDN.<br />
  No user content or personal data is transmitted by this plugin as part of that request.</p>
<p>• How do I avoid the CDN?<br />
  Keep the local file at <code>assets/vendor/chart.js/chart.umd.min.js</code> so the fallback is not used.</p>
<h4>Email delivery</h4>
<p>This plugin uses WordPress <code>wp_mail()</code> to send email verification messages. Mail delivery<br />
is handled by your hosting provider or any SMTP/email plugin you configure. If you connect<br />
a third-party email service (e.g., via an SMTP plugin), that service’s privacy terms apply.<br />
This plugin does not send verification data to any email vendor on its own.</p>
<h3>Creator Program</h3>
<p>We invite WordPress creators to publish an honest Authica walkthrough on YouTube (no positive review required).<br />
Find out more: <a href="https://authica.net/creator-program/" rel="nofollow ugc">authica.net/creator-program</a></p>
<h3>Trademark</h3>
<p>Authica™ is a trademark claimed by Emil Simunovic. Registration pending.<br />
WordPress is a registered trademark of the WordPress Foundation, used under license.</p>


Authica

Secure WordPress login with Turnstile, 2FA, hide login, WAF, brute force protection, passkeys, social login, activity logs and branding.

SecureGate Captcha Lite vs Authica