Getting started with SWPL Captcha Pro
Last updated July 10, 2026
What SWPL Captcha Pro does
SWPL Captcha Pro protects your WordPress and WooCommerce forms from bots and spam using two layers working together:
- A CAPTCHA provider you choose – Cloudflare Turnstile, Google reCAPTCHA (v2 or v3), or hCaptcha: the familiar widget (or invisible check) that proves a visitor is human. A Honeypot option provides server-side-only defense with no external service or account.
- A server-side risk score. Before any visitor is bothered with a challenge, every protected submission is scored from signals your server can see – form timing, browser signature, request volume, and more. Only requests that look risky are challenged, and only the riskiest handful are blocked outright.
Why two layers: a provider widget alone challenges everyone equally. The risk score means a normal shopper – especially a logged-in one – usually passes without seeing anything, while bots get stopped. That is how you can protect checkout and payment without adding friction for real buyers.
Installation
- Go to Plugins > Add New > Upload Plugin, upload the plugin zip, and click Install Now, then Activate.
- When licensing arrives for your copy, enter your license key where prompted. Until then the plugin runs unlocked.
- Open the SWPL Captcha Pro admin page. Every setting has a “?” beside it that links to its full entry on the built-in Help tab.
Initial setup
- Choose a provider (Provider tab). Turnstile and hCaptcha are privacy-friendly and low-friction; reCAPTCHA v2 is the classic checkbox; reCAPTCHA v3 is invisible and score-based; Honeypot needs no account; None turns the provider layer off (the risk score still runs, but no challenge is ever offered).
- Add its keys and test. Every provider gives a public Site key (rendered in the page) and a private Secret key (stays on your server – never publish it). The Help tab has a step-by-step key guide per provider, written against each provider’s live dashboard. Paste both keys and click Test connection to confirm they are accepted. For your safety the plugin never displays a stored secret again – leave the box blank to keep it.
- Choose which forms to protect (Forms tab). WordPress login, registration, lost password, and comments are always available; with WooCommerce active you also get WooCommerce login, registration, checkout, Block checkout, add payment method, and product reviews. Enable the forms that actually get abused – login and registration are the common targets.
- Set your risk thresholds (Signals tab). The Challenge threshold (default 30) is the score at which a borderline request must pass the provider challenge; the Block threshold (default 70) is the score at which a request is blocked outright. Lower numbers are stricter. The defaults are sensible – start there.
- Optional, advanced: the REST tab issues API keys and CORS origins for a headless front end; the Gateway tab (experimental) gates specific WordPress REST API routes; the Tools tab exports or imports all settings as JSON and can reset to defaults (export a backup first – reset cannot be undone).
Frequently asked questions
Will my customers get a CAPTCHA at checkout?
In short, no. Protection is risk-scored, not all-or-nothing: a regular shopper – especially a logged-in one – scores low and passes silently, without ever seeing a challenge; the provider is not even contacted. Only requests that look suspicious are challenged, and only the riskiest handful are blocked. That is why it is safe to protect checkout and payment forms.
What happens if I pick a provider but have not entered keys yet?
That is what Paranoid mode decides. Off (the default), a request that needs a challenge is allowed through – fail open, keeping the site usable. On, it is blocked – fail closed. The real fix either way is to finish configuring the provider.
Which provider should I pick?
For a polished, low-friction widget: Turnstile or hCaptcha. If your audience expects the Google checkbox: reCAPTCHA v2. For zero visible challenge: reCAPTCHA v3 (tune its 0.0-1.0 score threshold; Google’s default is around 0.5) or Honeypot (no account at all). Only the fields your chosen provider needs are shown.
Is my site behind Cloudflare or another proxy?
Then visit the REST tab’s Trusted proxy setting and choose the forwarded-IP header your proxy actually sends (X-Forwarded-For, CF-Connecting-IP, or X-Real-IP). Leave it off without such a proxy – enabling it wrongly lets a visitor spoof their IP past the velocity limits.
Where do I see what got challenged or blocked?
The Analytics tab shows the event log. How long those rows are kept is the Data retention setting (a daily job prunes older ones); the short-lived per-IP velocity rows used for rate detection are always kept only briefly regardless.