Title: Free Captcha Protection by MJ Studios Author: MJ Studios Published: October 22, 2026 Last modified: October 22, 2026 --- Search plugins ![](https://ps.w.org/mjs-captcha-protection/assets/banner-772x250.png?rev=3759750) ![](https://ps.w.org/mjs-captcha-protection/assets/icon.svg?rev=3759709) # Free Captcha Protection by MJ Studios By [MJ Studios](https://profiles.wordpress.org/mrnbdyyy/) [Download](https://downloads.wordpress.org/plugin/mjs-captcha-protection.1.1.6.zip) * [Details](https://wordpress.org/plugins/mjs-captcha-protection/#description) * [Reviews](https://wordpress.org/plugins/mjs-captcha-protection/#reviews) * [Installation](https://wordpress.org/plugins/mjs-captcha-protection/#installation) * [Development](https://wordpress.org/plugins/mjs-captcha-protection/#developers) [Support](https://wordpress.org/support/plugin/mjs-captcha-protection/) ## Description Most captchas stop spam by making your visitors do the work. Tick the box, then pick out every traffic light anyway. Free Captcha Protection hands that job to the visitor’s browser, so people just fill in your form and press send. As soon as someone starts using a protected form, their browser works through a small proof-of-work calculation in the background. On most devices it takes about a second, usually while the person is still typing. Bots that post straight to your forms never run it, so they arrive without a valid answer and get turned away. All of it happens on your own server. The plugin never talks to Google, Cloudflare or anyone else, and it sets no cookies. There’s no account to create and no API key to paste in. It’s free. We made it for the client sites we build and look after at MJ Studios. Now you can use it on yours. #### Replaces Google reCAPTCHA, Cloudflare Turnstile and hCaptcha Google reCAPTCHA, Cloudflare Turnstile, hCaptcha and Friendly Captcha all ask you for an account and a site key, and each loads its script from the provider’s servers. This plugin does the same job from your own server. It’s free, and there’s nothing to sign up for. Switch the old captcha off, activate this one, and the forms below are protected straight away. You don’t have to edit a single form. #### Works with the forms you already have * WordPress login, registration and lost password * Comments * WooCommerce login, registration and lost password * WooCommerce classic checkout (off by default, one tick to turn it on) * Elementor Pro forms * Contact Form 7 * WPForms * Any other form, using the `[mjscp_captcha]` shortcode and `mjscp_verify()` Protection is on with sensible defaults from the moment you activate it. #### What your visitors notice Ideally, nothing. * Nothing loads until someone interacts with a form, so your page speed stays where it was. * The widget stays hidden and only appears if verification fails. * If someone presses submit before the answer is ready, the form waits a moment and then sends itself. * Each answer works once. The widget then fetches a fresh challenge, so AJAX forms can be sent again without a page reload. * The work runs in Web Workers using the browser’s built-in crypto, with a pure JavaScript fallback for older browsers and sites on plain HTTP. * Page caching is fine, because challenges are fetched fresh when a form is used. #### Extra checks behind the scenes * A hidden honeypot field that only bots fill in * A minimum time on the form, because nobody writes a message in half a second * A spam score that counts links in messages and notices requests with missing browser headers * Automatic IP blocking after repeated failures (by default, 5 failures in an hour earns a 24 hour block) * An allowlist for single IPs and IPv4 ranges * Support for Cloudflare and other proxies, so blocks land on the real visitor IP You can’t lock yourself out. Login forms ignore IP blocks, and an IP an administrator has used is never blocked automatically. #### See what it stopped The Overview screen shows how your forms held up over the last 7, 14 or 30 days. You get totals compared with the period before, a daily chart you can hover for each day’s numbers, the block rate, the IPs that failed most and a breakdown by form and by reason. The Activity screen lists every check, newest first, and you can filter it by result, form or IP. Blocked IPs have their own screen, where you can block an address for a day, a week, a month or for good, and lift a block again. The admin screens are part of the plugin and load nothing from outside your site, so they open quickly. They work with JavaScript switched off too. #### Privacy The plugin was designed with privacy laws such as the GDPR in mind. * It sets no cookies and stores nothing in the visitor’s