How to use the WordPress captcha to protect your website

Hel­lo, thank you, we are plea­sed that you are using our captcha pro­tec­tion. Our captcha is ver­sa­ti­le and allows you to effec­tively pro­tect your web­site.

Supported plug-ins, themes and WordPress functions #

We are con­stant­ly deve­lo­ping our plug-in. If your the­me, your plug-in or a Word­Press func­tion is not yet sup­port­ed, you are wel­co­me to cont­act us. We will check whe­ther inte­gra­ti­on is pos­si­ble and will be hap­py to add it.

The fol­lo­wing plug-ins, the­mes and Word­Press func­tions are curr­ent­ly sup­port­ed:

• Word­Press Log­in
• Word­Press regis­tra­ti­on
• Woo­Com­mer­ce Log­in
• Woo­Com­mer­ce regis­tra­ti­on
• Ava­da Forms
• Cont­act Form 7
• Ele­men­tor Forms

Download and installation #

You can easi­ly install and acti­va­te our Word­Press Captcha plug­in via the plug­in mana­ger of your Word­Press web­site. You can find the down­load direct­ly on Word­Press Plug­ins.

You can also sim­ply install and acti­va­te the plug-in via your Word­Press web­site.

After instal­la­ti­on, you will find the link to the set­tings direct­ly on the left-hand side in the menu under Forge12 Spam Pro­tec­tion.

How to set up captcha protection on your website #

Open the plug-in set­tings by cli­cking on the Forge12 Spam Pro­tec­tion menu item in the navi­ga­ti­on bar of your Word­Press backend.

From here you can add Captcha pro­tec­tion to the indi­vi­du­al modu­les of your web­site.

Note: The navi­ga­ti­on may look dif­fe­rent for you. Depen­ding on which plug-ins and the­mes you use. Set­tings for plug-ins and the­mes that are not available are hid­den.

The captcha sys­tem is deac­ti­va­ted by default. You must the­r­e­fo­re acti­va­te each modu­le manu­al­ly.

WordPress captcha for login & registration #

Switch to the Word­Press tab in the captcha set­tings.

The opti­ons for Word­Press log­in and Word­Press regis­tra­ti­on are now available to you the­re. You can acti­va­te the captcha pro­tec­tion by con­fir­ming the check­bo­xes “Enable Spam Pro­tec­tion for Word­Press Log­in” and “Enable Spam Pro­tec­tion for Word­Press Regis­tra­ti­on”.

The pro­tec­tion method indi­ca­tes which captcha you would like to use. Sel­ect your desi­red method here. An expl­ana­ti­on of the indi­vi­du­al captcha sys­tems can be found below.

The Field­na­me field gives you the opti­on to rena­me the captcha field. To increase the effec­ti­ve­ness of the captcha, you should assign your own name. You may not enter any spe­cial cha­rac­ters or spaces here. It is best to use only num­bers and let­ters.

Example WordPress login

The fol­lo­wing image shows an exam­p­le of how to acti­va­te captcha pro­tec­tion for the Word­Press log­in. An image captcha is used for this. We have ren­a­med the field to “apart­ment” to dis­gu­i­se it.

Example WordPress registration

The fol­lo­wing image shows an exam­p­le of how to acti­va­te captcha pro­tec­tion for Word­Press regis­tra­ti­on. An arith­me­tic captcha is used for this. We have ren­a­med the field to “first­na­me” to dis­gu­i­se it.

As soon as you have acti­va­ted the two methods and saved the who­le thing, the captcha will be dis­play­ed.

WooCommerce Captcha for login and registration #

You can also acti­va­te captcha pro­tec­tion for the Woo­Com­mer­ce log­in and regis­tra­ti­on. To do this, go to the Woo­Com­mer­ce tab in the set­tings.

