Installation & Setup
Requires PHP 8.3+ and WordPress 6.8+.
For optional integrations, use Gravity Forms 2.9+ or WooCommerce 9.8+. Test the versions and add-ons used on the website.
Install
composer require eighteen73/wordpress-challengeActivate Challenge under Plugins, then open Settings > Challenge. Submissions remain unprotected until the selected provider is configured.
Manual installation
Extract a tagged GitHub release into your plugins directory and activate Challenge.
Provider Configuration
In Settings > Challenge, choose a provider and complete its fields below, then Save Changes. The selected provider is used across all protected forms.
When updating credentials, leave a secret field blank to keep its saved value, or tick Remove key to delete it. Switching providers preserves their saved credentials.
Cap
Use the connection details supplied by your Cap server administrator or hosted provider, with separate credentials for each website.
| Setting | Value |
|---|---|
| Server URL | HTTPS base URL, e.g. https://cap.example.com. Exclude the site key, query string, fragment and embedded credentials. Base paths are supported. |
| Site key (site ID) | The site's key identifier, not a URL |
| Secret key | The secret issued for that site key |
| Display | Floating (default) opens on submit; Visible shows the widget inline. An explicitly placed Gravity Forms Challenge field always renders inline. |
Cap Hosting and Privacy
| Connection | Destination |
|---|---|
| Visitor's browser: challenges, scripts and WASM | The Server URL above: your infrastructure when self-hosted, or your chosen hosted provider |
| WordPress: token verification | The same Cap instance |
| Cap Standalone: asset downloads | jsDelivr by default, downloaded and cached server-to-server |
Visitors do not make that upstream asset download. Challenge has no public CDN fallback if your instance's assets are unavailable.
The Cap endpoint must serve both the API and browser assets. Give your server administrator the Cap endpoint requirements if needed. For privacy assessment, review the instance's hosting and logs, and confirm browser traffic on your deployed version.
Cloudflare Turnstile
Create a Managed widget in Cloudflare Turnstile for the website's hostname, then enter its site key and secret key.
Google reCAPTCHA
Choose the version matching your Google keys:
| Provider | Settings |
|---|---|
| Google reCAPTCHA v2 | Checkbox site key and secret key |
| Google reCAPTCHA v3 | Site key, secret key and score threshold (default 0.5, range 0-1) |
Register the website's hostname with Google. Higher v3 thresholds reject more submissions.
Choose Which Forms to Protect
Gravity Forms Automatic protection is enabled by default. To protect selected forms only, disable it and add a Challenge field to each chosen form.
Supported WordPress account and WooCommerce forms are protected automatically once the provider is configured. See Protected Forms for coverage and field placement.
Verify
After saving, test as a logged-out visitor:
- Submit a protected form and confirm its intended result, including email delivery where applicable.
- Trigger a field validation error, correct it and submit again.
- Exercise any multi-page, AJAX, Save and Continue or checkout flows the website uses.
Saved credentials do not confirm a working connection. If a test fails, see Troubleshooting.