Name: Gatekeep – Universal CAPTCHA & Anti-Spam for All Forms & Comments
Rating: 5 (1 reviews)
Author: gatekeepwp

Every CAPTCHA, every form, free.

Gatekeep is a free CAPTCHA and anti-spam plugin for every WordPress form. Use its invisible protection, one of five built-in CAPTCHAs, or Google reCAPTCHA, hCaptcha, Cloudflare Turnstile and Friendly Captcha – on Contact Form 7, WPForms, Gravity Forms, Elementor, WooCommerce, login, registration and comments. No account, no API key, nothing paywalled.

Most visitors never see a challenge at all. Gatekeep scores every submission with honeypots, timing, rate limits, link reputation, disposable-email checks and a dozen other signals, and with Smart CAPTCHA shows a CAPTCHA only to the doubtful few – or to everyone, if that is what you want. Each form can have its own: a checkbox on the contact form, Turnstile on registration, nothing at all on comments.

It also catches the spam a CAPTCHA cannot: sales pitches typed by real people, links to shorteners and look-alike sites, and messages worded like the spam you have already marked. Every verdict is explained in plain language, and every mark you make teaches it what spam looks like on your site.

Every form, not just one

Contact forms
Login, registration and password reset
WooCommerce checkout and account creation
Comments
BuddyPress and bbPress
Membership and LMS plugins
Page-builder forms
Custom-coded forms – two function calls, or none at all with the universal guard

CAPTCHA for Contact Form 7 – without the CAPTCHA

Searching for a Contact Form 7 CAPTCHA usually means one thing: the form is drowning in spam. Gatekeep protects CF7 the moment it is activated – including the AJAX submission path most honeypot plugins miss – with nothing visible added to the form. The same is true for WPForms, Gravity Forms, Fluent Forms, Formidable, Ninja Forms, Elementor forms and the WooCommerce checkout: install, click Protect my website, done. If you specifically want a visible CAPTCHA on your CF7 form, five self-hosted ones are included – maths, image, checkbox, slide-to-confirm and invisible proof-of-work – with no Google account and no site keys. reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile and Friendly Captcha work too, if you already use one.

Smart CAPTCHA: shown only when it is needed

The CAPTCHA sits hidden in the form. When someone presses Send, Gatekeep runs its checks first. A normal visitor’s message simply goes – they never see a puzzle. A doubtful one gets the CAPTCHA, right there in the form, and goes once it is answered. Third-party widgets are not even loaded for the visitors who do not need them, which keeps pages lighter and sends Google, hCaptcha or Cloudflare nothing about most of your visitors.

Choose it per form on the Forms screen, with a preview of exactly what visitors will see. Without JavaScript, the built-in puzzles are simply shown, so nobody is left unable to send.

What it caught that other filters did not

Every anti-spam plugin reports what it blocked. None report what they missed – which is the number that actually tells you whether you are protected.

Gatekeep records every submission, clean ones included, so its totals have a denominator: not “12 blocked” but “12 blocked of 4,310”. Monitor Mode goes further and scores submissions without blocking any, alongside whatever protection you already run, so you can read a week of real verdicts before changing anything. Nothing else on the plugin directory will tell you what your current filter is letting through.

Signals a human spammer cannot avoid

Most anti-spam checks measure how a form was submitted – speed, tokens, hidden fields. Someone typing at human speed passes all of them. Gatekeep also reads what was sent:

Sales pitches typed by a person. “I came across your website… our team can get you to the first page of Google… reply STOP to opt out.” A service on offer, written as a pitch about your site, with a request for a call. A topic alone never counts – your own customers can ask about SEO.
“I wanted to know your price.” The run of few-word messages asking for “your price” in dozens of languages, with no product and no detail. On its own it only ever asks for a CAPTCHA, so a real customer asking the same thing gets through.
Where the links go. Link shorteners, bare IP addresses, program downloads, redirects, look-alike international names, chat-app invitations, and sites you marked as spam before.
Throwaway inboxes the list has not met yet. Domains named like a throwaway service, mailbox names that look generated, senders you marked as spam, and mail servers that run throwaway inboxes.
What you have taught it. Mark any submission Spam or Not spam in the Activity log. Gatekeep learns the wording and the sites behind your spam – in any language – and never holds a site you vouched for against anyone.
Imitating sender domains. Mail from search-yoursite.com when you are yoursite.com. Nobody legitimate writes to you from a domain built out of yours.
Disguised web addresses. “example dot com”, “example[.]org”, “hxxps://” – written that way to slip past filters, and scored precisely because honest correspondents never do it.
Link density. A short message that is mostly links.
Repeated messages. The same pitch arriving again and again, recognised even when names, numbers and links are varied between sends.
Malformed payloads. Submissions carrying hundreds of fields or nested absurdly deep to push the real message past a scanner.
Self-promoting comments. A comment whose author name, website, email address and body all advertise the same site. Doubtful comments go to your Spam folder rather than onto the page, and anything you mark as spam teaches Gatekeep the sites it was promoting.

