內容簡介
Gatekeep 是一款專為 WordPress 設計的 CAPTCHA 與垃圾郵件防護外掛，能有效阻擋各種表單的垃圾郵件，並且不會對訪客造成困擾。它透過風險評分、蜜罐技術等多種信號來檢測機器人，讓大多數真實用戶不需面對挑戰。
【主要功能】
• 支援多種表單類型，包括聯絡表單、登入、註冊等
• 無需顯示 CAPTCHA，保持用戶體驗流暢
• 監控模式可在不阻擋任何提交的情況下評估風險
• 17 點安全審核，檢查網站配置弱點
• 記錄所有提交，包括正常與可疑的，提供完整數據
• 自訂表單保護，僅需簡單的函數調用
外掛標籤
開發者團隊
② 後台搜尋「Gatekeep – CAPTCHA & Spam Protection」→ 直接安裝（推薦）
原文外掛簡介
Stop spam without annoying your visitors.
Gatekeep protects virtually every form on your WordPress site – not just contact forms.
Whether visitors are logging in, registering, checking out, leaving comments or submitting a form you wrote yourself, Gatekeep quietly analyses every submission and stops suspicious activity before it reaches your inbox.
Unlike traditional CAPTCHA plugins, Gatekeep uses risk scoring, honeypots, timing analysis, rate limiting and a dozen other signals to detect bots with almost no friction for real people. Most visitors never see a challenge at all.
Every form, not just one
Contact forms
Login, registration and password reset
WooCommerce checkout and account creation
Comments
BuddyPress and bbPress
Membership and LMS plugins
Page-builder forms
Custom-coded forms – two function calls, or none at all with the universal guard
CAPTCHA for Contact Form 7 – without the CAPTCHA
Searching for a Contact Form 7 CAPTCHA usually means one thing: the form is drowning in spam. Gatekeep protects CF7 the moment it is activated – including the AJAX submission path most honeypot plugins miss – with nothing visible added to the form. The same is true for WPForms, Gravity Forms, Fluent Forms, Formidable, Ninja Forms, Elementor forms and the WooCommerce checkout: install, click Protect my website, done. If you specifically want a visible challenge, four self-hosted ones are included – no Google account, no site keys.
What it caught that other filters did not
Every anti-spam plugin reports what it blocked. None report what they missed – which is the number that actually tells you whether you are protected.
Gatekeep records every submission, clean ones included, so its totals have a denominator: not “12 blocked” but “12 blocked of 4,310”. Monitor Mode goes further and scores submissions without blocking any, alongside whatever protection you already run, so you can read a week of real verdicts before changing anything. Nothing else on the plugin directory will tell you what your current filter is letting through.
Signals a human spammer cannot avoid
Most anti-spam checks measure how a form was submitted – speed, tokens, hidden fields. Someone typing at human speed passes all of them. Gatekeep also reads what was sent:
Imitating sender domains. Mail from search-yoursite.com when you are yoursite.com. Nobody legitimate writes to you from a domain built out of yours.
Disguised web addresses. “example dot com”, “example[.]org”, “hxxps://” – written that way to slip past filters, and scored precisely because honest correspondents never do it.
Link density. A short message that is mostly links.
Repeated messages. The same pitch arriving again and again, recognised even when names, numbers and links are varied between sends.
Malformed payloads. Submissions carrying hundreds of fields or nested absurdly deep to push the real message past a scanner.
Smarter than a CAPTCHA
Traditional captcha asks everyone to prove they are human. Gatekeep asks the submission instead, scoring signals the visitor never sees: honeypot traps, impossible submission speed, disposable email addresses, scripted HTTP clients and headless browsers, rate limits, invalid form tokens, missing browser headers and invisible link traps.
Only ambiguous submissions ever meet a challenge – and if you want one, four self-hosted options need no account and no keys.
