Description
Stop spam without annoying your visitors.
Gatekeep is an invisible CAPTCHA and anti-spam plugin. It stops spam in Contact Form 7, WPForms, Elementor forms, Gravity Forms, WooCommerce checkout, comments, login and registration – with no puzzle for real people to solve, no Google account and no API keys.
Gatekeep protects virtually every form on your WordPress site – not just contact forms.
Whether visitors are logging in, registering, checking out, leaving comments or submitting a form you wrote yourself, Gatekeep quietly analyses every submission and stops suspicious activity before it reaches your inbox.
Unlike traditional CAPTCHA plugins, Gatekeep uses risk scoring, honeypots, timing analysis, rate limiting and a dozen other signals to detect bots with almost no friction for real people. Most visitors never see a challenge at all.
Every form, not just one
- Contact forms
- Login, registration and password reset
- WooCommerce checkout and account creation
- Comments
- BuddyPress and bbPress
- Membership and LMS plugins
- Page-builder forms
- Custom-coded forms – two function calls, or none at all with the universal guard
CAPTCHA for Contact Form 7 – without the CAPTCHA
Searching for a Contact Form 7 CAPTCHA usually means one thing: the form is drowning in spam. Gatekeep protects CF7 the moment it is activated – including the AJAX submission path most honeypot plugins miss – with nothing visible added to the form. The same is true for WPForms, Gravity Forms, Fluent Forms, Formidable, Ninja Forms, Elementor forms and the WooCommerce checkout: install, click Protect my website, done. If you specifically want a visible CAPTCHA on your CF7 form, five self-hosted ones are included – maths, image, checkbox, slide-to-confirm and invisible proof-of-work – with no Google account and no site keys. reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile and Friendly Captcha work too, if you already use one.
What it caught that other filters did not
Every anti-spam plugin reports what it blocked. None report what they missed – which is the number that actually tells you whether you are protected.
Gatekeep records every submission, clean ones included, so its totals have a denominator: not “12 blocked” but “12 blocked of 4,310”. Monitor Mode goes further and scores submissions without blocking any, alongside whatever protection you already run, so you can read a week of real verdicts before changing anything. Nothing else on the plugin directory will tell you what your current filter is letting through.
Signals a human spammer cannot avoid
Most anti-spam checks measure how a form was submitted – speed, tokens, hidden fields. Someone typing at human speed passes all of them. Gatekeep also reads what was sent:
- Imitating sender domains. Mail from
search-yoursite.comwhen you areyoursite.com. Nobody legitimate writes to you from a domain built out of yours. - Disguised web addresses. “example dot com”, “example[.]org”, “hxxps://” – written that way to slip past filters, and scored precisely because honest correspondents never do it.
- Link density. A short message that is mostly links.
- Repeated messages. The same pitch arriving again and again, recognised even when names, numbers and links are varied between sends.
- Malformed payloads. Submissions carrying hundreds of fields or nested absurdly deep to push the real message past a scanner.
- Self-promoting comments. A comment whose author name, website, email address and body all advertise the same site. Doubtful comments go to your Spam folder rather than onto the page, and anything you mark as spam teaches Gatekeep the sites it was promoting.
Smarter than a CAPTCHA
Traditional captcha asks everyone to prove they are human. Gatekeep asks the submission instead, scoring signals the visitor never sees: honeypot traps, impossible submission speed, disposable email addresses, scripted HTTP clients and headless browsers, rate limits, invalid form tokens, missing browser headers and invisible link traps.
Only ambiguous submissions ever meet a challenge – and if you want one, five self-hosted options need no account and no keys.
Monitor Mode: prove it is safe before it blocks
Losing a real customer costs more than receiving spam. So Gatekeep starts in Monitor Mode: for the first week it watches, scores, logs and explains every decision without blocking anything. You switch enforcement on when the verdicts look right.
More than spam protection
A 17-point security audit checks for weak configuration – default admin accounts, unrotated salts, exposed config backups, the built-in file editor, XML-RPC, missing HTTPS, end-of-life PHP, pending updates and dormant plugins. Every finding explains what to do; nothing is changed automatically.
A security event log records who changed what: role changes, sign-ins and failures, plugin and theme changes, password and email changes, and critical settings.
