SecureGate Captcha Lite

SecureGate Captcha Lite is a high-performance security and anti-spam suite built to safeguard your WordPress site from intrusive spam, malicious bots, credential stuffing, and brute-force attacks. Leveraging professional-grade tools like Cloudflare Turnstile alongside our unique self-hosted Math and Character CAPTCHA fallback system, we ensure your site remains impenetrable while maintaining a seamless, privacy-first experience for legitimate users.

Protect Your Store – Upgrade to Pro Now

Why Choose SecureGate Captcha Lite?

Complete Protection
Secure all critical WordPress forms including admin login, user registration, password reset, and comment submissions. Each form can be individually enabled or disabled based on your needs.

Privacy-First Approach (GDPR Compliant)
Built with GDPR compliance as a core priority. Uses Cloudflare Turnstile for privacy-focused, cookie-free bot detection and includes a self-hosted fallback CAPTCHA that requires zero external API connections and zero third-party tracking.

Instant Protection Without API Keys
Want immediate protection without signing up for third-party services? Our built-in Math CAPTCHA works immediately upon plugin activation with zero API keys required.

Intelligent Auto-Fallback
Never worry about external network outages. If Cloudflare Turnstile experiences downtime, high latency, or is blocked by an aggressive client browser extension, SecureGate automatically falls back to our self-hosted Math CAPTCHA so your forms never break.

Lightning Fast Performance
Optimized code that loads conditionally only where needed. No bloat, no unnecessary database queries, and fully compatible with all major caching plugins to ensure your website remains fast.

Smart Rate Limiting & Brute-Force Defense
Intelligent rate limiting prevents brute-force login attacks by tracking failed login attempts and automatically locking out suspicious IP addresses temporarily.

Easy to Configure
Intuitive admin interface with clear settings for CAPTCHA providers, protected forms, and security rules. Get started in minutes with sensible defaults.

Core Features

CAPTCHA Providers

• Cloudflare Turnstile – Modern, privacy-focused CAPTCHA with frictionless user experience

  • Free forever with generous limits from Cloudflare
  • Invisible verification for most legitimate human visitors
  • No user frustration with slow image puzzles (no clicking traffic lights)
  • Privacy-compliant with no tracking cookies or user profiling
  • Quick 2-minute API key setup

• Built-in Fallback CAPTCHA – Self-hosted protection that works always

  • Math challenges (simple arithmetic problems like 5 + 3 = 8)
  • Warped character text recognition challenges
  • Works instantly with zero external dependencies or API keys
  • GDPR compliant by design (runs 100% on your own server)
  • Perfect for restricted networks, local development, and intranet sites

Protected Forms

• WordPress Login – Protect admin and frontend login forms from credential stuffing and automated password guessing
• User Registration – Stop spam bot registrations and fake user account creation
• Password Reset (Lost Password) – Prevent automated password reset abuse and email flooding
• Comment Forms – Block automated comment spam without clogging moderation queues

Security & Rate Limiting

• Rate Limiting – Configure maximum allowed failed login attempts before a temporary lockout triggers
• Automatic IP Blocking – Automatic temporary bans for suspicious IP addresses exceeding thresholds
• Customizable Lockout Duration – Define your own time thresholds for attempts and lockout duration
• Admin Exemptions – Administrators with ‘manage_options’ capability are automatically exempt to prevent accidental lockouts
• IP Allowlist – Whitelist static office, home, or developer IP addresses to bypass verification

Privacy & Compliance

• GDPR Ready – Anonymized IP logging (last octet stripped) with automatic expiration
• Data Minimization – Only essential security attempt data is stored temporarily as WordPress transients
• 7-Day Auto-Cleanup – All transient security logs are automatically deleted after 7 days
• No External Tracking – Self-hosted Math CAPTCHA requires zero third-party connections
• User Control – Administrators can disable logging entirely from plugin settings

