Free plugin
Real people in, bots out
Spam comments, fake sign-ups and password guessing stop at the door. Your visitors barely notice: most of the time there is nothing to click.
Works with Cloudflare Turnstile (free) or Google reCAPTCHA.
Every form, one plugin
Protection everywhere it matters
Turn it on once and choose which forms it guards.
Sign-in and sign-up
The admin sign-in, visitor accounts, sign-up and lost password are protected from bots.
Comments and forms
Comments, contact forms, shop reviews and checkout, and the forms you build with Fresco or Prisma.
Turnstile or reCAPTCHA
Cloudflare Turnstile, respectful of privacy, or Google reCAPTCHA v2 and v3: your choice.
A safety net
If Cloudflare is unreachable, reCAPTCHA can take over, so your forms never stop working.
No bother for your team
Signed-in users and the addresses you trust skip the check.
In your visitors’ language
The check and its messages follow the language of the page.
Settings
One page, every form
Choose the service, paste the two keys and tick the forms to protect: sign-in, registration, comments, Forms, page builders, the shop checkout. A green line tells you the protection is on.
- Cloudflare Turnstile or Google reCAPTCHA, your choice
- With Antispam, only for doubtful messages
- The secret key is stored encrypted and never shown again
Get started
Ready in a few minutes
Install it
In Plugins → Add New, find Captcha, then click Install and Activate.
Get your keys
Create a free Turnstile widget in your Cloudflare dashboard (or reCAPTCHA keys at Google).
Paste them and choose
In Settings → Captcha, paste the keys and tick the forms to protect.
You need Cleitext 0.54 or later.
Questions
Which service should I choose?
Turnstile is free and usually invisible to people; reCAPTCHA is the one many visitors already know. Both work the same way here.
Where do I get the keys?
From your free Cloudflare or Google account: the settings page tells you where to click.
What if I lock myself out?
Try the keys in a private window before signing out. If something goes wrong, the plugin can be turned off from the server with one command.
Goes well with
Plugins that work well together
Antispam
Keeps spam out of comments, sign-ups and forms with checks that run on your site only: a hidden field, a time check that works on cached pages, links, blocked words and addresses, foreign alphabets, repeated texts. A spam queue to review, and the Captcha plugin asked only when it is unsure. No outside service, IPs kept only as hashes.
Forms
A contact form block, included in Cleitext: messages are stored and emailed, with spam protection and a privacy notice.
Read more
Community
Cleitext grows with you
Found a problem, or missing a feature? Tell us on GitHub: every report is read and taken care of. And if you like Cleitext, leave a star: it helps others find it.
Free, open source, yours
Like every plugin in the official catalog: GPL license, no subscription, no limits.