Features
- Intelligent risk scoring rather than puzzles
- Universal form protection, including custom-coded forms
- Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Formidable, Ninja Forms, MetForm
- WooCommerce, BuddyPress, bbPress, MemberDash, Academy LMS, Bloom
- Divi 4 and 5, Elementor Pro, Bricks, Avada, Thrive, WPBakery, Oxygen, Beaver Builder
- Honeypot, timing analysis, rate limiting, disposable email detection
- Five self-hosted CAPTCHA options – maths, image, checkbox, slide-to-confirm and proof-of-work
- Google reCAPTCHA v2 and v3, hCaptcha, Cloudflare Turnstile and Friendly Captcha supported if you already use them
- Login, registration and comment protection
- Security audit and security event log
- Developer API and shortcode
- Privacy friendly – hashed IP addresses, no third-party tracking
- No API keys required
- Works with page caching
- No JavaScript in the default configuration
Switching from a CAPTCHA or another anti-spam plugin?
Coming from reCAPTCHA, hCaptcha or Turnstile: keep it, install Gatekeep in Monitor Mode beside it, and watch the log for a fortnight. You will see exactly what your captcha lets through – measured on your own traffic, not claimed by a vendor. Most sites then retire the puzzle; Gatekeep even ships a reCAPTCHA-compatible siteverify endpoint so custom code can switch by changing one URL.
Coming from Akismet or another comment filter: they classify comment text; Gatekeep protects the forms they never see – registration, login, checkout, contact. The two can run together, and the Compatibility screen shows the overlap so it stays a decision, not an accident.
Coming from a honeypot plugin: Gatekeep’s honeypot uses a field name derived from your own site’s salts, so bots cannot learn it elsewhere – and it is one signal of a dozen rather than the whole defence.
Measured, not promised
- ~380 bytes added to a form, no JavaScript by default
- Blocked submissions decided in under 5 ms
- 1,200+ automated assertions pass on every release, on WordPress and WooCommerce current versions
- Nothing loads for a visitor except what a page view needs – admin, licensing and hardening code stay out of the way
Free forever, and what Pro adds
Everything that is code is free – and the code agrees. The engine, all 33 integrations, Monitor Mode, the activity log, the dashboard health score, the 17-point security audit, protection profiles, the coexistence report, IP and keyword rules, advanced signals, settings export/import and every CAPTCHA option including the image one: free, with no licence prompt anywhere.
Gatekeep Pro is a separate plugin you download from your gatekeepwp.com account and install like any other. It adds the live spam-domain feed refreshed daily, card-testing protection for WooCommerce, the Fortify hardening pack, country rules, stored submissions with CSV export and signed webhooks, plus priority support. This plugin never downloads or installs other software. See plans and pricing.
Your forms never depend on Pro: everything in this plugin keeps working whether or not Pro is installed or licensed.
Third-party assets
Two font families are bundled and served from the plugin folder, so no
visitor request is ever made to a font CDN:
- IBM Plex Sans – Copyright 2017 IBM Corp, SIL Open Font License v1.1 – https://github.com/IBM/plex
- Bricolage Grotesque – Copyright 2022 The Bricolage Project Authors, SIL Open Font License v1.1 – https://github.com/ateliertriay/bricolage
Both licences are GPL-compatible. Full attribution is in assets/FONT-LICENSES.txt.
Friendly Captcha SDK (assets/vendor/friendly-captcha/site.min.js and site.compat.min.js)
Version 1.0.2, Mozilla Public License 2.0, unmodified.
Source: https://github.com/FriendlyCaptcha/friendly-captcha-sdk
Licence text: assets/vendor/friendly-captcha/LICENSE.txt
Bundled locally rather than loaded from a CDN.
External services
Gatekeep makes no outbound requests in its default configuration. Nothing below happens unless you switch that feature on yourself.
Each service is listed with what it is, what is sent, when it is sent, and links to its terms and privacy policy.
1. Google reCAPTCHA (optional, off by default)
What it is: Google’s CAPTCHA service. Used only if you select reCAPTCHA as a challenge provider and enter your own site and secret keys.
What is sent, and when: when a visitor loads a page carrying a form you have enabled reCAPTCHA on, their browser loads Google’s widget script from www.google.com and Google receives the visitor’s IP address, browser information and interaction data. When that form is submitted, your server sends the challenge token, your secret key and the visitor’s IP address to www.google.com to verify the answer. No form content is sent.
Terms of service: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy
2. hCaptcha (optional, off by default)
What it is: an alternative CAPTCHA service. Used only if you select hCaptcha and enter your own keys.