browser. * It makes no requests to outside services, so visitor data stays on your server. * The verification log keeps the IP address, browser user agent, form name and result for 30 days by default. You can shorten that to one day or switch the log off. * It remembers the last 20 IP addresses your administrators used, only so it never blocks them. * It adds suggested wording for your privacy policy under Settings > Privacy. * Deleting the plugin removes its tables and settings, unless you choose to keep them. Whether your site meets the GDPR depends on far more than one plugin, so that part is still yours to check. This plugin’s share of it is small and easy to explain in your privacy policy. #### External services None. This plugin does not connect to any third-party service. #### Trademarks Google reCAPTCHA, Cloudflare Turnstile, hCaptcha, Friendly Captcha, Akismet, CleanTalk, WooCommerce, Elementor, Contact Form 7 and WPForms are trademarks of their owners. This plugin is not affiliated with or endorsed by any of them. ### Developer hooks * `mjscp_form_enabled` (filter): enable or disable a form key. * `mjscp_pre_check` (filter): short-circuit verification. * `mjscp_score` (filter): adjust the spam score. * `mjscp_error_message` (filter): change the message shown on failure. * `mjscp_is_allowlisted` (filter): allowlist an IP programmatically. * `mjscp_auto_attach_selectors` (filter): attach the widget to extra forms by CSS selector. * `mjscp_max_number` (filter): fine-tune difficulty. * `mjscp_checked` (action): runs after each verification. ## Screenshots [⌊Overview: totals against the previous period, a daily chart and the block rate.⌉⌊ Overview: totals against the previous period, a daily chart and the block rate.⌉[ Overview: totals against the previous period, a daily chart and the block rate. [⌊Activity: every check, with filters and the details of each one.⌉⌊Activity: every check, with filters and the details of each one.⌉[ Activity: every check, with filters and the details of each one. [⌊Settings: a switch for each form, showing whether its plugin is active.⌉⌊Settings: a switch for each form, showing whether its plugin is active.⌉[ Settings: a switch for each form, showing whether its plugin is active. [⌊Blocked IPs: block an address by hand or lift a block.⌉⌊Blocked IPs: block an address by hand or lift a block.⌉[ Blocked IPs: block an address by hand or lift a block. ## Installation 1. In your WordPress admin, go to Plugins > Add New Plugin, search for “Free Captcha Protection” and click Install Now. You can also upload the zip under Plugins > Add New Plugin > Upload Plugin. 2. Activate it. 3. Go to Captcha Protection > Settings and choose which forms to protect. The defaults suit most sites. If your site sits behind Cloudflare or another proxy, set “Visitor IP source” so blocking uses the real visitor IP. ## FAQ ### Can it replace Google reCAPTCHA? Yes, for the forms listed above. reCAPTCHA needs a Google account and site keys, and every check goes through Google. Turn your reCAPTCHA plugin off, activate this one, and those forms are protected. Leaving both on means your visitors still get the reCAPTCHA check, which defeats the point. ### Can it replace Cloudflare Turnstile? Yes. Turnstile is free as well, but it needs a Cloudflare account and a site key, and each check is sent to Cloudflare. This plugin checks visitors on your own server instead. Turn your Turnstile plugin off before you activate this one. ### Can it replace hCaptcha? Yes. hCaptcha needs an account and a site key, and visitors can still be asked to solve an image puzzle. This plugin never shows a puzzle, and nothing is sent to hCaptcha or anyone else. ### Is it an invisible captcha? Yes. Visitors see nothing while it works. A short message with a Retry button only appears if a check fails. ### Do I still need Akismet? Often not. This plugin stops automated submissions before they are saved. Spam typed in by real people can still get through, and that’s the kind Akismet and CleanTalk look for. You can run either of them alongside this plugin. ### Is it really free? Yes. Every feature on this page is included, with no limit on forms or submissions and no sign-up. ### Does it help with the GDPR? It’s built to collect as little as possible. Nothing leaves your server, and the only log is a short one you can cut down further or switch off. Many site owners rely on legitimate interest for this kind of security log (Recital 49 of the GDPR mentions network security). Your own setup decides that, so check with whoever handles privacy for your site. ### Does it work with page caching? Yes. Challenges come fresh from a REST endpoint when a visitor uses a form, so