The opti­ons for Woo­Com­mer­ce log­in and Woo­Com­mer­ce regis­tra­ti­on are now available to you the­re. You can acti­va­te the captcha pro­tec­tion by con­fir­ming the check­bo­xes “Enable Spam Pro­tec­tion for Woo­Com­mer­ce Log­in” and “Enable Spam Pro­tec­tion for Woo­Com­mer­ce Regis­tra­ti­on”.

The pro­tec­tion method indi­ca­tes which captcha you would like to use. Sel­ect your desi­red method here. An expl­ana­ti­on of the indi­vi­du­al captcha sys­tems can be found below.

The Field­na­me field gives you the opti­on to rena­me the captcha field. To increase the effec­ti­ve­ness of the captcha, you should assign your own name. You may not enter any spe­cial cha­rac­ters or spaces here. It is best to use only num­bers and let­ters.

Example WooCommerce login

The fol­lo­wing image shows an exam­p­le of how to acti­va­te captcha pro­tec­tion for the Woo­Com­mer­ce log­in. A honey­pot captcha is used for this. We have retai­ned the default name for the field.

Example WooCommerce registration

The fol­lo­wing image shows an exam­p­le of how to acti­va­te captcha pro­tec­tion for Woo­Com­mer­ce regis­tra­ti­on. An image captcha is used for this. We have ren­a­med the field to “tage­bau” to dis­gu­i­se it.

As soon as you have acti­va­ted the two methods and saved the who­le thing, the captcha will be dis­play­ed on the Woo­Com­mer­ce log­in and regis­tra­ti­on page.

WordPress Captcha for comments #

You can also acti­va­te captcha pro­tec­tion for Word­Press comm­ents. To do this, go to the Comm­ents tab in the set­tings.

The opti­ons for the comm­ents are now available to you the­re. You can acti­va­te captcha pro­tec­tion by con­fir­ming the “Enable captcha pro­tec­tion” check­bo­xes.

The pro­tec­tion method indi­ca­tes which captcha you would like to use. Sel­ect your desi­red method here. An expl­ana­ti­on of the indi­vi­du­al captcha sys­tems can be found below.

The Field­na­me field gives you the opti­on to rena­me the captcha field. To increase the effec­ti­ve­ness of the captcha, you should assign your own name. You may not enter any spe­cial cha­rac­ters or spaces here. It is best to use only num­bers and let­ters.

Activate extended protection

If you still recei­ve spam mes­sa­ges despi­te Captcha pro­tec­tion, you should acti­va­te time-based pro­tec­tion. We explain how this works here.

Captcha for Contact Form 7, Avada Forms and Elementor #

You can also acti­va­te captcha pro­tec­tion for Cont­act Form 7 forms, Ele­men­tor Pro forms and Ava­da Forms forms. To do this, go to the Cont­act Form 7, Ele­men­tor or Ava­da Forms tab in the set­tings (depen­ding on which form sys­tem you are using).

The opti­ons for the forms are now available to you the­re. You can acti­va­te the captcha pro­tec­tion by con­fir­ming the check­bo­xes “Enable Spam Pro­tec­tion for Ava­da Forms” or “Enable Spam Pro­tec­tion for Cont­act Form 7”.

The pro­tec­tion method indi­ca­tes which captcha you would like to use. Sel­ect your desi­red method here. An expl­ana­ti­on of the indi­vi­du­al captcha sys­tems can be found below.

The Field­na­me field gives you the opti­on to rena­me the captcha field. To increase the effec­ti­ve­ness of the captcha, you should assign your own name. You may not enter any spe­cial cha­rac­ters or spaces here. It is best to use only num­bers and let­ters.

Activate extended protection

If you still recei­ve spam mes­sa­ges despi­te Captcha pro­tec­tion, you should acti­va­te time-based pro­tec­tion. We explain how this works here.

Multiple Submission Protection

The Mul­ti­ple Sub­mis­si­on Pro­tec­tion func­tion ensu­res that your forms can­not be sub­mit­ted mul­ti­ple times in suc­ces­si­on. It offers addi­tio­nal pro­tec­tion against bru­te force attacks against the web­site. Acti­va­te the func­tion if you noti­ce that someone is con­stant­ly try­ing to sub­mit your forms with the same con­tent.