What is sent, and when: on a page with an hCaptcha-enabled form, the visitor’s browser loads the widget from js.hcaptcha.com and hCaptcha receives their IP address, browser information and interaction data. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to api.hcaptcha.com. No form content is sent.
Terms of service: https://www.hcaptcha.com/terms
Privacy policy: https://www.hcaptcha.com/privacy
3. Cloudflare Turnstile (optional, off by default)
What it is: Cloudflare’s CAPTCHA alternative. Used only if you select Turnstile and enter your own keys.
What is sent, and when: on a page with a Turnstile-enabled form, the visitor’s browser loads the widget from challenges.cloudflare.com and Cloudflare receives their IP address and browser information. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to challenges.cloudflare.com to verify it. No form content is sent.
Terms of service: https://www.cloudflare.com/website-terms/
Privacy policy: https://www.cloudflare.com/privacypolicy/
4. Friendly Captcha (optional, off by default)
What it is: a proof-of-work CAPTCHA service. Used only if you select Friendly Captcha and enter your own keys.
The widget script is bundled with this plugin and served from your own site, so no script is loaded from a third party. Verification is still performed by Friendly Captcha, because that is the service being used.
What is sent, and when: when a visitor solves the challenge, their browser contacts Friendly Captcha’s puzzle endpoint. On submission, your server sends the challenge response and your API key to global.frcapi.com, or to eu.frcapi.com if you select their EU-only infrastructure. No form content is sent.
Terms of service: https://friendlycaptcha.com/legal/terms/
Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/
5. Gatekeep licence and threat list at gatekeepwp.com (optional, off by default)
What it is: the licensing and threat-list service operated by the plugin author. It is contacted only if you buy a licence and enter the key. Without a key it is never contacted.
What is sent, and when: on licence activation, and once daily while a licence is active, your site sends the licence key and your site address to gatekeepwp.com to validate the licence and to download the current threat list. This is a server-to-server request. No visitor data, no IP addresses and no form content are ever sent.
Terms of service: https://gatekeepwp.com/terms/
Privacy policy: https://gatekeepwp.com/privacy/
6. ipapi.co (optional, off by default, requires the Pro companion)
What it is: a geolocation lookup used only if you enable “Look up country when the host does not provide it” and the Gatekeep Pro companion is installed. The free plugin never contacts this service.
What is sent, and when: the visitor’s IP address is sent server-to-server to ipapi.co so a country code can be cached for a day. No form content is sent. Sign-in attempts are never blocked by country.
Terms of service: https://ipapi.co/terms/
Privacy policy: https://ipapi.co/privacy/
Screenshots
Installation
- Install through Plugins Add New, or upload the folder to
/wp-content/plugins/. - Activate. Gatekeep finds the forms on your site by itself — there is nothing to add to a form, no key to paste and no account to create.
- Open Gatekeep in the admin menu. The first screen shows what it found and what it recommends.
- Leave Monitor Mode on for a fortnight if you would rather watch before it blocks anything, then turn blocking on when you are happy with the verdicts.
FAQ
-
Will it conflict with what I already have?
-
There is a Compatibility screen that answers this directly. It lists every form
plugin and builder it found, names any captcha your plugins already have switched
on, names any other anti-spam plugin that is running, and says whether anything
actually conflicts.If your form plugin already has reCAPTCHA, Gatekeep will not add a second
challenge to those forms. If another anti-spam plugin is active, both can run –
and the screen suggests leaving Monitor Mode on for the first couple of days, so
you can see whether the two ever disagree before either blocks anything. -
Will this block real customers?
-
Not while Monitor Mode is on, and that is the default. Rate limiting is also skipped at WooCommerce checkout so shared IP addresses cannot lock out a sale.
-
Does it slow my site down?
-
The default configuration adds no JavaScript and makes no external requests. Assets load only on pages where a protected form is actually rendered.
-
Is it accessible?
-
The honeypot is hidden from assistive technology and removed from the tab order. The default configuration presents no visual puzzle at all.
-
How do I stop Contact Form 7 spam without a CAPTCHA?
-
Install Gatekeep and click Protect my website. CF7 is one of the 33 built-in integrations – including its AJAX submission path, which honeypot-only plugins often miss. No markup changes, no keys.
-
How do I add a CAPTCHA to Contact Form 7?
