Loved by store owners in 158+ countries
This WooCommerce CAPTCHA plugin protects login, registration, reviews, contact forms and checkout. Pick the built-in CAPTCHA, Turnstile, reCAPTCHA or hCaptcha. Then lock out the IPs that keep attacking.
Rated 4.9/5 across Trustpilot, Google and Envato
Featured across the WordPress community
A WooCommerce CAPTCHA plugin adds a human check to the forms bots attack. Those are login, registration, lost password, reviews, comments, contact forms and checkout. A bot that fails the check is refused before it creates an account, posts spam or places an order.
Advanced CAPTCHA goes further on a store. It checks the block checkout on the server, counts failed payments, locks out repeat attackers and logs every attempt. It is part of the DevDiggers WooCommerce extensions range.
Bots guess passwords on the login page all night. They fill your customer list with fake accounts and your reviews with links.
The expensive attack is at checkout. Card testers push hundreds of stolen cards through your gateway to find the ones that work. Every failed charge can cost a fee and puts your merchant account at risk.
See how it protects your storeEvery protected form passes through the same layers. Most bots are refused at the first one.
A hidden field and a fill timer catch bots that fill every field or submit within seconds. No puzzle is shown.
Your chosen challenge runs. With smart mode, visitors with a clean record skip it entirely.
The answer is checked on your server for every form, including Store API checkout requests from the Checkout block.
Failed logins, checks and payments are counted per IP. Cross the limit and that IP is refused on every form.
From the login page to the last step of checkout, every form gets the same protection and every attempt is logged.
See verifications, bots stopped, humans passed, block rate and IP lockouts against the previous period. An activity chart shows when attacks came.
Attacks by form, threats by type and the top offending IPs sit below it. A protection checklist points at any form still left open.
The built-in CAPTCHA is drawn by your own server. It needs no account and no keys, and sends nothing to a third party.
Prefer a hosted check? Switch to Cloudflare Turnstile, Google reCAPTCHA v2 or v3, or hCaptcha at any time. Each tab has a live preview and a Test button for your keys.
Protect guest checkout only, or every customer. On the Checkout block the answer is verified through the Store API on your server. That closes the gap WooCommerce described in 2024, where bots skip a CAPTCHA by posting straight to the API.
On the classic checkout, place the CAPTCHA above or below Place Order, before the payment methods or around the billing details.
Card testers can solve a CAPTCHA or pay humans to do it. The fraud shield watches what they cannot hide: failed payments.
Failed payments are counted per IP and per billing email. After three in an hour by default, both are locked out of checkout. Add a limit on orders per IP per hour for extra cover.
A plain CAPTCHA lets the same bot try forever. Here an IP that fails five times in 15 minutes is refused on every protected form for an hour. You set all three numbers.
The Firewall screen lists who is locked out right now. Lift a lockout in one click if a real customer gets caught.
Most of your customers never do anything wrong. With smart mode on, they never see a CAPTCHA.
After a wrong password, a failed check or a failed payment, that IP gets the full challenge for 24 hours. Using reCAPTCHA v3? A low score gets a v2 checkbox instead of a dead end.
A hidden field people never see sits on every protected form, with a signed timer beside it.
Bots that fill every field, or submit within two seconds of loading the page, are refused before any CAPTCHA call is made. You set the minimum fill time.
Throwaway inboxes are how fake accounts and fraud orders slip past email checks. The guard refuses more than 160 known temporary email services.
Turn it on for registration, checkout and comments. Add your own blocked domains and write the message shoppers see.
The Integrations screen lists every supported plugin with its logo and status. Switch one on and the CAPTCHA appears above its submit button.
Contact Form 7, WPForms, Fluent Forms, Gravity Forms, Elementor Pro Forms, Forminator and Formidable are covered. So are BuddyPress, bbPress, Ultimate Member and Mailchimp for WordPress.
Block the countries you never sell to, or allow only the ones you do. The country comes from Cloudflare or WooCommerce geolocation.
Keep a block list and a trusted list with single IPs, wildcards and ranges for IPv4 and IPv6. Trusted IPs and user roles never see a challenge.
Every check is logged with its result, form, reason, IP, provider and page. Filter by result or form and search for an IP.
Block, trust or unlock an IP from its row. Keep the history from one day up to a year, and old entries clear on their own.
Get an email when an attack triggers a lockout. Alerts are held to one every 15 minutes. A big attack never floods your inbox.
A weekly report sums up what was stopped. Copy your whole setup to another store with settings import and export.
No extra service is required. The built-in CAPTCHA runs on your own server from the first minute.
The CAPTCHA adds itself to the forms you already have. Nothing needs a shortcode or a theme edit.
Most CAPTCHA plugins add one widget from one provider and stop there. A store needs more than a puzzle.
Switch between the built-in CAPTCHA, Turnstile, reCAPTCHA and hCaptcha without touching a form.
The built-in CAPTCHA sends nothing to Google or anyone else. It sets no cookies and needs no extra consent.
Every Store API checkout request is verified on your server. Bots cannot skip the CAPTCHA by calling the API directly.