Smarter than a CAPTCHA

Traditional captcha asks everyone to prove they are human. Gatekeep asks the submission instead, scoring signals the visitor never sees: honeypot traps, impossible submission speed, disposable email addresses, scripted HTTP clients and headless browsers, rate limits, invalid form tokens, missing browser headers and invisible link traps.

Only ambiguous submissions ever meet a challenge – and if you want one, five self-hosted options need no account and no keys.

Every decision explained

Open any entry in the Activity log and Gatekeep shows what each piece of evidence means, how many points it added, how they combined into the score, which threshold it crossed and what happened as a result – and what to do if it got it wrong.

Monitor Mode: prove it is safe before it blocks

Losing a real customer costs more than receiving spam. So Gatekeep starts in Monitor Mode: for the first week it watches, scores, logs and explains every decision without blocking anything. You switch enforcement on when the verdicts look right.

More than spam protection

A 17-point security audit checks for weak configuration – default admin accounts, unrotated salts, exposed config backups, the built-in file editor, XML-RPC, missing HTTPS, end-of-life PHP, pending updates and dormant plugins. Every finding explains what to do; nothing is changed automatically.

A security event log records who changed what: role changes, sign-ins and failures, plugin and theme changes, password and email changes, and critical settings.

Features

Intelligent risk scoring rather than puzzles
Universal form protection, including custom-coded forms
Smart CAPTCHA – hidden until a submission looks suspicious
A different CAPTCHA for each form, with a live preview
Five self-hosted CAPTCHA options – maths, image, checkbox, slide-to-confirm and proof-of-work
Google reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile and Friendly Captcha
One-click switch: reuse the reCAPTCHA, hCaptcha or Turnstile keys another plugin already stores on your site
Test my keys: load the real widget with your keys and see that they work before you save
Adaptive proof-of-work – more work for visitors blocked before and during attacks, less for known visitors
Human-written spam detection: cold sales pitches, link reputation, learning from your own Spam and Not spam marks
Honeypot, timing analysis, rate limiting, disposable email detection that catches new throwaway domains
Every verdict explained in plain language
Login, registration and comment protection
Security audit and security event log
Developer API and shortcode
Privacy friendly – hashed IP addresses, no third-party tracking
No API keys required
Works with page caching
No JavaScript in the default configuration

Integrations (38, all free)

Contact forms: Contact Form 7, WPForms, Gravity Forms, Fluent Forms, Formidable Forms, Ninja Forms, Forminator, Everest Forms, HappyForms, Jetpack Forms, MetForm, Kadence Forms, SureForms

Newsletters: MailPoet subscription forms

WordPress: login, registration, lost password, comments, wpDiscuz comments

WooCommerce: checkout and account registration

Community and membership: BuddyPress, bbPress, PeepSo, Ultimate Member, LearnDash, MemberDash, Academy LMS

Page builders: Elementor Pro, Divi 4 and 5, Bricks, Avada, Thrive, WPBakery, Oxygen, Beaver Builder, SeedProd, Bloom, Orderable

Anything else: forms built into your theme or written by hand, through the universal form guard or two function calls.

Switching from a CAPTCHA or another anti-spam plugin?

Coming from reCAPTCHA, hCaptcha or Turnstile: Gatekeep finds the keys your current plugin already stores – CAPTCHA 4WP, Advanced Google reCAPTCHA, reCaptcha by BestWebSoft, Simple Cloudflare Turnstile, hCaptcha for WP, Contact Form 7, WPForms, Forminator and others – and uses them with one click, so there is nothing to look up again. Or keep your current plugin, install Gatekeep in Monitor Mode beside it, and watch the log for a fortnight. You will see exactly what your captcha lets through – measured on your own traffic, not claimed by a vendor. Most sites then retire the puzzle; Gatekeep even ships a reCAPTCHA-compatible siteverify endpoint so custom code can switch by changing one URL.

Coming from Akismet or another comment filter: they classify comment text; Gatekeep protects the forms they never see – registration, login, checkout, contact. The two can run together, and the Compatibility screen shows the overlap so it stays a decision, not an accident.