-
Activate Gatekeep and your CF7 forms are already protected – no shortcode, no [recaptcha] tag, no keys. To show a visible CAPTCHA as well, go to Gatekeep > Captcha and pick maths, image, checkbox or slide-to-confirm – or reCAPTCHA, hCaptcha or Turnstile with your own keys. It appears just above the Send button on every Contact Form 7 form.
-
Does it work with Elementor forms and other page builders?
-
Yes: Elementor Pro forms, Divi 4 and 5, Bricks, Avada, Thrive, WPBakery, Oxygen, Beaver Builder and SeedProd are covered, plus a universal guard for anything unusual.
-
Does it protect the WooCommerce checkout?
-
Yes, with a dedicated shop profile: nothing visible in front of a buyer, tolerance for password-manager-speed submissions, and rate limits that a busy shop will not trip.
-
Is Gatekeep GDPR friendly?
-
Decisions are made on your own server and nothing is sent to a third party. Visitor IP addresses are stored hashed, and the default configuration sets no cookies and loads no external scripts.
-
Is Gatekeep an alternative to Akismet or reCAPTCHA?
-
For form, registration, login and checkout protection, yes. For classifying comment text specifically, Akismet’s twenty years of data remain excellent – many sites run both, and Gatekeep will happily coexist and show you the overlap.
-
How do I stop comment spam?
-
Activate Gatekeep – comments are protected straight away. On top of the bot checks, it reads each comment for self-promotion (an author name, website, email address and message all advertising the same site), for writing systems your site does not use, and for long comments that say nothing about the post. Doubtful comments go to Comments > Spam instead of being published, so nobody genuine is turned away.
-
How do I stop WPForms spam?
-
Activate Gatekeep. WPForms is detected and protected automatically with an invisible honeypot, timing checks and risk scoring – nothing is added to the form for visitors to see. A visible CAPTCHA is available if you want one.
-
Does Gatekeep use a honeypot?
-
Yes – an invisible honeypot field is one of more than a dozen signals. On its own a honeypot only catches the simplest bots, so Gatekeep combines it with submission timing, form tokens, rate limits, disposable-email detection and content checks.
-
Do I need an account or API key?
-
No. The free plugin works completely offline with no account, no keys and no external service.
Reviews
There are no reviews for this plugin.
Contributors and Developers
“Gatekeep – Universal CAPTCHA & Anti-Spam for All Forms & Comments” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Gatekeep – Universal CAPTCHA & Anti-Spam for All Forms & Comments” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Change Log
1.2
A cleaner admin.
- New: a header on every Gatekeep screen that says what Gatekeep is doing right now – blocking, watching only, or paused – and how much it blocked this week.
- New: the tab strip runs across the top instead of down the side, so every screen gets the full width. The WordPress sidebar lists the five screens you open most; the rest are one click away on the strip.
- New: the Activity log can be filtered to blocked, challenged or allowed submissions, shows form names in plain words, and reads as cards on a phone.
- New: the Dashboard leads with what was stopped. The protection score follows, showing what needs fixing and folding away the checks that already pass.
- New: the Protection tab is split into short titled sections, and every switch says On or Off.
- New: the Save button stays in reach on long settings screens.
- Fixed: the 7-day counts were measured against UTC while the log is written in your site’s time zone, so a site far from UTC could count the wrong day’s entries.
- Fixed: wide tables no longer push the screen sideways on laptops and tablets.
- Nothing about how submissions are scored has changed.
1.1.1
- The plugin name is back to “Gatekeep – CAPTCHA & Spam Protection”. No code changes.
1.1
Comment spam.
- New: comments are read for self-promotion. A comment that links or names the commenter’s own website – the name “bda555”, the site bda555.com, the address admin@bda555.com and a link reading “bda555” in the body – is scored for it. A website in the Website field on its own is never held against anyone.
- New: comments written in a writing system your site does not use are scored. The script of your site language is always accepted, Indian sites accept every Indic script, and you can add others on the Protection tab.
- New: long comments that share no meaningful word with the post they were left on are scored, lightly. This never acts on its own.
- New: when you mark a comment as Spam, the sites it promoted are remembered for a year and count heavily against the next comment promoting them. Rescuing the comment from Spam forgets them again.
- New: doubtful comments go to Comments > Spam instead of being published. Previously, with no challenge provider set (the default), a comment that would have been challenged was published – including comments posted straight to wp-comments-post.php by a bot that never loaded the page. Nothing is turned away; you can approve anything Gatekeep gets wrong. Applies in Monitor Mode too. Can be switched off on the Protection tab.