IP Protection #

IP Pro­tec­tion allows you to block IP addres­ses for a peri­od of time defi­ned by you after mul­ti­ple spam mes­sa­ges have been sent. We recom­mend only acti­vat­ing the opti­ons if you still recei­ve spam mes­sa­ges despi­te all other mea­su­res.

IP Pro­tec­tion logs all fai­led captchas. As soon as the limit you have defi­ned has been rea­ched within the spe­ci­fied peri­od, the IP is encrypt­ed and blo­cked in the data­ba­se for the peri­od you have defi­ned.

Atten­ti­on: All captchas that you have acti­va­ted in our plug-in will be eva­lua­ted. You should the­r­e­fo­re only acti­va­te this opti­on if you are sure of what you are doing :)

Acti­va­te IP pro­tec­tion by set­ting the check­box next to “Enable IP Pro­tec­tion”.

Use the Max Retries field to spe­ci­fy how often a form must be clas­si­fied as spam befo­re the IP address is blo­cked. If you enter 3 here, the visi­tor may attempt to sol­ve the image captcha 3 times until they are excluded from all forms.

The Peri­od for IP address block field allows you to sel­ect the peri­od of time for which an IP address is blo­cked. This is spe­ci­fied in seconds. If you want to block an IP address for one hour after it has rea­ched the limit, you must enter 3600 here. If you want to block the IP address for one day, enter 86400 ins­tead.

Use the Time inter­val for detec­tion of sub­se­quent attacks field to defi­ne the peri­od in which the fai­led forms are recor­ded. This is spe­ci­fied in seconds. For exam­p­le, if you want all fai­led forms from the last hour to be taken into account, enter 3600 here. The IP address will only be blo­cked if the Max Retries limit has been rea­ched within the­se 3600 seconds.

Recom­men­da­ti­on

Max Retries: 5
Peri­od for IP address block: 86400
Time inter­val for detec­tion of sub­se­quent attacks: 600

You should achie­ve good results with the set­tings from abo­ve. Of cour­se, you can always adjust the values to suit your needs.

Extended protection with filters (Filter Rules) #

In addi­ti­on to captcha pro­tec­tion, you can acti­va­te various fil­ters. The­se check the fields of the form and if a fil­ter is acti­va­ted, the form is mark­ed as spam.

URL Filter

The URL fil­ter allows you to spe­ci­fy whe­ther and if so, how many links may be sub­mit­ted in a form.

You can also enter an indi­vi­du­al mes­sa­ge that will be dis­play­ed to your visi­tors when the fil­ter has been acti­va­ted.

Recom­men­da­ti­on

Acti­va­te fil­ter
Limi­ter: 1
Error mes­sa­ge: Lea­ve as default

As a rule, you never need more than one, maxi­mum two URLs per form. It is best to take a look at your forms and count the maxi­mum num­ber of links that you request in your forms. Then set the fil­ter and the limi­ter.

BB Code Filter

The BB Code Fil­ter pre­vents the sen­ding of mes­sa­ges that con­tain BB code ([url][/url]…). So far we have not come across any site that uses BB code, but many bots that try to insert URLs. Only the BB code for URLs is che­cked. Other BB code spe­ci­fi­ca­ti­ons are still allo­wed through.

Recom­men­da­ti­on

Acti­va­te fil­ter

Blacklist

You can use the black­list to block any words and parts of words. Sim­ply add one word per line. If you want to block “mother”, enter “mother” in a new line.

The “Enable/Disable gree­dy fil­ter” check­box spe­ci­fies whe­ther you only want to mark who­le words or also par­ti­al occur­ren­ces as spam.

Only acti­va­te the “Gree­dy” fil­ter if you are crea­ting your own list. If you are working with the impor­ted list from our ser­ver, you should deac­ti­va­te the “Gree­dy” fil­ter.