Brute force lockout, block lists and country rules refuse an IP that keeps failing on every form.
The card testing shield, order limit and disposable email guard target attacks a plain CAPTCHA never sees.
The honeypot, smart mode and trusted roles keep the challenge away from people who never did anything wrong.
If a hosted provider cannot be reached, forms stay open and the attempt is logged. A provider without keys never blocks anyone.
A dashboard, a full log and email alerts show what was stopped, on which form and from where.
There are no add-ons and no feature levels to buy. Every plan has the full plugin, updates and support.
This plugin is made by a team that builds WooCommerce plugins full time, follows WordPress coding standards, and usually answers support within hours.
The free build is a complete CAPTCHA plugin with four providers, every WordPress and WooCommerce form, a honeypot and a dashboard. Pro locks out the bot that keeps coming back, guards your checkout against card testers and hides the CAPTCHA from clean visitors.
| What you get | Free | Pro |
|---|---|---|
| Built-in CAPTCHA with no keys | Yes | Yes |
| Cloudflare Turnstile, reCAPTCHA v2 and v3, hCaptcha | Yes | Yes |
| Live preview and key test | Yes | Yes |
| WordPress login, registration, lost password and comments | Yes | Yes |
| Every WooCommerce form, including the Checkout block | Yes | Yes |
| Server check on Store API checkout | Yes | Yes |
| Contact Form 7, WPForms and Fluent Forms | Yes | Yes |
| Shortcode and PHP function for custom forms | Yes | Yes |
| Invisible honeypot and fill timer | Yes | Yes |
| Security dashboard and protection checklist | Yes | Yes |
| Trusted user roles and trusted IPs | Yes | Yes |
| Forms stay open during a provider outage | Yes | Yes |
| Verification log with filters and search | Kept 30 days | Kept 1 day to 1 year, you choose |
| Firewall screen | Trusted IPs and repeat offenders | Adds lockouts, the block list and a country summary |
| Card testing shield that locks the IP and billing email after failed payments | No | Yes |
| Works with any payment gateway on classic and block checkout | No | Yes |
| Orders per IP per hour limit | No | Yes |
| Brute force lockout that counts failures across every form | No | Yes |
| Locked Out list with one-click Lift Lockout | No | Yes |
| Block an IP from the log, the dashboard or the lockout list | No | Yes |
| Permanent block list for IPs, wildcards and IP ranges | No | Yes |
| Block or allow countries on every protected form | No | Yes |
| Disposable email guard with 168 services plus your own domains | No | Yes |
| Smart mode that hides the CAPTCHA from clean visitors | No | Yes |
| Low reCAPTCHA v3 scores fall back to a v2 checkbox | No | Yes |
| Gravity Forms, Elementor Pro, Forminator and Formidable | No | Yes |
| BuddyPress, bbPress, Ultimate Member and Mailchimp for WordPress | No | Yes |
| Affiliates and MultiPOS login forms | No | Yes |
| Lockout alert emails | No | Yes |
| Weekly security report email | No | Yes |
| Settings import and export between stores | No | Yes |
| Updates | From WordPress.org | One click with an active plan |
| Support | WordPress.org forum | Priority replies within hours |
| Price | Free | From $39 a year |
More than 20 accepted contributions to WooCommerce core. The same care goes into how this plugin guards your checkout.
More than $125,000 in sales and 500+ five-star reviews across Trustpilot, Google and Envato.
A short setup wizard picks the provider and the forms bots attack most. Protection starts the moment you finish.
Real WooCommerce developers answer your tickets. Every plan includes priority support and a 14-day refund.
Bots stopped, block rate and top offending IPs are in your own dashboard.
Every label is translation ready and CAPTCHA widgets follow the visitor's language.
Elite Author
Sold more than $125,000 on Envato Market.
Featured Author
Made it to the Authors' Hall of Fame.
Community Health
Took part in community research initiatives.
WP Compliant
Keeps items to current WordPress standards.
Copyright Ninja
Helped protect against copyright violations.
Feedback Guru
Joined a group to improve the experience.
Trendsetter
Had an item that was trending.
Featured Item
Had an item featured on Envato Market.
Stop the runs of failed orders that cost gateway fees and put your merchant account at risk.
Keep fake signups and throwaway emails out of your customer list and your marketing emails.
Lock out the IPs guessing passwords on wp-login and My Account before they get lucky.
Keep links and junk out of comments, reviews and Contact Form 7 or WPForms inboxes.
Protect BuddyPress, bbPress and Ultimate Member signups from spam accounts.
The 10-site plan covers a portfolio, and settings export copies one setup to every store. Need a deeper clean-up? See our WordPress security services.
Upload Pro and activate it. It installs the free plugin for you, and the setup wizard opens.
Start with the built-in one, or paste your Turnstile, reCAPTCHA or hCaptcha keys and press Test.
Login, registration, lost password, guest checkout and reviews are ticked for you. Add any form plugin on the Integrations screen.