Monitor Mode: prove it is safe before it blocks
Losing a real customer costs more than receiving spam. So Gatekeep starts in Monitor Mode: for the first week it watches, scores, logs and explains every decision without blocking anything. You switch enforcement on when the verdicts look right.
More than spam protection
A 17-point security audit checks for weak configuration – default admin accounts, unrotated salts, exposed config backups, the built-in file editor, XML-RPC, missing HTTPS, end-of-life PHP, pending updates and dormant plugins. Every finding explains what to do; nothing is changed automatically.
A security event log records who changed what: role changes, sign-ins and failures, plugin and theme changes, password and email changes, and critical settings.
Features
Intelligent risk scoring rather than puzzles
Universal form protection, including custom-coded forms
Contact Form 7, Gravity Forms, WPForms, Fluent Forms, Formidable, Ninja Forms, MetForm
WooCommerce, BuddyPress, bbPress, MemberDash, Academy LMS, Bloom
Divi 4 and 5, Elementor Pro, Bricks, Avada, Thrive, WPBakery, Oxygen, Beaver Builder
Honeypot, timing analysis, rate limiting, disposable email detection
Four self-hosted challenges – maths, image, checkbox and proof-of-work
reCAPTCHA, hCaptcha and Turnstile supported if you already use them
Login, registration and comment protection
Security audit and security event log
Developer API and shortcode
Privacy friendly – hashed IP addresses, no third-party tracking
No API keys required
Works with page caching
No JavaScript in the default configuration
Switching from a CAPTCHA or another anti-spam plugin?
Coming from reCAPTCHA, hCaptcha or Turnstile: keep it, install Gatekeep in Monitor Mode beside it, and watch the log for a fortnight. You will see exactly what your captcha lets through – measured on your own traffic, not claimed by a vendor. Most sites then retire the puzzle; Gatekeep even ships a reCAPTCHA-compatible siteverify endpoint so custom code can switch by changing one URL.
Coming from Akismet or another comment filter: they classify comment text; Gatekeep protects the forms they never see – registration, login, checkout, contact. The two can run together, and the Compatibility screen shows the overlap so it stays a decision, not an accident.
Coming from a honeypot plugin: Gatekeep’s honeypot uses a field name derived from your own site’s salts, so bots cannot learn it elsewhere – and it is one signal of a dozen rather than the whole defence.
Measured, not promised
~380 bytes added to a form, no JavaScript by default
Blocked submissions decided in under 5 ms
1,200+ automated assertions pass on every release, on WordPress and WooCommerce current versions
Nothing loads for a visitor except what a page view needs – admin, licensing and hardening code stay out of the way
Free forever, and what Pro adds
Everything that is code is free – and the code agrees. The engine, all 33 integrations, Monitor Mode, the activity log, the dashboard health score, the 17-point security audit, protection profiles, the coexistence report, IP and keyword rules, advanced signals, settings export/import and all four challenges including the image one: free, with no licence prompt anywhere.
The paid tier buys hosted services that need someone on duty: the disposable-email-domain feed of 75,000+ entries refreshed daily, IP reputation, hosted verification, the Fortify hardening pack (a separate companion plugin you download from your account and install like any other plugin), and priority support. This plugin never downloads or installs other software. See plans and pricing.
Your forms never depend on the licence: if it lapses, protection keeps working and you keep the version you have.
Third-party assets
Two font families are bundled and served from the plugin folder, so no
visitor request is ever made to a font CDN:
IBM Plex Sans – Copyright 2017 IBM Corp, SIL Open Font License v1.1 – https://github.com/IBM/plex
Bricolage Grotesque – Copyright 2022 The Bricolage Project Authors, SIL Open Font License v1.1 – https://github.com/ateliertriay/bricolage
Both licences are GPL-compatible. Full attribution is in assets/FONT-LICENSES.txt.
Friendly Captcha SDK (assets/vendor/friendly-captcha/site.min.js and site.compat.min.js)
Version 1.0.2, Mozilla Public License 2.0, unmodified.