Performance Optimizations

• Conditional Loading – Scripts and styles load strictly on pages displaying protected forms
• Zero Impact – Unprotected public pages experience zero performance overhead
• Cache Friendly – Works seamlessly with WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache, and Cloudflare APO
• Lightweight Assets – Clean, minified CSS and JavaScript for minimal page weight
• Database Efficiency – Uses WordPress transients instead of creating permanent database tables

Perfect For

• Bloggers – Protect comments from spam without tedious moderation
• Membership Sites – Secure member registration and login processes from bots
• Business Websites – Prevent fake lead registrations, spam inquiries, and brute force login attempts
• Personal Blogs – Simple setup with powerful, hands-off protection
• Portfolio Sites – Keep contact forms, logins, and comments spam-free

Technical Specifications

• WordPress Version: 5.8 or higher (Fully tested and verified up to WordPress 7.1)
• PHP Version: 7.4 or higher (PHP 8.0, 8.1, and 8.2 compatible)
• Multisite Compatible: Yes (Network-activatable)
• Translation Ready: Yes (Includes .pot template file)
• Performance Impact: Negligible (Conditional asset loading only on protected forms)
• Browser Support: All modern browsers (Chrome, Firefox, Safari, Edge, Opera)

Supported CAPTCHA Providers

Cloudflare Turnstile
Turnstile is Cloudflare’s modern, privacy-preserving alternative to traditional CAPTCHAs. It uses sophisticated browser challenges that are invisible to most legitimate users while effectively blocking automated bots.

Built-in Fallback CAPTCHA
Our self-hosted CAPTCHA system offers two challenge types:
– Math Challenges: Simple arithmetic problems (e.g., “What is 7 + 3?”)
– Text Recognition: Warped text characters requiring human recognition

Both are effective against automated bots while remaining accessible to humans and requiring zero API keys.

Comparison with Other CAPTCHA Plugins

Unlike many CAPTCHA plugins that rely solely on external services or lack fallback mechanisms, SecureGate Captcha Lite provides:
– Multiple provider support with automatic fallback to prevent broken forms
– Self-hosted Math CAPTCHA option for complete independence with zero API keys
– Built-in brute force protection and IP rate limiting (no extra plugins required)
– Modern, clean admin interface with tabbed settings
– Regular updates and active maintenance tested against latest WordPress releases
– Clean, secure, well-documented code

Privacy & Data Collection

What Data Does This Plugin Collect?

SecureGate Captcha Lite is designed with privacy as a core principle:

Stored Locally (in your WordPress database as transients):
* Anonymized IP addresses (last octet removed)
* Timestamp of verification attempts
* Success/failure status of CAPTCHA verifications
* Failed attempt counters for rate limiting

NOT Stored:
* User emails or usernames
* Personal identifying information
* Browser fingerprints
* Tracking cookies (plugin-side)
* Permanent user profiles

External Service Data:
When Cloudflare Turnstile is enabled, user browser data is sent to Cloudflare for bot detection. Please review Cloudflare’s Privacy Policy for details.

When using the Built-in CAPTCHA, NO external services are contacted.

Data Retention:
All logs are stored as WordPress transients and automatically deleted after 7 days. Administrators can disable logging entirely in settings.

Right to Erasure:
No personal data is collected that would require manual erasure requests under GDPR.

Support & Documentation

Need Help?

• Documentation: Visit the plugin page for guides and tutorials
• Support Forum: Get help from the community at WordPress.org Support
• Bug Reports: Report issues on the support forum
• Feature Requests: Share your ideas on the support forum

Response Time:
We monitor the support forum regularly and aim to respond within 24-48 hours for most queries.

Credits & Acknowledgments

Developed with ❤️ by R.Sabbir

Third-Party Services:
When Cloudflare Turnstile is enabled, this plugin connects to Cloudflare’s servers for CAPTCHA verification. By using Turnstile, you agree to Cloudflare’s Terms of Service and Privacy Policy.