Title: Veekay Captcha Shield Author: Velmurugan Kuberan Published: September 27, 2026 Last modified: September 27, 2026 --- Search plugins ![](https://ps.w.org/veekay-captcha-shield/assets/banner-772x250.png?rev=3715936) ![](https://ps.w.org/veekay-captcha-shield/assets/icon-256x256.png?rev=3715936) # Veekay Captcha Shield By [Velmurugan Kuberan](https://profiles.wordpress.org/vkuberan/) [Download](https://downloads.wordpress.org/plugin/veekay-captcha-shield.1.0.0.zip) * [Details](https://wordpress.org/plugins/veekay-captcha-shield/#description) * [Reviews](https://wordpress.org/plugins/veekay-captcha-shield/#reviews) * [Installation](https://wordpress.org/plugins/veekay-captcha-shield/#installation) * [Development](https://wordpress.org/plugins/veekay-captcha-shield/#developers) [Support](https://wordpress.org/support/plugin/veekay-captcha-shield/) ## Description Veekay Captcha Shield protects selected WordPress and WooCommerce forms using configurable CAPTCHA providers. Choose a global default provider, then optionally use a different provider for individual forms or disable CAPTCHA for specific forms. **Supported providers** * Cloudflare Turnstile — Managed, Non-Interactive, Invisible * Google reCAPTCHA Enterprise — Score-based, Checkbox, Invisible * hCaptcha — Checkbox, Invisible **Supported WordPress forms** * Login * Registration * Lost password * Comments **Supported WooCommerce forms** * Login * Registration * Lost password * Product reviews * Classic checkout * Checkout Block WooCommerce is optional. WordPress form protection remains available when WooCommerce is not active. WooCommerce 10.1.0 or newer is required when WooCommerce protection is used. **Configuration** Veekay Captcha Shield provides one settings page under **Settings Veekay Captcha Shield**. The General tab lets you: * choose a global default provider; * use the global default for individual forms; * select a different provider for an individual form; * disable CAPTCHA globally or for an individual form. Separate settings tabs are available for Cloudflare Turnstile, Google reCAPTCHA Enterprise, and hCaptcha. The Status tab compares the current PHP, WordPress, and WooCommerce versions with the minimum versions supported by Veekay Captcha Shield. **Security and verification** * CAPTCHA verification is performed server-side. * Protected forms fail closed when required verification cannot be completed. * Submitted CAPTCHA tokens are treated as untrusted input and are not stored. * Provider secret credentials remain server-side. * Raw provider errors, tokens, credentials, and complete provider responses are not exposed to visitors. * Only the effective CAPTCHA provider is loaded for a protected form. **Documentation** Detailed setup, provider configuration, form guides, and troubleshooting documentation: [Veekay Captcha Shield documentation](https://velukuberan.github.io/veekay-captcha-shield/) Project source and technical documentation: [Veekay Captcha Shield on GitHub](https://github.com/velukuberan/veekay-captcha-shield) ### External services Veekay Captcha Shield integrates with third-party CAPTCHA services. No CAPTCHA provider is contacted unless a site administrator configures that provider and selects it for a protected form. When a configured provider is used, its browser-side CAPTCHA service may process information directly from the visitor’s browser according to that provider’s own policies. When a protected action is submitted, Veekay Captcha Shield sends CAPTCHA verification information to the selected provider for verification. ### Cloudflare Turnstile When Cloudflare Turnstile protects a form, the Turnstile browser service is loaded so Cloudflare can perform its CAPTCHA challenge and generate a verification token. When the protected form is submitted, Veekay Captcha Shield sends the generated token and the configured secret key to Cloudflare’s Siteverify service. The visitor’s IP address may also be included when available. No form-field contents are intentionally included by Veekay Captcha Shield in the server-side Siteverify request. Service: [Cloudflare Turnstile](https://www.cloudflare.com/products/turnstile/) Turnstile documentation: [Cloudflare Turnstile documentation](https://developers.cloudflare.com/turnstile/) Turnstile Privacy Addendum: [Cloudflare Turnstile Privacy Addendum](https://www.cloudflare.com/turnstile-privacy-policy/) Cloudflare terms: [Cloudflare Terms](https://www.cloudflare.com/website-terms/) ### Google reCAPTCHA Enterprise When Google reCAPTCHA protects a form, Google’s reCAPTCHA browser service is used to generate a CAPTCHA token. When the protected form is submitted, Veekay Captcha Shield creates a Google reCAPTCHA Enterprise assessment. The assessment can include: * the generated CAPTCHA token; * the configured site key; * the visitor’s IP address when available; * the visitor’s user agent when available; * the expected CAPTCHA action when applicable. The Google Cloud project ID and configured API key are used to authenticate the assessment request. Service: [Google reCAPTCHA Enterprise](https://cloud.google.com/security/products/recaptcha) Documentation: [Google reCAPTCHA Enterprise