Description
GridXFlex Captcha Security adds a self-hosted image CAPTCHA, backed by a silent honeypot layer, to your site’s Login, Registration, Lost Password, and Comments forms.
Everything is generated on your own server using PHP’s built-in GD library. No requests are ever sent to a third-party service, no API keys are required, and no personal data is stored beyond a short-lived, one-time-use security token.
Features
- Self-hosted image CAPTCHA (GD-generated, delivered inline as a base64 image — no extra HTTP request)
- Silent honeypot field on every protected form, on by default
- Per-form protection toggles: Login, Registration, Lost Password, Comments
- Configurable character type (alphanumeric / letters / numbers), letter case, and length (3–6 characters)
- Option to hide the comment captcha for logged-in users
- One-time-use challenge tokens — each code can be attempted exactly once, then it’s gone
- No PHP sessions, no cookies set by this plugin, no external requests, no tracking
Why no PHP sessions?
Older captcha plugins commonly call session_start() on every front-end request, even on pages that never show a captcha. That has a real performance cost, breaks under object-cache or load-balanced PHP-FPM pools without sticky sessions, and is incompatible with full-page caching. GridXFlex Captcha Security stores each challenge as a short-lived WordPress transient, keyed by a random token embedded in the form. The token is just a lookup key — the actual secret (a hash of the code) stays server-side — so it remains safe even on a cached page, and each challenge is deleted the instant it’s checked, pass or fail.
Screenshots
Installation
- Upload the
gridxflex-captcha-securityfolder to/wp-content/plugins/. - Activate the plugin through the “Plugins” screen in WordPress.
- Go to Settings GridXFlex Captcha to choose which forms are protected and adjust the captcha’s appearance.
FAQ
-
Does this plugin transmit any data externally?
-
No. Code generation, image rendering, and verification all happen on your own server using PHP’s built-in GD library. Nothing is sent to any third-party API or service.
-
Why doesn’t this use PHP sessions?
-
For compatibility with page caching and load-balanced hosting. Instead of
$_SESSION, each challenge is stored as a short-lived WordPress transient keyed by a random token embedded in the form. This works identically behind full-page cache and across load-balanced PHP-FPM pools without sticky sessions, and every challenge is automatically deleted after a single use. -
What is the honeypot layer?
-
A hidden form field that’s invisible to human visitors but often auto-filled by simple bots. If it’s filled in, the submission is rejected the same way a wrong CAPTCHA code would be — no separate “bot detected” message is ever shown, so automated scripts can’t learn which check they failed.
-
Does this require an API key?
-
No. This version doesn’t use any third-party CAPTCHA provider.
-
Does the plugin work if my host doesn’t have the GD PHP extension?
-
Yes. If GD isn’t available, the image challenge is automatically skipped — protected forms keep working normally, they just fall back to honeypot-only protection instead of erroring out. You’ll see an admin notice explaining this; it clears itself automatically as soon as GD is enabled, no need to reactivate the plugin.
-
Does the captcha add any visible branding to my site?
-
An HTML comment —
<!-- Powered By GridXFlex WordPress Plugins -->— is placed next to the captcha markup wherever it renders (login, registration, lost password, comments). It isn’t visible in the page as displayed, only in page source. -
What happens if someone gets the comment captcha wrong?
-
They’re redirected back to the same post with an inline error message, and their typed name, email, URL, and comment text are restored — nothing is lost and they don’t leave the page. Login, Registration, and Lost Password show their errors the same way, inline on the same page, using WordPress core’s own error-display mechanism for those forms.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“GridXFlex Captcha Security” is open source software. The following people have contributed to this plugin.
Contributors
Translate “GridXFlex Captcha Security” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.0
- Initial release: image CAPTCHA + honeypot for Login, Registration, Lost Password, and Comments forms.
- Graceful fallback when the GD extension is unavailable: protected forms keep working via the honeypot layer alone instead of erroring; the admin notice re-checks live and clears itself once GD is enabled, no reactivation needed.