Protected Forms

Once a provider is configured, Challenge verifies these submissions server-side:

Integration	Protected actions
Gravity Forms	Final submission, Save and Continue, resume-link emails
WordPress	Native registration and password-reset requests
WooCommerce	My Account registration and password-reset requests; guest classic and Block checkout

Gravity Forms

Automatic Protection

Settings > Challenge > Automatic protection is enabled by default. Every Gravity Form is protected without adding a field in the form editor.

Provider	Automatic placement
Cap	Uses the site-wide Floating or Visible setting
Turnstile	Widget beside Submit
reCAPTCHA v2	Checkbox beside Submit
reCAPTCHA v3	Invisible verification on submission

Explicit Placement or Individual Opt-In

Add a Challenge field from the Gravity Forms editor to choose an inline position. Cap renders that field visibly even when the site-wide display mode is Floating.

To protect only selected forms, uncheck Automatic protection. Only forms containing a Challenge field will then require verification.

On multi-page forms, place the Challenge field on the final page. If conditional logic makes an earlier page the final page, Challenge supplies the widget there as needed. Ordinary Next and Previous navigation does not require a challenge.

AJAX and Validation Retries

Standard and AJAX submissions are supported. Verification errors appear inline; visitors can correct their entries and retry.

Save and Continue

Both saving an incomplete form and emailing a resume link require verification on protected forms.

• Intermediate pages receive a widget beside Save and Continue.
• The resume-email form receives a fresh widget after saving.
• Failed resume-email verification preserves the email address for retry and does not send the notification.
• Completing a resumed form still requires final-submission verification.

Both Floating and Visible Cap modes apply to these actions.

Uploads and Add-Ons

Verification runs at final form submission. The upload endpoint itself is not protected by Challenge.

For payment and user-registration add-ons, test the complete payment or account-creation flow, including retries. A successful ordinary submission does not establish add-on compatibility.

WordPress Accounts

Registration and requests for a password-reset email receive a widget automatically. Authorised reset emails sent from WordPress user management are exempt.

Custom account forms from themes or other plugins are not automatically covered. Confirm compatibility before relying on protection.

WooCommerce

My Account registration and password-reset requests receive a widget automatically. Checkout protection applies to guests only, for both classic checkout and the Checkout Block.

Test checkout, payment retries and any express payment methods used on the website before deploying this integration.

Exclusions

The following are outside Challenge's coverage:

• Login forms
• Comments and product reviews
• Logged-in checkout
• The final password-change step reached through a reset email
• Custom forms without a Challenge integration

Use separate rate limiting and account security controls for site-wide protection.