HSArticle Math CAPTCHA for Forms adds a math CAPTCHA to any WordPress form. No API keys. No third-party services. No configuration needed to get started.
Features:
Math CAPTCHA — addition, subtraction, multiplication with sensible number ranges
Two display modes: distorted canvas image (bot-resistant) or plain text (accessible)
Server-side validation — answer stored in PHP session with HMAC signature, never exposed to the client
Honeypot field — silent bot trap alongside the math challenge
Rate limiting — blocks IPs after 10 failed attempts per 10 minutes
Refresh button — generate a new question without reloading
WPForms auto inject — protect any WPForms (free or pro) without adding a shortcode
Registered as a CF7 form tag — no unknown tag warnings in the CF7 editor
Session only starts on pages that actually contain a form — no impact on page caching elsewhere
Clean admin page under its own menu — not buried under Settings