Advanced CAPTCHA FAQs

Short answers to common questions about Advanced CAPTCHA. Step by step guides are in Tutorials, and every field is in Configuration.

Is there a free version?

Yes. The free plugin has the Built-in CAPTCHA, Turnstile, reCAPTCHA v2 and v3 and hCaptcha on every WordPress and WooCommerce form, plus Contact Form 7, WPForms, Fluent Forms, the honeypot, the dashboard and the log. Pro adds lockouts, the block list, the card-testing shield, the email guard, country rules, smart mode, email alerts and more form plugins.

Do I need keys or an account?

Not for the Built-in CAPTCHA, which is the default. It runs on your own server and works as soon as protection is on. Cloudflare Turnstile, Google reCAPTCHA and hCaptcha each need a free account and a site key and secret key from that provider.

Is the Built-in CAPTCHA GDPR friendly?

It sets no cookies and sends nothing to a third party, so it needs no extra consent. The verification log does keep each visitor's IP and browser for 30 days by default, so mention that in your privacy policy.

Can I lock myself out of wp-admin?

A hosted provider without both keys never blocks anyone; protection pauses instead. To be safe, add your role to Trusted user roles or your IP to the Trusted List. In Pro, a lockout can be lifted from the Firewall by any other admin, or ends by itself after the lockout length.

Why does a form show no CAPTCHA?

Check four things. Protection is enabled on the General tab. The form is ticked on the Integrations screen. A hosted provider has both keys saved. You are not trusted by role or IP. With smart mode on, a visitor with a clean record sees no CAPTCHA on purpose.

How do I add the CAPTCHA to Contact Form 7?

Switch on the Contact Form 7 card on the Integrations screen. Then, in the form editor, click the Advanced CAPTCHA button and Insert Tag, or type [ddwcac_captcha] above the submit button, and save the form.

Does it work with page caching?

Yes. The Built-in CAPTCHA fetches a fresh challenge when a cached page shows an old one, and the honeypot's timer is signed so a cached copy cannot be replayed. Hosted widgets are drawn by the provider's own script on each visit.

Does it work with the Checkout block?

Yes. The CAPTCHA and the honeypot are added to the Checkout block and checked with the order, at the position set in Checkout position. In Pro, the card-testing shield and email guard run on the block checkout too.

A real customer is locked out. What do I do?

Open the Firewall and click Lift Lockout next to their IP. If the card-testing shield locked them out, Lift Lockout releases their billing email too. Trust their IP to stop it happening again.

Will it block apps that use the REST API or XML-RPC?

No. XML-RPC, REST API application passwords, WP-Cron and WP-CLI never show a widget, so the plugin never checks them.