About this plugin
SecureGate Captcha Lite is a high-performance security and anti-spam suite built to safeguard your WordPress site from intrusive spam, malicious bots, credential stuffing, and brute-force attacks. Leveraging professional-grade tools like Cloudflare Turnstile alongside our unique self-hosted Math and Character CAPTCHA fallback system, we ensure your site remains impenetrable while maintaining a seamless, privacy-first experience for legitimate users.
Protect Your Store – Upgrade to Pro Now
Why Choose SecureGate Captcha Lite?
Complete Protection
Secure all critical WordPress forms including admin login, user registration, password reset, and comment submissions. Each form can be individually enabled or disabled based on your needs.
Privacy-First Approach (GDPR Compliant)
Built with GDPR compliance as a core priority. Uses Cloudflare Turnstile for privacy-focused, cookie-free bot detection and includes a self-hosted fallback CAPTCHA that requires zero external API connections and zero third-party tracking.
Instant Protection Without API Keys
Want immediate protection without signing up for third-party services? Our built-in Math CAPTCHA works immediately upon plugin activation with zero API keys required.
Intelligent Auto-Fallback
Never worry about external network outages. If Cloudflare Turnstile experiences downtime, high latency, or is blocked by an aggressive client browser extension, SecureGate automatically falls back to our self-hosted Math CAPTCHA so your forms never break.
Lightning Fast Performance
Optimized code that loads conditionally only where needed. No bloat, no unnecessary database queries, and fully compatible with all major caching plugins to ensure your website remains fast.
Smart Rate Limiting & Brute-Force Defense
Intelligent rate limiting prevents brute-force login attacks by tracking failed login attempts and automatically locking out suspicious IP addresses temporarily.
Easy to Configure
Intuitive admin interface with clear settings for CAPTCHA providers, protected forms, and security rules. Get started in minutes with sensible defaults.
Core Features
CAPTCHA Providers
-
Cloudflare Turnstile – Modern, privacy-focused CAPTCHA with frictionless user experience
- Free forever with generous limits from Cloudflare
- Invisible verification for most legitimate human visitors
- No user frustration with slow image puzzles (no clicking traffic lights)
- Privacy-compliant with no tracking cookies or user profiling
- Quick 2-minute API key setup
-
Built-in Fallback CAPTCHA – Self-hosted protection that works always
- Math challenges (simple arithmetic problems like 5 + 3 = 8)
- Warped character text recognition challenges
- Works instantly with zero external dependencies or API keys
- GDPR compliant by design (runs 100% on your own server)
- Perfect for restricted networks, local development, and intranet sites
Protected Forms
- WordPress Login – Protect admin and frontend login forms from credential stuffing and automated password guessing
- User Registration – Stop spam bot registrations and fake user account creation
- Password Reset (Lost Password) – Prevent automated password reset abuse and email flooding
- Comment Forms – Block automated comment spam without clogging moderation queues
Security & Rate Limiting
- Rate Limiting – Configure maximum allowed failed login attempts before a temporary lockout triggers
- Automatic IP Blocking – Automatic temporary bans for suspicious IP addresses exceeding thresholds
- Customizable Lockout Duration – Define your own time thresholds for attempts and lockout duration
- Admin Exemptions – Administrators with ‘manage_options’ capability are automatically exempt to prevent accidental lockouts
- IP Allowlist – Whitelist static office, home, or developer IP addresses to bypass verification
Privacy & Compliance
- GDPR Ready – Anonymized IP logging (last octet stripped) with automatic expiration
- Data Minimization – Only essential security attempt data is stored temporarily as WordPress transients
- 7-Day Auto-Cleanup – All transient security logs are automatically deleted after 7 days
- No External Tracking – Self-hosted Math CAPTCHA requires zero third-party connections
- User Control – Administrators can disable logging entirely from plugin settings
Performance Optimizations
- Conditional Loading – Scripts and styles load strictly on pages displaying protected forms
- Zero Impact – Unprotected public pages experience zero performance overhead
- Cache Friendly – Works seamlessly with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, and Cloudflare APO
- Lightweight Assets – Clean, minified CSS and JavaScript for minimal page weight
- Database Efficiency – Uses WordPress transients instead of creating permanent database tables
Perfect For
- Bloggers – Protect comments from spam without tedious moderation
- Membership Sites – Secure member registration and login processes from bots
- Business Websites – Prevent fake lead registrations, spam inquiries, and brute force login attempts
- Personal Blogs – Simple setup with powerful, hands-off protection
- Portfolio Sites – Keep contact forms, logins, and comments spam-free
Technical Specifications
- WordPress Version: 5.8 or higher (Fully tested and verified up to WordPress 7.1)
- PHP Version: 7.4 or higher (PHP 8.0, 8.1, and 8.2 compatible)
- Multisite Compatible: Yes (Network-activatable)
- Translation Ready: Yes (Includes.pot template file)
- Performance Impact: Negligible (Conditional asset loading only on protected forms)
- Browser Support: All modern browsers (Chrome, Firefox, Safari, Edge, Opera)
Supported CAPTCHA Providers
Cloudflare Turnstile
Turnstile is Cloudflare’s modern, privacy-preserving alternative to traditional CAPTCHAs. It uses sophisticated browser challenges that are invisible to most legitimate users while effectively blocking automated bots.
Built-in Fallback CAPTCHA
Our self-hosted CAPTCHA system offers two challenge types:
”)
– Text Recognition: Warped text characters requiring human recognition
Both are effective against automated bots while remaining accessible to humans and requiring zero API keys.
Comparison with Other CAPTCHA Plugins
Unlike many CAPTCHA plugins that rely solely on external services or lack fallback mechanisms, SecureGate Captcha Lite provides:
– Multiple provider support with automatic fallback to prevent broken forms
– Self-hosted Math CAPTCHA option for complete independence with zero API keys
– Built-in brute force protection and IP rate limiting (no extra plugins required)
– Modern, clean admin interface with tabbed settings
– Regular updates and active maintenance tested against latest WordPress releases
– Clean, secure, well-documented code
Privacy & Data Collection
What Data Does This Plugin Collect?
SecureGate Captcha Lite is designed with privacy as a core principle:
Stored Locally (in your WordPress database as transients):
* Anonymized IP addresses (last octet removed)
* Timestamp of verification attempts
* Success/failure status of CAPTCHA verifications
* Failed attempt counters for rate limiting
NOT Stored:
* User emails or usernames
* Personal identifying information
* Browser fingerprints
* Tracking cookies (plugin-side)
* Permanent user profiles
External Service Data:
When Cloudflare Turnstile is enabled, user browser data is sent to Cloudflare for bot detection. Please review Cloudflare’s Privacy Policy for details.
When using the Built-in CAPTCHA, NO external services are contacted.
Data Retention:
All logs are stored as WordPress transients and automatically deleted after 7 days. Administrators can disable logging entirely in settings.
Right to Erasure:
No personal data is collected that would require manual erasure requests under GDPR.
Support & Documentation
Need Help?
- Documentation: Visit the plugin page for guides and tutorials
- Support Forum: Get help from the community at WordPress.org Support
- Bug Reports: Report issues on the support forum
- Feature Requests: Share your ideas on the support forum
Response Time:
We monitor the support forum regularly and aim to respond within 24-48 hours for most queries.
Credits & Acknowledgments
Sabbir
Third-Party Services:
When Cloudflare Turnstile is enabled, this plugin connects to Cloudflare’s servers for CAPTCHA verification. By using Turnstile, you agree to Cloudflare’s Terms of Service and Privacy Policy.