Coming from a honeypot plugin: Gatekeep’s honeypot uses a field name derived from your own site’s salts, so bots cannot learn it elsewhere – and it is one signal of a dozen rather than the whole defence.

Measured, not promised

~380 bytes added to a form, no JavaScript by default
Blocked submissions decided in under 5 ms
1,200+ automated assertions pass on every release, on WordPress and WooCommerce current versions
Nothing loads for a visitor except what a page view needs – admin, licensing and hardening code stay out of the way

Free forever, and what Pro adds

Everything that is code is free – and the code agrees. The engine, all 38 integrations, Smart CAPTCHA, Monitor Mode, the activity log, the dashboard health score, the 17-point security audit, protection profiles, the coexistence report, IP and keyword rules, advanced signals, settings export/import and every CAPTCHA option including the image one: free, with no licence prompt anywhere.

Gatekeep Pro is a separate plugin you download from your gatekeepwp.com account and install like any other. It adds the live spam-domain feed refreshed daily, card-testing protection for WooCommerce, the Fortify hardening pack, country rules, stored submissions with CSV export and signed webhooks, individual Contact Form 7 form policies, rule preview, a weekly summary email, spike alerts and (Agency) change history with restore, plus priority support. This plugin never downloads or installs other software. See plans and pricing.

Your forms never depend on Pro: everything in this plugin keeps working whether or not Pro is installed or licensed.

Third-party assets

Two font families are bundled and served from the plugin folder, so no
visitor request is ever made to a font CDN:

IBM Plex Sans – Copyright 2017 IBM Corp, SIL Open Font License v1.1 – https://github.com/IBM/plex
Bricolage Grotesque – Copyright 2022 The Bricolage Project Authors, SIL Open Font License v1.1 – https://github.com/ateliertriay/bricolage

Both licences are GPL-compatible. Full attribution is in assets/FONT-LICENSES.txt.

Friendly Captcha SDK (assets/vendor/friendly-captcha/site.min.js and site.compat.min.js)
Version 1.0.2, Mozilla Public License 2.0, unmodified.
Source: https://github.com/FriendlyCaptcha/friendly-captcha-sdk
Licence text: assets/vendor/friendly-captcha/LICENSE.txt
Bundled locally rather than loaded from a CDN.

External services

Gatekeep makes no outbound requests in its default configuration. Nothing below happens unless you switch that feature on yourself.

Each service is listed with what it is, what is sent, when it is sent, and links to its terms and privacy policy.

1. Google reCAPTCHA (optional, off by default)

What it is: Google’s CAPTCHA service. Used only if you select reCAPTCHA as a challenge provider and enter your own site and secret keys.

What is sent, and when: when a visitor loads a page carrying a form you have enabled reCAPTCHA on, their browser loads Google’s widget script from www.google.com and Google receives the visitor’s IP address, browser information and interaction data. When that form is submitted, your server sends the challenge token, your secret key and the visitor’s IP address to www.google.com to verify the answer. No form content is sent.

2. hCaptcha (optional, off by default)

What it is: an alternative CAPTCHA service. Used only if you select hCaptcha and enter your own keys.

What is sent, and when: on a page with an hCaptcha-enabled form, the visitor’s browser loads the widget from js.hcaptcha.com and hCaptcha receives their IP address, browser information and interaction data. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to api.hcaptcha.com. No form content is sent.

3. Cloudflare Turnstile (optional, off by default)

What it is: Cloudflare’s CAPTCHA alternative. Used only if you select Turnstile and enter your own keys.

What is sent, and when: on a page with a Turnstile-enabled form, the visitor’s browser loads the widget from challenges.cloudflare.com and Cloudflare receives their IP address and browser information. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to challenges.cloudflare.com to verify it. No form content is sent.

4. Friendly Captcha (optional, off by default)

What it is: a proof-of-work CAPTCHA service. Used only if you select Friendly Captcha and enter your own keys.

The widget script is bundled with this plugin and served from your own site, so no script is loaded from a third party. Verification is still performed by Friendly Captcha, because that is the service being used.

What is sent, and when: when a visitor solves the challenge, their browser contacts Friendly Captcha’s puzzle endpoint. On submission, your server sends the challenge response and your API key to global.frcapi.com, or to eu.frcapi.com if you select their EU-only infrastructure. No form content is sent.

Terms of service: https://friendlycaptcha.com/legal/terms/
Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/

Test my keys (admin only, on request)

On the Captcha screen, “Test my keys” loads the chosen service’s widget in your own browser with the site key you typed, and your server sends the resulting …