Captcha by BestWebSoft – Advanced Spam Protection, Math & OCR-Friendly Captcha for Site Forms vs WPVulnerability

Captcha by BestWebSoft is the premier spam protection and security plugin for WordPress, designed to safeguard your website’s forms from spam and malicious submissions. This plugin provides robust protection for login, registration, password recovery, comments, WooCommerce checkout, and custom forms using advanced captcha solutions, including Math captcha and OCR-friendly captcha. Enhance your website’s security and user experience with versatile captcha options that are easy to set up and manage, ensuring uninterrupted protection against spam without the need for code modifications. Choose from Invisible captcha, Character recognition captcha, and Slide captcha to customize your protection strategy. Block bots effectively with powerful math-based challenges or smooth, user-friendly sliding interactions. Captcha by BestWebSoft integrates seamlessly with popular plugins and is optimized for spam protection on WordPress forms, making it ideal for WooCommerce, Contact Form 7, and other integrations. Secure your site today with a lightweight, fast, and reliable solution that prioritizes both security and user experience. Stop spam now with the most effective WordPress captcha solution! View Demo Free Features Add captcha to: Login form Registration form Reset password form Comments form Protected post password form Contact Form Car Rental V2 Pro Custom form Choose Captcha type: Invisible Character Recognition Simple math actions such as addition, subtraction, and multiplication Slide captcha Enhance captcha protection with: Letters Numbers Images Hide captcha for: Registered users in comments form Set captcha submission time limit Settings for displaying captchas by Weekdays and Hours Refresh captcha option Edit captcha title and notifications Compatible with latest WordPress version Incredibly simple settings for fast setup without modifying code Detailed step-by-step documentations and videos Multilingual and RTL ready Force Strong Passwords Pro Features All features from Free version included plus: Compatible with : Contact Form 7 (since v 3.4) Subscriber Jetpack contact form MailChimp for WordPress Ninja Forms Gravity Forms WPForms Caldera Forms Formidable Contact Form MemberPress Compatible with WooCommerce: Login form Register form Lost password form Checkout billing form Compatible with bbPress: New Topic form Reply form Compatible with BuddyPress: Registration form Comments form Create a Group form Compatible with Forums – wpForo: Login form Registration form New Topic form Reply form Compatible with Divi : Contact Form Login Form Compatible with LearnDash login: Login form Registration form Compatible with BuddyBoss: Registration form Compatible with Elementor Pro: Elementor Contact form [NEW] Compatible with BWS Login Register Form: Login form Registration form Forgot Password form Compatible with Easy Digital Downloads Form: Login form Registration form Forgot Password form Hide captcha for: Allowed IP addresses Merge IP addresses from Limit Attempts plugin with Captcha Allow List Configure all subsites on the network Captcha submission time limit for separate forms Image packages with hand-drawn digits Add and enable unlimited number of image packages at the same time Edit Slide captcha appearance Block disposable emails Add custom code via plugin settings page Get answer to your support question within one business day (Support Policy) Upgrade to Pro Now If you have feature suggestions or ideas you’d like to see in the plugin, we’d love to hear from you! Suggest a Feature Documentation & Videos [Doc] User Guide [Doc] Installation [Doc] Purchase [Video] Purchase, Installation, Configuration Tutorial [Video] User Guide Help & Support Visit our Help Center if you have any questions; our friendly Support Team is ready to assist you. Affiliate Program Earn a 20% commission by selling premium WordPress plugins and themes by BestWebSoft — Join the Affiliate Program Translation Arabic (ar_AR) (thanks to Albayan Design Hani Aladoli) Bangla (bn_BD) (thanks to SM Mehdi Akram, www.shamokaldarpon.com) Belarusian (bel) (thanks to Natasha Diatko) Brazilian Portuguese (pt_BR) (thanks to Breno Jacinto, www.iconis.org.br) Bulgarian (bg_BG) (thanks to Nick) Catalan (ca) (thanks to Psiete) Chinese (zh_CN) (thanks to TIM, Jack Chen, www.jackchen.im) Taiwan (zh_TW) (thanks to Kaiconan) Croatian (hr) (thanks to Daniel) Czech (cs_CZ) (thanks to Michal Kučera www.n0lim.it) Danish (da_DK) (thanks to Byrial Ole Jensed) Dutch (nl_NL) (thanks to Bart Duineveld) Estonian (et) (thanks to Ahto Tanner) Greek (el) (thanks to Aris, www.paraxeno.net) Farsi/Persian (fa_IR) (thanks to