documentation](https://cloud.google.com/recaptcha/docs) Google Cloud Terms of Service: [Google Cloud Terms of Service](https://cloud.google.com/terms) Google Cloud privacy information: [Google Cloud Privacy](https://cloud.google.com/privacy) ### hCaptcha When hCaptcha protects a form, the hCaptcha browser service is loaded so hCaptcha can perform its challenge and generate a verification token. When the protected form is submitted, Veekay Captcha Shield sends the generated token, configured site key, and configured secret key to hCaptcha’s Siteverify service. The visitor’s IP address may also be included when available. No form-field contents are intentionally included by Veekay Captcha Shield in the server-side Siteverify request. Service: [hCaptcha](https://www.hcaptcha.com/) Documentation: [hCaptcha documentation](https://docs.hcaptcha.com/) Privacy Policy: [hCaptcha Privacy Policy](https://www.hcaptcha.com/privacy) Terms of Service: [hCaptcha Terms of Service](https://www.hcaptcha.com/terms) Site owners are responsible for reviewing the terms, privacy requirements, and configuration requirements of the CAPTCHA provider they choose to use. ### Support Please report bugs and technical issues at: [Report an issue on GitHub](https://github.com/velukuberan/veekay-captcha-shield/issues) User documentation and troubleshooting guides are available at: [Veekay Captcha Shield documentation](https://velukuberan.github.io/veekay-captcha-shield/) ## Screenshots [⌊General settings with global provider selection and per-form CAPTCHA overrides.⌉⌊ General settings with global provider selection and per-form CAPTCHA overrides.⌉[ General settings with global provider selection and per-form CAPTCHA overrides. [⌊Cloudflare Turnstile site key, secret key, and widget mode configuration.⌉⌊Cloudflare Turnstile site key, secret key, and widget mode configuration.⌉[ Cloudflare Turnstile site key, secret key, and widget mode configuration. [⌊Google reCAPTCHA Enterprise project credentials, mode, and minimum-score configuration.⌉⌊ Google reCAPTCHA Enterprise project credentials, mode, and minimum-score configuration .⌉[ Google reCAPTCHA Enterprise project credentials, mode, and minimum-score configuration. [⌊hCaptcha site key, secret key, and display-mode configuration.⌉⌊hCaptcha site key, secret key, and display-mode configuration.⌉[ hCaptcha site key, secret key, and display-mode configuration. [⌊CAPTCHA protection on a WordPress login form.⌉⌊CAPTCHA protection on a WordPress login form.⌉[ CAPTCHA protection on a WordPress login form. [⌊CAPTCHA protection on a WooCommerce account form.⌉⌊CAPTCHA protection on a WooCommerce account form.⌉[ CAPTCHA protection on a WooCommerce account form. [⌊CAPTCHA protection on WooCommerce checkout.⌉⌊CAPTCHA protection on WooCommerce checkout.⌉[ CAPTCHA protection on WooCommerce checkout. ## Installation 1. Install **Veekay Captcha Shield** from **Plugins Add New**, or upload the plugin ZIP package using **Plugins Add New Upload Plugin**. 2. Activate **Veekay Captcha Shield**. 3. Go to **Settings Veekay Captcha Shield**. 4. Configure the credentials for at least one CAPTCHA provider. 5. On the General tab, select the provider you want to use as the global default. 6. Optionally override or disable CAPTCHA for individual WordPress or WooCommerce forms. 7. Test the protected forms on your site before relying on them in production. **Provider setup** Cloudflare Turnstile: [Cloudflare Turnstile dashboard](https://dash.cloudflare.com/?to=/:account/turnstile) Google reCAPTCHA Enterprise: [Google reCAPTCHA Enterprise](https://cloud.google.com/security/products/recaptcha) hCaptcha: [hCaptcha](https://www.hcaptcha.com/) Detailed setup guides are available at: [Veekay Captcha Shield documentation](https://velukuberan.github.io/veekay-captcha-shield/) ## FAQ ### Which CAPTCHA providers are supported? Veekay Captcha Shield supports Cloudflare Turnstile, Google reCAPTCHA Enterprise, and hCaptcha. Cloudflare Turnstile supports Managed, Non-Interactive, and Invisible modes. Google reCAPTCHA Enterprise supports Score-based, Checkbox, and Invisible modes. hCaptcha supports Checkbox and Invisible display modes. ### Which provider should I use? The best provider depends on your requirements. Cloudflare Turnstile supports Managed, Non-Interactive, and Invisible modes, with Managed as the default mode in Veekay Captcha Shield. Google reCAPTCHA Enterprise supports Score-based, Checkbox, and Invisible modes using Google Cloud reCAPTCHA assessments. hCaptcha provides Checkbox and Invisible display modes. You can also use different providers for different forms. ### Can I use multiple providers at the same time? Yes. You choose one global default provider, but each supported form can use the global default, select a different provider, or disable CAPTCHA. Only the provider configured for a particular protected form is used for that form. ### Does this plugin work without WooCommerce? Yes. WooCommerce is optional. WordPress login, registration, lost password, and comment protection remain available when WooCommerce is not installed or active. ### Which WooCommerce versions are supported? WooCommerce 10.1.0 or newer is required for WooCommerce