Switch on the card testing shield, lockouts and the disposable email guard. Then watch the dashboard fill up.
Store owners kept sending us the same support ticket. A night of failed orders, every one a stolen card being tested on their checkout. A CAPTCHA alone had not stopped it.
So I built Advanced CAPTCHA to do what a puzzle cannot. It checks every checkout request on the server, counts failed payments and locks the attacker out. Real customers mostly never see a puzzle at all.
One yearly price with every feature in it. There are no add-ons and no limits on checks or forms.
Every plan works as long as your subscription stays active. It renews yearly until you cancel, and you can cancel anytime from your account. Every plan is backed by our 14-day refund policy.
$39/year
Just $3.25/mo when billed annually
$179/year
Just $14.92/mo when billed annually
$299/year
Just $24.92/mo when billed annually
If the plugin does not work as promised on your site, you have the backup of our 14-day refund policy to ask for your money back.
Every screen below comes from the plugin running a real WooCommerce store. The live demo is the same build and needs no account.
Answers to what store owners ask us most about adding a CAPTCHA to WooCommerce.
Ask a QuestionInstall the plugin and run the setup wizard. Guest checkout is ticked for you. To protect logged in customers too, tick All Users Checkout on the WooCommerce card under Integrations.
For a walkthrough with screenshots, read our guide on adding Google reCAPTCHA to WooCommerce checkout.
Yes. The CAPTCHA shows in the Checkout block and the answer is verified through the Store API on your server. A bot that posts straight to the Store API is checked the same way.
Cloudflare Turnstile is the friendliest hosted option, because most visitors never click anything. The built-in CAPTCHA is the most private, because nothing leaves your server. Use reCAPTCHA or hCaptcha if you already have keys.
We compare the options in more depth in our list of reCAPTCHA alternatives.
No. The built-in CAPTCHA works without an account or keys. Turnstile, reCAPTCHA and hCaptcha need a free site key and secret key, and each provider tab links to where you get them.
It makes card testing much harder. No tool stops every attack, because some testers solve CAPTCHAs or pay people to. That is why the card testing shield also counts failed payments per IP and per billing email and locks both out of checkout.
Rarely. Turnstile and reCAPTCHA v3 are usually invisible, and the honeypot catches many bots with no puzzle at all. With smart mode on, visitors with a clean record never see a CAPTCHA.
With the fallback on, they get a v2 checkbox instead of an error. Tick it and the form goes through. The fallback needs a v2 site key and secret key as well as your v3 keys.
No. A hosted provider stays off until both keys are saved. Add your IP with the Trust my IP button or trust your user role. Any lockout can be lifted from the Firewall screen.
By default, forms keep working and the attempt is logged, instead of blocking every login and checkout. The honeypot, lockouts and fraud shield keep running. You can switch this off and refuse forms during an outage instead.
It is drawn on your own server, sets no cookies and sends nothing to a third party. Hosted providers receive the visitor's IP and a challenge token. The plugin adds suggested wording to your privacy policy page. Check your setup with your own advisor.
Failed logins, failed checks and failed payments from one IP are counted. By default, five failures in 15 minutes lock that IP out of every protected form for an hour. You can change all three numbers.
Express buttons on product and cart pages place the order without the checkout form. Test them after setup, especially if you protect every customer's checkout. Our support team will help if a button needs an exception.
Contact Form 7, WPForms, Fluent Forms, Gravity Forms, Elementor Pro Forms, Forminator, Formidable, BuddyPress, bbPress, Ultimate Member and Mailchimp for WordPress. For anything else, add the shortcode and call one PHP function in your form handler.
Yes. WordPress login, registration, lost password, comments and every form plugin are protected on any WordPress site. The checkout and fraud shield need WooCommerce.
Yes. The built-in CAPTCHA refreshes itself on cached pages. Behind Cloudflare, a load balancer or Nginx proxy, set the visitor IP source so the real IP is used for lockouts and logs.
The form, provider, result and reason, the visitor IP, user agent and page. You choose how long to keep it, from one day up to a year, and old entries are deleted on their own. Logging can be switched off.
Yes. Advanced CAPTCHA is free with four providers, every WordPress and WooCommerce form, three form plugins, the honeypot and the dashboard. Pro adds the card testing shield, lockouts, country rules and more integrations.
Want to compare other options first? Read our comparison of WooCommerce CAPTCHA plugins.
No. Pro runs on top of the free plugin and reads the same settings and logs. Activate your license key and every Pro feature turns on.
Every setting is explained in the Advanced CAPTCHA documentation with screenshots. There is also a step by step guide to adding Cloudflare Turnstile to WordPress.
This plugin comes with a 14-day refund policy. If it does not work as described on your site, contact us within 14 days for a full refund. You can read the full terms on our refund policy page.
Add a WooCommerce CAPTCHA plugin that guards every form, checks the block checkout on your server and locks out repeat attackers. Try the live demo and then pick a plan.
What you get the day you turn it on.
from 500+ reviews
Store owners in 158+ countries run on DevDiggers.
Elite Author with $125,000+ in sales.
