Gate House – Spam Protection & CAPTCHA

Description

Gate House helps reduce automated spam on native WordPress and WooCommerce forms. Start with built-in keyless checks, or connect Cloudflare Turnstile, Google reCAPTCHA v2/v3 or hCaptcha. Free needs no Gate House account, license, credit card or trial.

WordPress login, registration and comment spam protection

Choose Off, Invisible or Human check for native WordPress login, registration, password-reset requests and comments. The checks act on supported submissions; they do not classify comment content or prove that every visitor is legitimate.

WooCommerce checkout, account and review forms

Add checks to WooCommerce My Account forms, product reviews, classic checkout, Checkout Blocks and native order-payment forms. Checkout checks are an explicit choice: test complete sandbox payment journeys before enabling them. Custom forms, headless routes, express wallets and gateway-specific flows need separate assessment.

Start without CAPTCHA keys

Automatic protection runs on your server using a signed form proof, a hidden honeypot and a minimum submission time. No external provider account or browser challenge is needed for this mode. Fresh settings observe until you choose protection. Turn on recommended protection enables invisible checks for supported sign-in, registration, reset, comment and review forms while leaving checkout unchanged.

Choose Turnstile, reCAPTCHA or hCaptcha

All three provider integrations are included in Free: Cloudflare Turnstile Managed, Google reCAPTCHA v2 checkbox or v3 score, and standard hCaptcha. Connect one external provider at a time, save that provider’s keys and run the browser-to-server connection test. Then select Human check on the forms you want to protect. Provider key creation takes place in the provider’s own dashboard.

See form coverage and blocked attempts

Guided setup includes form discovery, provider diagnostics and daily blocked-attempt totals. Overview separates enabled form types from successful-use observations. A detected form or passing provider test is not proof that every theme or payment journey works. Try successful and rejected submissions on the actual forms your visitors use.

Free protection and optional Pro controls

Free includes the form checks above, keyless setup, provider testing, coverage and the aggregate blocked-attempt counter. Gate House Pro is a separately distributed add-on for configurable rate limits and presets, advanced rules, disposable-email and account-abuse checks, card-testing signals, held-order review, detailed local activity, Contact Form 7 and administration tools. Free keeps working independently. Learn more: https://gatehousewp.com/

External services

Automatic protection runs locally and sends no data to Gate House or a CAPTCHA vendor. The Free edition has no Gate House license updater, install check-in or setup-status telemetry. Its CSS, JavaScript and fonts ship locally.

External verification is optional. An administrator chooses a provider, saves that provider’s keys, runs an explicit connection test, and enables Human check on selected forms. Only that selected provider’s browser script is loaded on forms configured for its check and on explicit administrator diagnostics. Automatic forms do not load a vendor challenge. The script receives the public site key and, where supported, the form’s verification action; the provider processes browser/challenge data under its own privacy policy, including the browser’s network connection and IP address.

When a visitor submits a provider challenge, or an administrator submits the connection test, Gate House sends an HTTPS POST containing the verification secret (secret), challenge token (response), and trusted client IP when available (remoteip) to the selected provider’s verification endpoint. hCaptcha also receives the expected public site key (sitekey). The plugin does not send account passwords, payment details, or order contents to these verification endpoints. Raw challenge tokens, secrets and IP addresses are not retained in plugin counters.

Cloudflare Turnstile

Purpose: managed human verification for the selected forms and administrator connection test.
Browser script: https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
Server verification: https://challenges.cloudflare.com/turnstile/v0/siteverify
Terms: https://www.cloudflare.com/website-terms/
Privacy: https://www.cloudflare.com/privacypolicy/

Google reCAPTCHA

Purpose: reCAPTCHA v2 checkbox or v3 verification for the selected forms and administrator connection test.
Browser script: https://www.google.com/recaptcha/api.js (render=explicit for v2; render= for v3).
Server verification: https://www.google.com/recaptcha/api/siteverify
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy

hCaptcha

Purpose: standard human verification for the selected forms and administrator connection test.
Browser script: https://js.hcaptcha.com/1/api.js?render=explicit
Server verification: https://api.hcaptcha.com/siteverify
Terms: https://www.hcaptcha.com/terms
Privacy: https://www.hcaptcha.com/privacy

Review your selected provider’s terms, privacy information and quotas before configuring it. Provider keys are optional when using Automatic protection. Preserve provider branding and any privacy notices required for your site.

Source code and build instructions

Readable TypeScript and CSS for the compiled assets are included in assets/src/. The build entry point is tools/build.mjs; package.json, package-lock.json and tsconfig.json contain the build configuration and locked dependencies. No private repository or Pro source is needed to rebuild the Free assets.

On a development copy, use Node.js 22 LTS (22.13 or later) with npm. From the installed gate-house-spam-protection-captcha directory (gate-house/ in the source repository), run:

npm ci
npm run build

The build writes assets/build/admin.js, assets/build/frontend.js, assets/build/frontend-recovery.js, assets/build/admin.css and assets/build/frontend.css. The local recovery helper can restore the frontend bundle when a page builder removes it; it waits for a configured Human-check widget and does not contact an additional service. To check the source, run npm run typecheck and npm run lint. Prebuilt assets ship in the installation ZIP, so site owners do not need Node.js or a build step. Keep node_modules and other development dependencies out of distributable ZIPs. Local font files are covered by assets/fonts/OFL.txt.