Protects contact, registration, login, password reset and the newsletter. Seven verification methods, three with no external service. IP blocks, an attempt log and an invisible mode.
The contact form, registration, password reset and newsletter sign-up are four addresses automated scripts visit non-stop. Every shop knows the result: an inbox full of SEO offers, a customer list littered with accounts nobody created, and a newsletter going to addresses that never asked for it.
CAPTCHA Protection closes those doors without getting in your customers way. You get seven verification methods — from completely invisible to a classic question — and you switch them on per form. Three of them run entirely on your own server: they need no account anywhere, send no customer data outside, and keep working when someone else's service is down.
Contact, registration (including the guest checkout step), login, password reset and the newsletter. Every one gets its own method, its own limits and its own address lists — nothing is forced on you globally.
The math question, the invisible honeypot and proof of work run only on your server. No visitor IP ever leaves the shop, you need no account with Google or anyone else, and an outage at a third party cannot block your forms.
Set a threshold and the first submissions from an address go through untouched — the verification only reaches whoever keeps hammering the form. Signed-in customers can be skipped entirely.
After a run of failed attempts an address is blocked for a duration you choose. The block expires on its own, and if it ever catches a real customer you lift it with one click and add them to the never-ask list.
You see who tried to submit a form, when, with which method and with what result — and behind one click, what they typed. Passwords, tokens and the verification fields themselves are never stored. Download the lot as a CSV file.
The panel lists the cases where a form only looks protected — for instance when you picked an external service but have not entered its API keys, or enabled country blocking without the geolocation database.
Data sheet