Source: https://github.com/FriendlyCaptcha/friendly-captcha-sdk
Licence text: assets/vendor/friendly-captcha/LICENSE.txt
Bundled locally rather than loaded from a CDN.
External services
Gatekeep makes no outbound requests in its default configuration. Nothing below happens unless you switch that feature on yourself.
Each service is listed with what it is, what is sent, when it is sent, and links to its terms and privacy policy.
1. Google reCAPTCHA (optional, off by default)
What it is: Google’s CAPTCHA service. Used only if you select reCAPTCHA as a challenge provider and enter your own site and secret keys.
What is sent, and when: when a visitor loads a page carrying a form you have enabled reCAPTCHA on, their browser loads Google’s widget script from www.google.com and Google receives the visitor’s IP address, browser information and interaction data. When that form is submitted, your server sends the challenge token, your secret key and the visitor’s IP address to www.google.com to verify the answer. No form content is sent.
Terms of service: https://policies.google.com/terms
Privacy policy: https://policies.google.com/privacy
2. hCaptcha (optional, off by default)
What it is: an alternative CAPTCHA service. Used only if you select hCaptcha and enter your own keys.
What is sent, and when: on a page with an hCaptcha-enabled form, the visitor’s browser loads the widget from js.hcaptcha.com and hCaptcha receives their IP address, browser information and interaction data. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to api.hcaptcha.com. No form content is sent.
Terms of service: https://www.hcaptcha.com/terms
Privacy policy: https://www.hcaptcha.com/privacy
3. Cloudflare Turnstile (optional, off by default)
What it is: Cloudflare’s CAPTCHA alternative. Used only if you select Turnstile and enter your own keys.
What is sent, and when: on a page with a Turnstile-enabled form, the visitor’s browser loads the widget from challenges.cloudflare.com and Cloudflare receives their IP address and browser information. On submission, your server sends the challenge token, your secret key and the visitor’s IP address to challenges.cloudflare.com to verify it. No form content is sent.
Terms of service: https://www.cloudflare.com/website-terms/
Privacy policy: https://www.cloudflare.com/privacypolicy/
4. Friendly Captcha (optional, off by default)
What it is: a proof-of-work CAPTCHA service. Used only if you select Friendly Captcha and enter your own keys.
The widget script is bundled with this plugin and served from your own site, so no script is loaded from a third party. Verification is still performed by Friendly Captcha, because that is the service being used.
What is sent, and when: when a visitor solves the challenge, their browser contacts Friendly Captcha’s puzzle endpoint. On submission, your server sends the challenge response and your API key to global.frcapi.com, or to eu.frcapi.com if you select their EU-only infrastructure. No form content is sent.
Terms of service: https://friendlycaptcha.com/legal/terms/
Privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/
5. Gatekeep licence and threat list at gatekeepwp.com (optional, off by default)
What it is: the licensing and threat-list service operated by the plugin author. It is contacted only if you buy a licence and enter the key. Without a key it is never contacted.
What is sent, and when: on licence activation, and once daily while a licence is active, your site sends the licence key and your site address to gatekeepwp.com to validate the licence and to download the current threat list. This is a server-to-server request. No visitor data, no IP addresses and no form content are ever sent.
Terms of service: https://gatekeepwp.com/terms/
Privacy policy: https://gatekeepwp.com/privacy/
6. ipapi.co (optional, off by default, requires the Pro companion)
What it is: a geolocation lookup used only if you enable “Look up country when the host does not provide it” and the Gatekeep Pro companion is installed. The free plugin never contacts this service.
What is sent, and when: the visitor’s IP address is sent server-to-server to ipapi.co so a country code can be cached for a day. No form content is sent. Sign-in attempts are never blocked by country.
Terms of service: https://ipapi.co/terms/
Privacy policy: https://ipapi.co/privacy/