Exam­p­le: You put the word “com” on the black­list and acti­va­te the “Gree­dy” fil­ter. Now all sub­strings such as “Com­mu­ni­ty”, “Com­pu­ter”, “Com­po­ser” or “forge12.com” are also mark­ed as spam.

Recom­men­da­ti­on

Acti­va­te fil­ter
Deac­ti­va­te gree­dy fil­ter
Load pre­de­fi­ned black­list (load from our ser­ver)

Activate Time Based Protection #

If you still recei­ve spam mes­sa­ges despi­te Captcha pro­tec­tion, you should acti­va­te time-based pro­tec­tion. This checks how much time has pas­sed bet­ween ope­ning the page and sen­ding the form.

Expl­ana­ti­on: A bot does not scroll through the web­site, but sear­ches expli­cit­ly for forms. The­r­e­fo­re, it usual­ly only takes seconds from loa­ding the page to sen­ding the form.

You can acti­va­te the exten­ded pro­tec­tion by cli­cking on “Enable to track the time from ente­ring till sub­mit­ting the form”.

Use the Time in mil­li­se­conds field to spe­ci­fy the mini­mum num­ber of mil­li­se­conds that must have elap­sed for the sub­mis­si­on not to be clas­si­fied as spam. Depen­ding on the length of the form, you can free­ly sel­ect a value here. Recom­men­ded: 500 to 1000.

The Field name field gives you the opti­on of naming the Time Based Pro­tec­tion field indi­vi­du­al­ly. You can lea­ve the set­tings as they are.

Time-based pro­tec­tion is available for Cont­act Form 7, Ava­da Forms and comm­ents.

Example of time-based protection for comments

The fol­lo­wing image shows an exam­p­le of how to acti­va­te time-based pro­tec­tion for comm­ents. If the form is com­ple­ted in less than half a second (500 ms), our sys­tem defi­nes the mes­sa­ge as spam. The form is the­r­e­fo­re not sent.

Honeypot, Arithmetic and Image Captcha #

You can sel­ect one of the three Captcha methods for all are­as. Depen­ding on which one you choo­se, your visi­tors will have to per­form dif­fe­rent tasks.

Honeypot

The honey­pot is an invi­si­ble field. The trick behind it is to get a bot to fill in the field. A nor­mal visi­tor would not even see the field. So if the field is fil­led in, this is an indi­ca­ti­on that the form has been fil­led in by a bot. As the visi­tor does not have to do any­thing here, this is the most popu­lar ver­si­on of the captcha, but not the most secu­re. Choo­se this opti­on if you want to make it easy for your visi­tors to send your forms.

Arithmetic — the “math” captcha

The arith­me­tic captcha asks your visi­tors a math pro­blem. The form will only be sent if you are able to sol­ve this arith­me­tic pro­blem. The arith­me­tic task is gene­ra­ted ran­dom­ly. Howe­ver, the­se are simp­le tasks and not com­plex for­mu­las. The captcha requi­res some effort from the visi­tor, but is more secu­re than the honey­pot captcha.

Image Captcha — the image solution

The image captcha gene­ra­tes an image from a ran­dom com­bi­na­ti­on of num­bers and let­ters. The visi­tor must then enter this to sub­mit the form. This solu­ti­on has so far been the most effec­ti­ve against spam, as bots still find it dif­fi­cult to read images.

Activate logs #

You have the opti­on of acti­vat­ing the logs in the plug-in set­tings. As soon as you acti­va­te this, all forms are recor­ded. It is saved whe­ther a form could be sent or whe­ther it was mark­ed as spam.

The logs are used to defi­ne the ide­al set­tings for your forms. For exam­p­le, if you recei­ve a lot of spam, you can view the mes­sa­ges the­re and take the neces­sa­ry mea­su­res. The same appli­es if you sud­den­ly stop recei­ving mes­sa­ges and you don’t know which captcha mecha­nism is respon­si­ble.