Invisible CAPTCHA with Turnstile or reCAPTCHA v3 — Bring Your Own Keys

For most sites, the local defenses — honeypot, timing, rate limiting — stop the spam. But for a form under persistent, sophisticated attack, Spamify can add an invisible CAPTCHA layer. It’s optional, it uses your own provider keys, and it stays completely off until you configure it.

Two providers, both invisible

The captcha_provider setting picks between two modern, low-friction options that don’t make visitors click on traffic lights:

• Cloudflare Turnstile — privacy-leaning, no visible puzzle for the vast majority of users.
• Google reCAPTCHA v3 — scores each visitor invisibly in the background.

Both are free to use with your own keys. You create the keys in your Cloudflare or Google account and paste them into Spamify — the plugin never provides shared keys, so the trust relationship is between your site and your provider.

Bring your own keys — and nothing loads until you do

This is the important privacy detail: no CAPTCHA script loads and no visitor data is sent to any provider until you enter keys. On a fresh install, CAPTCHA is inert. When enabled, only the CAPTCHA token and visitor IP are sent to your chosen provider’s verification endpoint, only on submission — never to the plugin author.

The captcha_action setting

When a visitor fails the CAPTCHA check, captcha_action decides what happens — block the submission, or flag it for review. Because reCAPTCHA v3 in particular returns a score rather than a hard pass/fail, many sites prefer to flag borderline cases rather than block them outright, then tighten once they’ve watched the dashboard for false positives.

When to actually turn it on

Don’t reach for CAPTCHA first. Enable it when:

• A specific form is getting spam despite honeypot, timing, and rate limiting.
• You’re seeing distributed abuse from many IPs (which rate limiting alone can’t stop).

Add it as a targeted top layer, not a blanket default — the goal is to bother real visitors as little as possible.