Mostafa Asadi, www.ma73.ir, Morteza Gholami) Finnish (fi) (thanks to Mikko Sederholm) French (fr_FR) (thanks to Martel Benjamin, Capronnier luc) German (de_DE) (thanks to Thomas Hartung, Lothar Schiborr) Hebrew (he_IL) (thanks to Sagive SEO) Hindi (hi_IN) (thanks to Outshine Solutions, www.outshinesolutions.com) Hungarian (hu_HU) (thanks to Peter Aprily) Japanese (ja) (thanks to Foken) Indonesian (id_ID) (thanks to Nasrulhaq Muiz, www.al-badar.net) Italian (it_IT) (thanks to Marco) Latvian (lv) (thanks to Juris O) Lithuanian (lt_LT) (thanks to Arnas) Norwegian (nb_NO) (thanks to Tore Hjartland) Polish (pl_PL) (thanks to Krzysztof Opuchlik) Portuguese (pt_PT) (thanks to João Paulo Antunes) Romanian (ro_RO) (thanks to Ciprian) Russian (ru_RU) Serbian (sr_RS) (thanks to Radovan Georgijevic) Slovak (sk_SK) (thanks to Branco Radenovich) Slovenian (sl_SI) (thanks to Uroš Klopčič, www.klopcic.net) Spanish (es_ES) Swedish (sv_SE) (thanks to Christer Rönningborg, Blittan) Tagalog (tl) (thanks to Roozbeh Jalali, www.languageconnect.net) Turkish (tr_TR) (thanks to Can Atasever, www.canatasever.com) Ukrainian (uk) Vietnamese (vi_VN) (thanks to NDT Solutions) Some translations may be incomplete. We continuously add new features that require translation. To create or update a language pack, send the text of PO and MO files to BestWebSoft. Download the latest Poedit version here. Recommended Plugins Limit Attempts — Protect your WordPress site against brute force attacks by limiting login attempts. Updater — Automatically check and update your WordPress core, plugins, and themes to the latest versions. Contact Form — A simple and essential contact form plugin for any WordPress site. Subscriber — Add an email newsletter sign-up form to WordPress posts, pages, and widgets. Collect and manage subscriber data effectively. Credits This plugin includes a license verification mechanism to ensure the authenticity of your license key and provide access to premium features and updates. The verification process involves securely connecting to our external service hosted on the BestWebSoft website: BestWebSoft. Privacy Policy End User License Agreement

This plugin integrates with the WPVulnerability API to provide real-time vulnerability assessments for your WordPress core, plugins, themes, PHP version, Apache HTTPD, nginx, MariaDB, MySQL, ImageMagick, curl, memcached, Redis, and SQLite. It delivers detailed reports directly within your WordPress dashboard, helping you stay aware of potential security risks. Configure the plugin to send periodic notifications about your site’s security status, ensuring you remain informed without being overwhelmed. Designed for ease of use, it supports proactive security measures without storing or retrieving any personal data from your site. Data reliability The information provided by the information database comes from different sources that have been reviewed by third parties. There is no liability of any kind for the information. Act at your own risk. Using the plugin WP-CLI You can use the following WP-CLI commands to manage and check vulnerabilities: Core: wp wpvulnerability core Plugins: wp wpvulnerability plugins Themes: wp wpvulnerability themes PHP: wp wpvulnerability php Apache HTTPD: wp wpvulnerability apache nginx: wp wpvulnerability nginx MariaDB: wp wpvulnerability mariadb MySQL: wp wpvulnerability mysql ImageMagick: wp wpvulnerability imagemagick curl: wp wpvulnerability curl memcached: wp wpvulnerability memcached Redis: wp wpvulnerability redis SQLite: wp wpvulnerability sqlite To configure the plugin you can use: Hide component: wp wpvulnerability config hide [on|off] Notification email: wp wpvulnerability config email (comma separatted) Notification period: wp wpvulnerability config period Log retention: wp wpvulnerability config log-retention (in days) Cache duration: wp wpvulnerability config cache (in hours) All commands support the --format option to specify the output format: --format=table: Displays the results in a table format (default). --format=json: Displays the results in JSON format. Need help? wp wpvulnerability --help: Displays help information for WPVulnerability commands. wp wpvulnerability [command] --help: Displays help information for a WPVulnerability command. REST API The WPVulnerability plugin provides several REST API endpoints to fetch vulnerability information for different components of your WordPress site. Core: /wpvulnerability/v1/core Plugins: /wpvulnerability/v1/plugins Themes: /wpvulnerability/v1/themes PHP: /wpvulnerability/v1/php Apache HTTPD: /wpvulnerability/v1/apache nginx: /wpvulnerability/v1/nginx MariaDB: /wpvulnerability/v1/mariadb MySQL: /wpvulnerability/v1/mysql ImageMagick: /wpvulnerability/v1/imagemagick