Description
SiteGuarding Math Captcha asks visitors to solve a small example such as “7 + ? = 12” before a form is sent. People answer it in a second; most spam bots do not. There are no cookies, no tracking and no third-party captcha service: everything runs on your own site.
Where it works
- WordPress login, registration (including multisite sign-up), lost password and comment forms
- WooCommerce: login, registration, lost password, checkout (classic checkout and the checkout block), product reviews and the order tracking form
- Contact Form 7, WPForms (Lite and Pro), Formidable Forms, Ninja Forms, Fluent Forms and Forminator: the captcha is added before the submit button of every form automatically (Fluent Forms conversational forms are not covered)
- bbPress new topics and replies
- Your own forms: add the [sgmathcp_captcha] shortcode and check the answer with sgmathcp_verify(), or list pages under “Protected pages” and every form posted to them is checked for you
Captcha options
- Addition, subtraction, multiplication and division with numbers from 1 to 99
- Numbers as digits, as words in the language of your site, or mixed
- Your own title above the example and your own time limit
- Hidden for logged-in users if you wish (login, registration and lost password forms always ask)
- A hidden trap field that only bots fill in
- Works with page caching: a fresh example is loaded when a visitor starts filling a cached form
- Every example can be used only once, so a solved captcha cannot be replayed
IP and country rules
- Never show the captcha to trusted IP addresses or countries
- Block IP addresses, ranges (CIDR, wildcards, from-to) and countries, IPv4 and IPv6
- Lock an IP address for a while after too many wrong answers (an IPv6 address is locked with its /64 network)
- Block rules apply to logged-in users too
- Country detection from a free public domain database or from the Cloudflare country header
- The visitor address is taken from the connection; proxy headers are trusted only from Cloudflare or from proxies you list, so bots cannot fake their address
Statistics
- Failed checks by hour or by day, from today to the last 12 months
- Top countries, top IP addresses with a one-click block, and failures by form and reason
- Optional counter of today’s failed checks in the admin bar (off by default)
- Limited retention of IP addresses and an option to store them shortened
Privacy
The captcha sets no cookies. When a check fails, the plugin stores the IP address, its country, the form and the time in your database to block repeated attempts and to show statistics. IP addresses are deleted automatically after the number of days you choose (90 by default). A suggested text for your privacy policy is added under Settings > Privacy.
External services
This plugin can download a free IP-to-country database so that country rules work. Nothing is downloaded unless an administrator clicks “Download database” or “Update now” on the IP & GEO tab, or enables the monthly update there.
- What: the “user-country” database of the ip-location-db project, published in the public domain (PDDL 1.0), about 7 MB.
- Where from: https://github.com/sapics/ip-location-db/releases (github.com redirects the download to release-assets.githubusercontent.com). A checksum file is read from the same place to verify the download.
- What is sent: a normal file request. Like any web request it shows the IP address of your server to GitHub. No data about your visitors or your site is sent.
- GitHub terms of service: https://docs.github.com/site-policy/github-terms/github-terms-of-service
- GitHub privacy statement: https://docs.github.com/site-policy/privacy-policies/github-general-privacy-statement
You can upload your own database in MaxMind DB format instead (for example GeoLite2 Country with your own MaxMind license).
Screenshots
Installation
- Install the plugin from the Plugins screen, or upload the plugin folder to /wp-content/plugins/.
- Activate it.
- Open Settings > Math Captcha and choose the forms to protect. Login, registration, lost password and comment forms are on by default.
FAQ
-
Does it work with page caching?
-
Yes. Every example works once and expires after the time you set. For forms that are often cached (comments, contact forms) the plugin loads a fresh example as soon as the visitor starts filling the form, and after every AJAX submission.
-
Can I place the captcha myself in Contact Form 7?
-
Yes. Add the [sgmathcp your-captcha] tag where you want it. Forms without the tag get the captcha automatically before the submit button. The messages can be changed on the form’s Messages tab.
-
How do I protect my own form?
-
Put [sgmathcp_captcha] inside the form. If the form sends its data to the same page, add that page to “Protected pages” on the Forms tab and you are done. Otherwise check the answer in your form handler:
$check = sgmathcp_verify(); if ( is_wp_error( $check ) ) { // Show $check->get_error_message() and stop. } -
Express payment buttons such as Apple Pay and Google Pay send the order without the captcha answer, so the checkout captcha refuses those orders. Go to Settings > Math Captcha > Forms and select their payment methods under “Payment methods without captcha”. Orders paid with these methods are placed without the question, and the question is hidden while such a method is selected on the checkout.
Bots can choose these methods too, so select only methods where the customer confirms the payment in a wallet. Some payment plugins use one method for cards and express buttons (for example Stripe or WooPayments): selecting it also removes the captcha from card payments. Orders that need no payment always need the answer, and IP and country blocks and the limit of wrong answers still apply. Developers can decide per order with the sgmathcp_wc_checkout_skip filter.
-
My site is behind Cloudflare or a proxy. Which IP address is used?
-
By default the connection address. When the request comes from a Cloudflare address, the Cloudflare visitor header is used. For your own proxy or load balancer, choose “Behind my own proxy” on the IP & GEO tab and list the proxy addresses.
-
I blocked my own IP address or country. How do I get back in?
-
The plugin warns you before this happens and the Block button refuses your own address. If you are locked out anyway, rename the folder wp-content/plugins/siteguarding-math-captcha with FTP or your hosting file manager, log in, rename it back and fix the rules.
-
I used WP Advanced Math Captcha. Can I keep my settings?
-
Yes. The Advanced tab offers to import its settings, and Contact Form 7 forms with the old [mathcaptcha] tag keep working once that plugin is deactivated.
-
Is a math captcha enough against every bot?
-
No captcha stops everything. A math captcha stops the automated spam most sites receive. For stronger protection combine it with the attempt limit and the IP and country rules.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“SiteGuarding Math Captcha” is open source software. The following people have contributed to this plugin.
Contributors
Translate “SiteGuarding Math Captcha” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.1.0
- New: WooCommerce payment methods without captcha, for express payment buttons such as Apple Pay and Google Pay. The checkout question is hidden while such a method is selected.
1.0.0
- First release.