cached pages are fine. ### My site is behind Cloudflare. Do I need to change anything? One setting. Set “Visitor IP source” to CF-Connecting-IP. Otherwise every visitor looks like a Cloudflare server, and blocking would hit Cloudflare’s IPs instead of the spammer’s. ### What if a visitor has JavaScript turned off? Protected forms need JavaScript to produce an answer, so submissions without one are rejected. ### How can I see it working? Add `?mjscp_debug=1` to any page URL to show the widget and its status. Every verification also shows up on the Activity screen. ### How do I protect my own custom form? Place `[mjscp_captcha]` inside the form, or `echo mjscp_widget();` in PHP. When you process the form, call `mjscp_verify()`. It returns `true` or a `WP_Error`. ### Can I lock myself out? No. Login forms ignore IP blocks, and IPs that administrators have used are never blocked automatically. You still need a valid answer and the right password to log in. ### What happens to blocking if I switch the log off? Automatic blocking counts failures from the log, so it stops too. Manual blocks and the allowlist keep working. ### Does it support the WooCommerce block checkout? Not yet. The classic checkout is supported and is off by default. ### Will it slow down older phones? On medium difficulty most devices finish in about a second, usually while the visitor is still typing. Choose Low difficulty for the lightest load. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Free Captcha Protection by MJ Studios” is open source software. The following people have contributed to this plugin. Contributors * [ MJ Studios ](https://profiles.wordpress.org/mrnbdyyy/) [Translate “Free Captcha Protection by MJ Studios” into your language.](https://translate.wordpress.org/projects/wp-plugins/mjs-captcha-protection) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/mjs-captcha-protection/), check out the [SVN repository](https://plugins.svn.wordpress.org/mjs-captcha-protection/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/mjs-captcha-protection/) by [RSS](https://plugins.trac.wordpress.org/log/mjs-captcha-protection/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.1.6 * New name: Free Captcha Protection by MJ Studios. Nothing else changes, and your settings stay as they are. * The plugin now links to its home page, captcha.mjstudios.tech. * A small link in the plugin’s footer to rate it on WordPress.org. * The readme explains how to switch from another captcha service. #### 1.1.5 * Settings: forms from plugins that aren’t active now show as off and locked, with a note that they start once you activate the plugin. Your choice is kept until then. * The test view you get with ?mjscp_debug=1 now says what visitors actually see, so Invisible mode no longer looks like a visible status line. #### 1.1.4 * Removed the Plugin URI header, which pointed to the same page as Author URI. #### 1.1.3 * Corrected the contributor username in the readme. #### 1.1.2 * Activity now marks rows from an IP you’ve already blocked with “IP blocked” instead of offering to block it again. * Fixed the missing space between the two cards on the Blocked IPs screen. #### 1.1.1 * Rewrote the database queries behind the Overview and Activity screens and the uninstall routine, so Plugin Check now reports no warnings. * The screens show the same data as before, and uninstalling still removes data only when Clean uninstall is on. #### 1.1.0 * New admin design with four screens: Overview, Activity, Blocked IPs and Settings. * Overview compares totals with the previous period and adds a daily chart you can hover, the block rate and the IPs that failed most. * New Activity screen with filters, pages and the full details of each check. * Settings show whether each form’s plugin is active, and a save bar appears when you change something. * Block an IP for 24 hours, 7 days, 30 days or permanently. * One-click fix for sites behind Cloudflare. * Tested with WordPress 7.1 and PHP 7.4 to 8.5. #### 1.0.0 * First public release. ## Meta * Version **1.1.6** * Last updated **1 week ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[captcha](https://wordpress.org/plugins/tags/captcha/) [contact form](https://wordpress.org/plugins/tags/contact-form/)[spam](https://wordpress.org/plugins/tags/spam/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/mjs-captcha-protection/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/mjs-captcha-protection/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/mjs-captcha-protection/reviews/) ## Contributors * [ MJ Studios ](https://profiles.wordpress.org/mrnbdyyy/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/mjs-captcha-protection/)