{"id":6937,"date":"2026-11-10T10:34:00","date_gmt":"2026-11-10T09:34:00","guid":{"rendered":"https:\/\/wpmastertoolkit.com\/module\/captcha-on-login-form\/"},"modified":"2026-11-10T11:23:26","modified_gmt":"2026-11-10T10:23:26","slug":"captcha-on-login-form","status":"publish","type":"module","link":"https:\/\/wpmastertoolkit.com\/en\/module\/captcha-on-the-login-form\/","title":{"rendered":"Captcha on login form"},"content":{"rendered":"

Captcha Module on the Login Form: A Simple Math Problem to Keep Bots Out<\/h1>\n\n\n\n

WordPress login, forgotten password, and registration forms are prime targets for bots. The plugin Captcha on login form<\/strong> WPMasterToolKit adds a simple addition problem (\u00abWhat is 3 + 2?\u00bb) to these three native forms; the problem is generated and verified on your server, without using any third-party services. The module is free; the adaptive mode is available only in the Pro version.<\/p>\n\n\n\n

\"Captcha<\/figure>\n\n\n\n

Which plugin can this module replace?<\/h2>\n\n\n\n

It replaces mathematical CAPTCHA extensions such as Really Simple CAPTCHA<\/strong> or Math Captcha<\/strong> on the WordPress login page. It is not equivalent to reCAPTCHA, hCaptcha, or Turnstile: it does not perform behavioral analysis and only protects native WordPress forms (not those from WooCommerce or form builders). It adds a simple layer of friction that complements\u2014but does not replace\u2014a limit on login attempts, such as our Limit Login Attempts module.<\/p>\n\n\n\n

Main features<\/h2>\n\n\n\n

Three secure forms<\/h3>\n\n\n\n
    \n
  • Login form:<\/strong> the login form (username and password).<\/li>\n\n\n\n
  • Forgot Password Form:<\/strong> the email request to reset the password.<\/li>\n\n\n\n
  • Registration form:<\/strong> the native registration form, if registration is open on your site.<\/li>\n<\/ul>\n\n\n\n

    Each form is activated separately. The \u00abNew question\u00bb link offers another calculation, and the CAPTCHA also works without JavaScript.<\/p>\n\n\n\n

    Two protection modes<\/h3>\n\n\n\n
      \n
    • Always require:<\/strong> The question appears every time on the protected forms.<\/li>\n\n\n\n
    • Adaptive (Pro):<\/strong> The question only appears when recent activity seems suspicious. Legitimate visitors log in without any issues, while repeated attempts trigger the question.<\/li>\n<\/ul>\n\n\n\n

      Adaptive Mode Settings (Pro)<\/h3>\n\n\n\n

      Adaptive mode tracks failed attempts and form submissions over a short period of time, separately for each browser and each IP address. Once a threshold is reached, the question becomes mandatory for a specified period of time. All thresholds are adjustable:<\/p>\n\n\n\n

        \n
      • Activity counting period:<\/strong> Duration of the counting period (5 minutes by default).<\/li>\n\n\n\n
      • Require questions for:<\/strong> The length of time the question remains mandatory after a suspicious activity (15 minutes by default).<\/li>\n\n\n\n
      • Failed logins from a single browser \/ from a single IP address:<\/strong> Number of allowed failed connection attempts (3 per browser and 5 per IP address by default).<\/li>\n\n\n\n
      • Request limits:<\/strong> Number of login form submissions (10), reset requests (3), registrations (3), and two-factor authentication code requests (3).<\/li>\n\n\n\n
      • Form timing:<\/strong> A form submitted too quickly (less than 1,500 ms by default) is flagged as suspicious and triggers the question earlier.<\/li>\n<\/ul>\n\n\n\n
        \"Captcha<\/figure>\n\n\n\n

        How to use this module<\/h2>\n\n\n\n
          \n
        1. Activate Captcha on login form<\/strong> in WPMasterToolKit, then open WPMasterToolkit > Captcha on the login form<\/strong>.<\/li>\n\n\n\n
        2. Select the \u00abAlways require\u00bb mode or, in Pro, \u00abAdaptive.\u00bb.<\/li>\n\n\n\n
        3. Check the boxes next to the forms you want to protect.<\/li>\n\n\n\n
        4. In adaptive mode, adjust the time periods and thresholds as needed, then click \u00abSave.\u00bb.<\/li>\n\n\n\n
        5. Open your login page in an incognito window to check how the question appears.<\/li>\n<\/ol>\n\n\n\n

