LukaCodes

<p><strong>AntiSpam Shield by LukaCodes</strong> is a lightweight, no-bloat plugin that protects your WordPress comment section <strong>and contact forms</strong> from spam. Six independent tools, one settings page. <a href="https://lukacodes.com/comment-shield-docs/" rel="nofollow ugc">Read the full documentation</a>.</p>
<ul>
<li><strong>Disable Website Field</strong> — Removes the URL/website field from the comment form. Works with all themes, including those that hardcode the field (CSS fallback included).</li>
<li><strong>Strip Links from Comments</strong> — Automatically removes all <code><a href></code> hyperlinks from comment content — both on display and before saving to the database. Spammers get zero benefit from posting links.</li>
<li><strong>reCAPTCHA v3</strong> — Adds Google’s invisible bot-score protection. No checkbox, no puzzle, no friction for real users. Bots are silently blocked server-side.</li>
<li><strong>Cloudflare Turnstile</strong> — A privacy-friendly CAPTCHA alternative. Mutually exclusive with reCAPTCHA v3 — enabling one automatically disables the other.</li>
<li><strong>Login Shield</strong> — Adds CAPTCHA to the WordPress login form (<code>wp-login.php</code>). Stops brute-force bots silently.</li>
<li><strong>Registration Shield</strong> — Adds CAPTCHA to the WordPress registration form. Blocks bot account creation.</li>
<li><strong>WPForms Integration</strong> — Apply the same CAPTCHA protection to WPForms Lite — using the same keys you already configured, no extra setup.</li>
<li><strong>Easy Contact Form by LukaCodes Integration</strong> — Apply the same CAPTCHA protection to forms created with the companion Easy Contact Form plugin.</li>
</ul>
<p>All features are <strong>independent</strong> — enable only what you need.</p>
<h4>Login & Registration Shield</h4>
<p>Version 1.1.2 adds CAPTCHA protection to <code>wp-login.php</code>:</p>
<ul>
<li><strong>Login Shield</strong> — Hooks into <code>wp_authenticate_user</code> for server-side verification after credentials are checked. Returns a <code>WP_Error</code> if CAPTCHA fails — WordPress displays it as a normal login error.</li>
<li><strong>Registration Shield</strong> — Hooks into <code>registration_errors</code> to add CAPTCHA validation during registration. Works alongside all other WordPress registration validations.</li>
</ul>
<p>Both are independently togglable in the settings panel. Admins already logged in are never affected.</p>
<h4>WPForms Integration</h4>
<p>Version 1.1.0 introduces CAPTCHA protection for <strong>WPForms Lite</strong>:</p>
<ul>
<li>Hooks into <code>wpforms_display_submit_before</code> to inject the CAPTCHA widget before the submit button.</li>
<li>Hooks into <code>wpforms_process</code> for server-side token verification.</li>
<li>Works with both reCAPTCHA v3 (invisible) and Cloudflare Turnstile (visible widget).</li>
</ul>
<p>Note: WPForms Pro includes its own native CAPTCHA integration — this feature is intended for <strong>WPForms Lite</strong> users only.</p>
<h4>Easy Contact Form by LukaCodes Integration</h4>
<p>Version 1.1.4 adds CAPTCHA protection for forms created with <a href="https://wordpress.org/plugins/lukacodes-easy-contact-form/" rel="ugc">Easy Contact Form by LukaCodes</a>:</p>
<ul>
<li>Injects the CAPTCHA widget (Turnstile) or invisible token (reCAPTCHA v3) into every Easy Contact Form on the page.</li>
<li>Hooks into Easy Contact Form’s <code>lukacodes_comment_shield_check</code> filter for server-side token verification before the submission is processed or emails are sent.</li>
<li>Uses the same CAPTCHA keys you already configured — no extra setup.</li>
<li>When a token fails, the user sees a CAPTCHA-specific error message inline; the submission is never stored or emailed.</li>
</ul>
<h4>Why AntiSpam Shield?</h4>
<p>Most anti-spam plugins are heavy, require accounts, or add ugly CAPTCHAs. AntiSpam Shield by LukaCodes is different:</p>
<ul>
<li>~30 KB total — no external libraries, no jQuery dependency</li>
<li>Settings page with <strong>live key testing</strong> — verify your reCAPTCHA or Turnstile keys before enabling</li>
<li><strong>Link stripping preview</strong> — paste any comment text and see exactly what gets removed</li>
<li>Graceful fallback: if Google’s or Cloudflare’s API is unreachable, comments are held for moderation (never lost)</li>
<li>Trusted users (administrators) bypass CAPTCHA checks automatically</li>
<li><strong>Mutual exclusion</strong>: reCAPTCHA v3 and Cloudflare Turnstile cannot be active at the same time</li>
<li>WP Coding Standards compliant — fully escaped output, nonce-protected AJAX</li>
</ul>
<h4>reCAPTCHA v3 — How it works</h4>
<p>When a visitor submits a form, JavaScript silently requests a score token from Google. The token is sent with the submission and verified server-side against your minimum score threshold (configurable from 0.1 to 1.0). No user interaction required.</p>
<h4>Cloudflare Turnstile — How it works</h4>
<p>A Turnstile widget is rendered inside the form. When the visitor completes the challenge, a token is submitted and verified server-side against the Cloudflare API.</p>
<h3>Third-Party Services</h3>
<p>This plugin optionally uses the following third-party services:</p>
<h4>Google reCAPTCHA v3</h4>
<p>A service provided by Google LLC.</p>
<ul>
<li><strong>What it does:</strong> Detects bots and spam on your comment form and contact forms without user interaction.</li>
<li><strong>When data is sent:</strong> Only when reCAPTCHA v3 is enabled. A token is sent to <code>https://www.google.com/recaptcha/api/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a reCAPTCHA token.</li>
<li><strong>Google Privacy Policy:</strong> https://policies.google.com/privacy</li>
<li><strong>Google Terms of Service:</strong> https://policies.google.com/terms</li>
</ul>
<h4>Cloudflare Turnstile</h4>
<p>A service provided by Cloudflare, Inc.</p>
<ul>
<li><strong>What it does:</strong> Presents a privacy-friendly CAPTCHA widget on comment and contact forms.</li>
<li><strong>When data is sent:</strong> Only when Cloudflare Turnstile is enabled. A token is sent to <code>https://challenges.cloudflare.com/turnstile/v0/siteverify</code> on each form submission.</li>
<li><strong>What data is sent:</strong> The visitor’s IP address and a Turnstile token.</li>
<li><strong>Cloudflare Privacy Policy:</strong> https://www.cloudflare.com/privacypolicy/</li>
<li><strong>Cloudflare Terms of Service:</strong> https://www.cloudflare.com/website-terms/</li>
</ul>
<p>Both services are entirely optional. If you do not enter API keys or enable either CAPTCHA, no data is sent to any third party.</p>


AntiSpam Shield by LukaCodes

Block comment spam, brute-force logins and bot registrations with reCAPTCHA v3 or Cloudflare Turnstile. Lightweight, no bloat.

Simple CAPTCHA Alternative with Cloudflare Turnstile vs AntiSpam Shield by LukaCodes