curl: /wpvulnerability/v1/curl memcached: /wpvulnerability/v1/memcached Redis: /wpvulnerability/v1/redis SQLite: /wpvulnerability/v1/sqlite The WPVulnerability REST API uses Application Passwords for authentication. You need to include a valid Application Password in the Authorization header of your requests. Example Request with Authentication curl -X GET https://example.com/wp-json/wpvulnerability/v1/plugins -u username:application_password Replace username with your WordPress username and application_password with your Application Password. Extra Configurations “From:” mail (since: 3.2.2) If, for some reason, you need the emails sent by the plugin to have a From different from the site administrator, you can change it from the wp-config.php by adding a constant: define( 'WPVULNERABILITY_MAIL', 'sender@example.com' ); If the constant is active, it will be visible in the configuration screen. Force hiding checks (since: 4.1.0) If you want to always hide a specific component, you can define a constant in wp-config.php. When set to true, the option will be checked automatically in the settings screen and the related analysis will be skipped. Example: define( 'WPVULNERABILITY_HIDE_APACHE', true ); Available constants: WPVULNERABILITY_HIDE_CORE, WPVULNERABILITY_HIDE_PLUGINS, WPVULNERABILITY_HIDE_THEMES, WPVULNERABILITY_HIDE_PHP, WPVULNERABILITY_HIDE_APACHE, WPVULNERABILITY_HIDE_NGINX, WPVULNERABILITY_HIDE_MARIADB, WPVULNERABILITY_HIDE_MYSQL, WPVULNERABILITY_HIDE_IMAGEMAGICK, WPVULNERABILITY_HIDE_CURL, WPVULNERABILITY_HIDE_MEMCACHED, WPVULNERABILITY_HIDE_REDIS, WPVULNERABILITY_HIDE_SQLITE. Cache duration (since: 4.1.0) By default, data from the API is cached for 12 hours. To change this, define WPVULNERABILITY_CACHE_HOURS in wp-config.php with one of 1, 6, 12 or 24. This value overrides the setting screen and WP-CLI command. define( 'WPVULNERABILITY_CACHE_HOURS', 24 ); Log rotation (since: 4.2.0) WPVulnerability stores the most recent API responses so you can review recent calls from the new log tab. Define WPVULNERABILITY_LOG_RETENTION_DAYS in wp-config.php to control how many days of entries are preserved. Supported values are 0, 1, 7, 14 or 28; using 0 disables logging entirely. define( 'WPVULNERABILITY_LOG_RETENTION_DAYS', 14 ); When the constant is present its value is enforced in the settings UI and through WP-CLI, ensuring consistent log rotation across environments. Security configuration (since: 4.3.0) WPVulnerability uses a hybrid detection approach for server software (ImageMagick, Redis, Memcached, SQLite): PHP extensions first (most secure), then shell commands as fallback (most accurate). You can control this behavior using security configuration constants in wp-config.php. Global disable of shell commands: define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true ); Completely disables shell command usage. Falls back to PHP extensions only. Use for maximum security when accuracy loss is acceptable. Security mode (standard/strict/disabled): define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' ); standard – Hybrid detection: PHP extensions first, shell commands fallback (default, best accuracy) strict – PHP extensions only, no shell commands (high security, lower accuracy) disabled – No software detection at all (maximum security) Component whitelist: define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick,redis' ); Allows shell commands only for specified components. Available components: imagemagick, redis, memcached, sqlite. Use for granular control. Examples: Maximum security (no shell commands): define( 'WPVULNERABILITY_SECURITY_MODE', 'strict' ); Only allow ImageMagick shell detection: define( 'WPVULNERABILITY_SHELL_EXEC_WHITELIST', 'imagemagick' ); Complete disable: define( 'WPVULNERABILITY_DISABLE_SHELL_EXEC', true ); All shell commands are hardcoded and validated – no user input is involved. Commands are logged for security auditing. Compatibility WordPress: 4.7 – 7.1 PHP: 7.0 – 8.5 WP-CLI: 2.3.0 – 2.12.0 Security This plugin adheres to the following security measures and review protocols for each version: WordPress Plugin Handbook WordPress Plugin Security WordPress APIs Security WordPress Coding Standards Plugin Check (PCP) Privacy This plugin or the WordPress Vulnerability Database API does not collect any information about your site, your identity, the plugins, themes or content the site has. Vulnerabilities A security vulnerability was found and fixed in version 4.2.2.1. All previous versions (3.3.0 – 4.2.1) are affected. Please update to version 4.2.2.1 or later. Found a security vulnerability? Please report it to us privately at ROBOTSTXT. Contributors You can contribute to this plugin at the WPVulnerability repository.