Skip to content

Sign-in

CAPTCHA

Pro and AgencyAbout Login Protection

Adds a quick "are you human?" check to your sign-in, sign-up, password reset and comment forms, so robots cannot use them.

What it does

A CAPTCHA is a small test that people pass easily and robots do not. Most of the time your visitors will not even notice it: it works quietly in the background.

Stack Guard uses one of two free services to run the check: Cloudflare Turnstile or Google reCAPTCHA. The service decides whether the visitor is a person, and Stack Guard refuses the form if not.

Why you might want it

Robots fill in sign-in forms to guess passwords, sign-up forms to create fake accounts, and comment forms to post spam. A CAPTCHA stops all three before they reach your site.

We recommend Cloudflare Turnstile. It is free, it respects your visitors' privacy, and it rarely asks anyone to click anything.

Get your keys

The service gives you two keys: a Site Key, which is public and shows the check on your pages, and a Secret Key, which stays private and lets Stack Guard confirm the answer.

  1. On the Login tab, find Bot defence and choose a CAPTCHA Provider.
  2. Click Get API Keys. It opens the provider's page in a new tab. Sign in or create a free account there.
  3. Add your website. Type your domain exactly as visitors see it, for example yoursite.com.
  4. Copy the Site Key and the Secret Key the provider shows you.

Turn it on

  1. Switch on CAPTCHA Protection.
  2. Paste the Site Key and the Secret Key into their boxes. Nothing changes on your site until both are filled in.
  3. Under Enable On, choose the forms to protect. Login, registration and password reset are on by default; comments are off.
  4. Click Save Changes.
  5. Before you sign out, open your sign-in page in a private browser window and check you can still sign in. This catches a mistyped key while you are still signed in to fix it.

Which provider to choose

Cloudflare Turnstile: free, private, and usually invisible. The best choice for most sites.

Google reCAPTCHA v2 (Checkbox): the familiar "I'm not a robot" box. Sometimes asks visitors to pick pictures.

Google reCAPTCHA v3 (Invisible): no box at all. Google gives each visitor a score from 0 (probably a robot) to 1 (probably a person). The Score Threshold is the lowest score you accept: a higher number is stricter. 0.5 is a sensible start.

Keys only work with the provider and version that made them, so new keys are needed if you switch.

What visitors will see

Depending on the provider, a small box near the form button or nothing at all. If the check fails, the form is not sent and they are asked to try again.

People who moderate comments on your site are never asked.

If something goes wrong

If the provider's service is down, Stack Guard lets the form through, so an outage never locks you out.

A wrong key is different: every sign-in will fail. If that happens while you are still signed in, fix the key on the Login tab.

If you are already signed out, add define( 'SMG_SAFE_MODE', true ); to wp-config.php, the settings file in your site's main folder, just above That's all, stop editing! Sign in, correct the keys, then remove the line. The Login Guard topic explains this step by step.

Ad blockers and very strict privacy settings can stop the check from loading for some visitors. If people report trouble, try Cloudflare Turnstile, which is blocked less often.

Which plan includes it

CAPTCHA is part of Pro. On Free you can see the settings, but no check is added to your forms.

How it works, for developers
  • Providers: Cloudflare Turnstile and Google reCAPTCHA v2 or v3. Answers are verified on your server against the provider's siteverify address with your secret key; reCAPTCHA v3 passes when the score is at or above smg_recaptcha_v3_threshold (default 0.5).
  • Hooks: sign-in on login_form and the authenticate filter at priority 15; sign-up on register_form and registration_errors; lost password on lostpassword_form and lostpassword_post; comments on comment_form_after_fields and preprocess_comment. WooCommerce sign-in and sign-up forms are covered too.
  • Settings: smg_captcha_enabled, smg_captcha_provider, smg_captcha_site_key, smg_captcha_secret_key, smg_captcha_on_login, smg_captcha_on_register, smg_captcha_on_reset, smg_captcha_on_comments. Both keys are left out of settings exports. Safe mode turns CAPTCHA off.

Quick answers about captcha

What does CAPTCHA do in Stack Guard?

A CAPTCHA is a small test that people pass easily and robots do not. Most of the time your visitors will not even notice it: it works quietly in the background. Stack Guard uses one of two free services to run the check: Cloudflare Turnstile or Google reCAPTCHA. The service decides whether the visitor is a person, and Stack Guard refuses the form if not.

Why use captcha on a WordPress site?

Robots fill in sign-in forms to guess passwords, sign-up forms to create fake accounts, and comment forms to post spam. A CAPTCHA stops all three before they reach your site. We recommend Cloudflare Turnstile. It is free, it respects your visitors' privacy, and it rarely asks anyone to click anything.

How do I set up captcha?

1. On the Login tab, find Bot defence and choose a CAPTCHA Provider. 2. Click Get API Keys. It opens the provider's page in a new tab. Sign in or create a free account there. 3. Add your website. Type your domain exactly as visitors see it, for example yoursite.com. 4. Copy the Site Key and the Secret Key the provider shows you.

Which Stack Guard plan includes captcha?

CAPTCHA is part of Pro. On Free you can see the settings, but no check is added to your forms.

More in Sign-in

Not running Stack Guard yet? It is free.

Download Free