- New: a short message that packs in several links and disguises one of them (“example[.]org”, “example dot com”) is scored as one strong signal and blocked. Scored separately the two came to 79, which was allowed on the Relaxed and eCommerce settings.
- New: an Upgrade to Pro item at the foot of the Gatekeep menu, linking to a page that lists what the separate Pro plugin adds. It disappears once Pro is active. Nothing in this plugin is locked.
- Fix: an ordinary email address after the word “at” (“email me at name@example.com”) was treated as a disguised address and scored 60.
- Fix: pingbacks and trackbacks are no longer scored for missing a form token they can never have.
- Fix: “Check the field set matches” and “Count whole networks” could be switched on but not off again – unticking them did not save.
- Fix: Diagnostics no longer warns about a “Licence check” task that this plugin does not have.
1.0
First public release.
- Local features (security score, image challenge, allowlists, blocked terms, MX checks, the bundled disposable-domain list, the security audit and the event log) are free in both code and documentation. A licence only buys hosted services and the optional companion plugin, which you install yourself.
- The universal form guard uses WordPress 6.9’s template enhancement output buffer when available. On older WordPress it wraps the template in a paired
ob_start()/ob_get_clean()in the same function, and includes the theme viaload_template()so$postand$wp_querystay in scope. - Directory-listing advice no longer writes
index.phpor.htaccessoutside a plugin-specific uploads folder. - Field HTML is escaped with
wp_kses()at every output sink, includingrender_block/the_contentfilter callbacks. -
Compatibility tracking no longer reads visitor POST or writes transients from the front end.
-
Pro entitlement can no longer be granted from the site itself. The
gatekeep_can_usefilter may now only restrict a capability, never grant one; developers who need an unlocked build locally haveGATEKEEP_DEV_UNLOCK, which refuses to run on anything that looks like a production hostname. - Licence answers from the licence server are verified with an Ed25519 signature and re-checked on every capability query, so editing the stored licence record by hand no longer unlocks anything.
- Disposable-address checks and MX checks moved to the free tier. Both run entirely on your own server and the data file already ships in this package, so gating them was never defensible.
- Uninstalling now removes everything the plugin created, including the visitor-reputation and domain tables and the stored licence record.
-
On multisite, deleting a site now drops that site’s Gatekeep tables instead of leaving them behind.
-
Protects every entry point, not just contact forms: 33 form plugins, page-builder forms, WordPress login, registration, password reset and comments, WooCommerce checkout and account creation, plus a universal guard for forms belonging to no plugin at all.
- Over twenty scoring signals. Honeypot, submission timing, form tokens, rate and subnet limits, request shape, field integrity, visitor reputation, disposable and role addresses, MX checks, imitating sender domains, disguised web addresses, link density, repeated messages and malformed payloads.
- Monitor Mode: score submissions without blocking any, alongside whatever protection you already run, and see what it is letting through.
- Every submission recorded, clean ones included, so totals have a denominator — not “12 blocked” but “12 blocked of 4,310”.
- Every verdict explained by the signals behind it, in plain sentences.
- Eight challenge options if you want a visible check, four of them self-hosted with no keys and no third party.
- Nothing leaves your site. Scoring happens on your own server.
- Honest about what it did not check. If your challenge provider is unreachable, submissions are still allowed so your forms keep working — but the log records that they were allowed WITHOUT verification rather than claiming they passed, and Diagnostics counts it.
- Correct under load. The repeat-message and token counters are incremented by the database itself rather than read-modify-written, so a burst of traffic cannot make the counts drift — which matters because a burst is exactly when those checks are needed.
- Bounded under attack. Storage a spammer can force Gatekeep to use is capped: message and token memory live in fixed-size stores rather than growing a row per submission, the activity log has a row ceiling as well as a retention period, and there is a limit on how much text one submission can make the server read.
- Understands what sits in front of your site. Behind Cloudflare, a load balancer or a reverse proxy, Gatekeep identifies the real visitor rather than the proxy — so rate limits and reputation apply to one person instead of your entire audience. Diagnostics tells you if it needs setting.
- Clears WP Rocket, W3 Total Cache, LiteSpeed, SG Optimizer, WP Super Cache and other page caches on activation, on update and whenever you change a setting — so a stored copy of yesterday’s page never makes a working plugin look broken. There is a manual button on Diagnostics, and it tells you plainly if a cache could not be reached rather than claiming success.