          Our technical choices<\/h2>\n\n\n\n
            \n
          • 100 % local:<\/strong> No calls to external services, so no visitor data is shared with third parties.<\/li>\n\n\n\n
          • Single-use questions:<\/strong> Each question is linked to the browser via a technical cookie, expires after 10 minutes, and can only be attempted once. Only a hash (HMAC) is stored in a dedicated table that is cleared every hour by the cron job.<\/li>\n\n\n\n
          • Built-in anti-abuse limits:<\/strong> The number of queries, responses, and errors generated per IP address is capped over a 5-minute period. The filters wpmastertoolkit_captcha_issue_limit<\/code>, wpmastertoolkit_captcha_validate_limit<\/code>, wpmastertoolkit_captcha_failure_limit<\/code>, wpmastertoolkit_captcha_activity_limit<\/code> and wpmastertoolkit_captcha_cancel_limit<\/code> allow these limits to be adjusted.<\/li>\n\n\n\n
          • Generic error messages,<\/strong> that never reveal whether an account exists.<\/li>\n\n\n\n
          • Accessibility:<\/strong> labeled field, mobile numeric keypad, messages announced to screen readers.<\/li>\n\n\n\n
          • Compatible with other WPMasterToolKit modules:<\/strong> An incorrect CAPTCHA answer is not counted as a failure by Limit Login Attempts; two-factor authentication (Pro) checks the CAPTCHA before sending a code via email; and the CAPTCHA works with Move Login URL and Custom Login Design.<\/li>\n\n\n\n
          • API access is not affected:<\/strong> Application passwords, XML-RPC, and REST APIs do not go through secure forms.<\/li>\n<\/ul>\n\n\n\n

            Good to Know<\/h2>\n\n\n\n
              \n
            • If you're using a reverse proxy or a CDN, configure your server to pass through visitors' actual IP addresses; otherwise, they will all share the same IP address\u2014and thus the same limitations.<\/li>\n\n\n\n
            • Exclude the login page and AJAX requests from your page cache.<\/li>\n\n\n\n
            • Keep the login attempt limit enabled: the calculation acts as a deterrent for simple bots, but it is not a foolproof verification method.<\/li>\n<\/ul>\n\n\n\n

              Conclusion<\/h2>\n\n\n\n

              Captcha on Login Form protects native WordPress forms without relying on an external service or tracking your visitors. The \u00abAlways Require\u00bb mode is available for free; the adaptive mode in the Pro version only interrupts your users when necessary.<\/p>","protected":false},"excerpt":{"rendered":"

              The WPMasterToolKit \u201cCaptcha on Login Form\u201d module adds a math problem\u2014generated locally without any third-party services\u2014to WordPress\u2019s native login, forgotten password, and registration forms. In the Pro version, adaptive mode displays the question only when suspicious activity is detected, with adjustable thresholds.<\/p>","protected":false},"featured_media":0,"parent":0,"template":"","meta":{"_acf_changed":false,"_surecart_dashboard_logo_width":"180px","_surecart_dashboard_show_logo":true,"_surecart_dashboard_navigation_orders":true,"_surecart_dashboard_navigation_invoices":true,"_surecart_dashboard_navigation_subscriptions":true,"_surecart_dashboard_navigation_downloads":true,"_surecart_dashboard_navigation_saved":true,"_surecart_dashboard_navigation_billing":true,"_surecart_dashboard_navigation_account":true},"wpmtk_module_category":[],"class_list":["post-6937","module","type-module","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/wpmastertoolkit.com\/en\/wp-json\/wp\/v2\/module\/6937","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmastertoolkit.com\/en\/wp-json\/wp\/v2\/module"}],"about":[{"href":"https:\/\/wpmastertoolkit.com\/en\/wp-json\/wp\/v2\/types\/module"}],"wp:attachment":[{"href":"https:\/\/wpmastertoolkit.com\/en\/wp-json\/wp\/v2\/media?parent=6937"}],"wp:term":[{"taxonomy":"wpmtk_module_category","embeddable":true,"href":"https:\/\/wpmastertoolkit.com\/en\/wp-json\/wp\/v2\/wpmtk_module_category?post=6937"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}