內容簡介
Gate House 是一款專為 WordPress 和 WooCommerce 表單設計的防垃圾郵件與 CAPTCHA 外掛，能有效減少自動化垃圾郵件。使用者可選擇內建的無鑰檢查或連接 Cloudflare Turnstile、Google reCAPTCHA 或 hCaptcha，且無需註冊帳號或提供信用卡。
【主要功能】
• WordPress 登入、註冊及評論防垃圾郵件
• WooCommerce 結帳、帳戶及評論表單檢查
• 無需 CAPTCHA 鑰匙的自動保護
• 支援 Cloudflare Turnstile、reCAPTCHA 和 hCaptcha
• 監控表單覆蓋率及阻擋嘗試次數
• 免費版與可選的 Pro 控制功能
外掛標籤
開發者團隊
② 後台搜尋「Gate House – Spam Protection & CAPTCHA」→ 直接安裝（推薦）
原文外掛簡介
Gate House helps reduce automated spam on native WordPress and WooCommerce forms. Start with built-in keyless checks, or connect Cloudflare Turnstile, Google reCAPTCHA v2/v3 or hCaptcha. Free needs no Gate House account, license, credit card or trial.
WordPress login, registration and comment spam protection
Choose Off, Invisible or Human check for native WordPress login, registration, password-reset requests and comments. The checks act on supported submissions; they do not classify comment content or prove that every visitor is legitimate.
WooCommerce checkout, account and review forms
Add checks to WooCommerce My Account forms, product reviews, classic checkout, Checkout Blocks and native order-payment forms. Checkout checks are an explicit choice: test complete sandbox payment journeys before enabling them. Custom forms, headless routes, express wallets and gateway-specific flows need separate assessment.
Start without CAPTCHA keys
Automatic protection runs on your server using a signed form proof, a hidden honeypot and a minimum submission time. No external provider account or browser challenge is needed for this mode. Fresh settings observe until you choose protection. Turn on recommended protection enables invisible checks for supported sign-in, registration, reset, comment and review forms while leaving checkout unchanged.
Choose Turnstile, reCAPTCHA or hCaptcha
All three provider integrations are included in Free: Cloudflare Turnstile Managed, Google reCAPTCHA v2 checkbox or v3 score, and standard hCaptcha. Connect one external provider at a time, save that provider’s keys and run the browser-to-server connection test. Then select Human check on the forms you want to protect. Provider key creation takes place in the provider’s own dashboard.
See form coverage and blocked attempts
Guided setup includes form discovery, provider diagnostics and daily blocked-attempt totals. Overview separates enabled form types from successful-use observations. A detected form or passing provider test is not proof that every theme or payment journey works. Try successful and rejected submissions on the actual forms your visitors use.
Free protection and optional Pro controls
Free includes the form checks above, keyless setup, provider testing, coverage and the aggregate blocked-attempt counter. Gate House Pro is a separately distributed add-on for configurable rate limits and presets, advanced rules, disposable-email and account-abuse checks, card-testing signals, held-order review, detailed local activity, Contact Form 7 and administration tools. Free keeps working independently. Learn more: https://gatehousewp.com/
External services
Automatic protection runs locally and sends no data to Gate House or a CAPTCHA vendor. The Free edition has no Gate House license updater, install check-in or setup-status telemetry. Its CSS, JavaScript and fonts ship locally.
External verification is optional. An administrator chooses a provider, saves that provider’s keys, runs an explicit connection test, and enables Human check on selected forms. Only that selected provider’s browser script is loaded on forms configured for its check and on explicit administrator diagnostics. Automatic forms do not load a vendor challenge. The script receives the public site key and, where supported, the form’s verification action; the provider processes browser/challenge data under its own privacy policy, including the browser’s network connection and IP address.
When a visitor submits a provider challenge, or an administrator submits the connection test, Gate House sends an HTTPS POST containing the verification secret (secret), challenge token (response), and trusted client IP when available (remoteip) to the selected provider’s verification endpoint. hCaptcha also receives the expected public site key (sitekey). The plugin does not send account passwords, payment details, or order contents to these verification endpoints. Raw challenge tokens, secrets and IP addresses are not retained in plugin counters.
Cloudflare Turnstile
Purpose: managed human verification for the selected forms and administrator connection test.
Browser script: https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
Server verification: https://challenges.cloudflare.com/turnstile/v0/siteverify
Terms: https://www.cloudflare.com/website-terms/
Privacy: https://www.cloudflare.com/privacypolicy/
Google reCAPTCHA
Purpose: reCAPTCHA v2 checkbox or v3 verification for the selected forms and administrator connection test.
Browser script: https://www.google.com/recaptcha/api.js (render=explicit for v2; render= for v3).
Server verification: https://www.google.com/recaptcha/api/siteverify
Terms: https://policies.google.com/terms
Privacy: https://policies.google.com/privacy
hCaptcha
Purpose: standard human verification for the selected forms and administrator connection test.
Browser script: https://js.hcaptcha.com/1/api.js?render=explicit
Server verification: https://api.hcaptcha.com/siteverify
Terms: https://www.hcaptcha.com/terms
Privacy: https://www.hcaptcha.com/privacy
Review your selected provider’s terms, privacy information and quotas before configuring it. Provider keys are optional when using Automatic protection. Preserve provider branding and any privacy notices required for your site.
Source code and build instructions
Readable TypeScript and CSS for the compiled assets are included in assets/src/. The build entry point is tools/build.mjs; package.json, package-lock.json and tsconfig.json contain the build configuration and locked dependencies. No private repository or Pro source is needed to rebuild the Free assets.
On a development copy, use Node.js 22 LTS (22.13 or later) with npm. From the installed gate-house-spam-protection-captcha directory (gate-house/ in the source repository), run:
npm ci
npm run build
The build writes assets/build/admin.js, assets/build/frontend.js, assets/build/frontend-recovery.js, assets/build/admin.css and assets/build/frontend.css. The local recovery helper can restore the frontend bundle when a page builder removes it; it waits for a configured Human-check widget and does not contact an additional service. To check the source, run npm run typecheck and npm run lint. Prebuilt assets ship in the installation ZIP, so site owners do not need Node.js or a build step. Keep node_modules and other development dependencies out of distributable ZIPs. Local font files are covered by assets/fonts/OFL.txt.