protection. ### Does this plugin support WooCommerce Classic Checkout? Yes. Veekay Captcha Shield integrates with the traditional WooCommerce Classic Checkout flow and preserves CAPTCHA protection when WooCommerce updates checkout content through AJAX. ### Does this plugin support WooCommerce Checkout Block? Yes. Veekay Captcha Shield supports WooCommerce Checkout Block using the Store API checkout flow. CAPTCHA token data is passed through WooCommerce checkout extension data and verified server-side before checkout completes. Classic Checkout and Checkout Block use the same WooCommerce checkout CAPTCHA setting. ### Are WooCommerce product reviews the same setting as WordPress comments? No. WooCommerce product reviews are independently configurable from WordPress comments. ### Does this plugin store submitted CAPTCHA tokens? No. CAPTCHA tokens are used for provider verification and are not persisted by Veekay Captcha Shield. ### What happens if the CAPTCHA provider cannot be reached? Protected forms fail closed when required verification cannot be completed. Visitors receive a plugin-owned message asking them to try again. Raw provider errors and technical responses are not exposed. ### Does deactivating the plugin remove my settings? No. Deactivating Veekay Captcha Shield preserves its settings, credentials, global default, per-form overrides, and provider configuration. ### Does uninstalling the plugin remove my settings? Yes. Uninstalling Veekay Captcha Shield permanently removes plugin-owned data, including credentials, global defaults, per-form settings, provider settings, transients, and caches. Uninstallation does not contact external CAPTCHA providers or revoke credentials stored with those providers. ### Does Veekay Captcha Shield use external services? Yes. CAPTCHA protection depends on the external provider selected for a protected form. When a provider is enabled, its official browser-side CAPTCHA service may be loaded on pages containing a protected form. When the form is submitted, CAPTCHA verification data is sent to that provider for server-side verification. See the **External services** section below for details. ### Where can I find detailed setup instructions? User documentation is available at: [Veekay Captcha Shield documentation](https://velukuberan.github.io/veekay-captcha-shield/) ## Reviews There are no reviews for this plugin. ## Contributors & Developers “Veekay Captcha Shield” is open source software. The following people have contributed to this plugin. Contributors * [ Velmurugan Kuberan ](https://profiles.wordpress.org/vkuberan/) [Translate “Veekay Captcha Shield” into your language.](https://translate.wordpress.org/projects/wp-plugins/veekay-captcha-shield) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/veekay-captcha-shield/), check out the [SVN repository](https://plugins.svn.wordpress.org/veekay-captcha-shield/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/veekay-captcha-shield/) by [RSS](https://plugins.trac.wordpress.org/log/veekay-captcha-shield/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First stable release. * Added CAPTCHA protection for WordPress login, registration, lost password, and comments. * Added WooCommerce protection for login, registration, lost password, product reviews, Classic Checkout, and Checkout Block. * Added Cloudflare Turnstile support for Managed, Non-Interactive, and Invisible modes. * Added Google reCAPTCHA Enterprise support for Score-based, Checkbox, and Invisible modes. * Added hCaptcha support for Checkbox and Invisible modes. * Added global provider selection and independent per-form provider overrides. * Added server-side verification with shared verification results. * Added independent WooCommerce product-review configuration. * Added Classic Checkout AJAX rehydration. * Added Checkout Block Store API integration. * Added admin environment compatibility status. * Added production release packaging with minified frontend assets. * Added translation support and translation-template generation. #### 0.1.0-beta1 * Initial public beta. * Added Cloudflare Turnstile, Google reCAPTCHA Enterprise, and hCaptcha providers. * Added WordPress login, registration, lost password, and comment protection. * Added server-side verification using a common verification-result model. * Added global and per-form CAPTCHA configuration. ## Meta * Version **1.0.0** * Last updated **2 days ago** * Active installations **Fewer than 10** * WordPress version ** 6.7 or higher ** * Tested up to **7.1.2** * PHP version ** 8.1 or higher ** * Tags * [captcha](https://wordpress.org/plugins/tags/captcha/)[hcaptcha](https://wordpress.org/plugins/tags/hcaptcha/) [recaptcha](https://wordpress.org/plugins/tags/recaptcha/)[turnstile](https://wordpress.org/plugins/tags/turnstile/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/veekay-captcha-shield/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/veekay-captcha-shield/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/veekay-captcha-shield/reviews/) ## Contributors * [ Velmurugan Kuberan ](https://profiles.wordpress.org/vkuberan/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/veekay-captcha-shield/)