Captchinoo, admin login page protection with Google recaptcha

Your login page is the single most attacked page on any WordPress site. Bots hit wp-login.php around the clock, guessing username and password combinations thousands of times a day. Captchinoo puts a human verification step in front of that form, so automated scripts are stopped before they ever reach your password check.

Install it, pick the captcha style you like, and you are protected. There is nothing else to configure.

Three captcha styles, one click apart

• Slide to unlock — a lightweight swipe slider, just like unlocking a phone. No external service, no API keys, works on desktop and touch devices.
• Icon captcha — the visitor picks the one icon that does not belong in the row. Friendly, image based, and no typing required.
• Google reCAPTCHA v2 — the familiar “I’m not a robot” checkbox, backed by Google’s own bot detection.

Why site owners choose Captchinoo

• No puzzles to read. No distorted letters and no math questions. Your users are not punished for logging in.
• Genuinely lightweight. Only the assets for the captcha you actually selected are loaded, and only on the login page. Nothing is queued on the front end of your site.
• Works with caching. The login page is never cached by page caching plugins, so Captchinoo stays reliable where other captcha plugins break.
• Translation ready. Every string is translatable and the plugin ships with full text domain support.
• Zero configuration required. The slide captcha works the moment you activate the plugin — no account, no keys, no signup.

Upgrade to Captchinoo Pro

The free plugin secures your WordPress login form. Captchinoo Pro adds Google reCAPTCHA v3 (invisible, no user interaction), hCaptcha support, and two factor authentication (2FA) for a second layer of account security.

External services

This plugin can optionally use Google reCAPTCHA, a third party service, and only when you explicitly select “Google reCAPTCHA” as your captcha type and enter your own API keys.

When that option is active, the visitor’s browser loads Google’s reCAPTCHA script from https://www.google.com/recaptcha/api.js, and your server sends the captcha response token together with the visitor’s IP address to https://www.google.com/recaptcha/api/siteverify in order to confirm the challenge was solved. No data is transmitted to Google when the Slide or Icon captcha is selected, and the plugin never sends data anywhere else.

Google’s terms and privacy policy apply to that service: Terms of Service — Privacy Policy.

Support

If you have a problem, a question, or a feature request, please open a thread in the support forum. We answer every one. If Captchinoo helps keep your site safe, a review would mean a lot to us.

Automatic installation

1. Go to Plugins > Add New in your WordPress dashboard.
2. Search for Captchinoo Captcha.
3. Click Install Now, then Activate.
4. Go to Captcha free in the admin menu to choose your captcha type.

Manual installation

1. Download the plugin .zip file.
2. Go to Plugins > Add New > Upload Plugin, choose the file, and click Install Now.
3. Activate the plugin.
4. Go to Captcha free in the admin menu to choose your captcha type.

The Slide captcha is enabled by default and needs no further setup. If you prefer Google reCAPTCHA, see the FAQ below for how to get your API keys.

1. 

   The Slide to unlock captcha on the WordPress login form.

2. 

   The Icon captcha — select the image that does not belong in the row.

3. 

   Google reCAPTCHA v2 on the login form.

4.3

• Security: fixed a login captcha bypass in the Slider (Swipe) captcha where the check could be skipped by omitting the captcha field. The token is now required, single-use, and rotated after every attempt.
• Security: added a CSRF nonce to the Google reCAPTCHA “Verify & save” admin action.
• Security: replaced the “administrator” role checks with the proper “manage_options” capability.
• Hardening: reCAPTCHA verification now fails closed and is null-safe if Google is unreachable.
• Compatibility: full PHP 8.3 support (null-safe array/property access, guarded sessions) and tested up to WordPress 7.1.
• Cleanup: removed a leftover debug handler and normalized bundled library files.
• Documentation: rewritten readme with a full FAQ and an external services disclosure.

4.2

• hCaptcha Support

4.1

• Fix some errors with slide captcha
• Css fixes
• JS fixes
• Update google captcha help link
• Interface update
• check with the latest wordpress update

3.2

• check with the latest wordpress update

3.1

• Clean outputs

3.0

• Code fix & check with the latest wordpress update

2.5

• Code fix & check with the new wordpress update

2.4

• Code fix & check with the new 5.7 wordpress update

2.3

• Important fixing (PHP Short Array Syntax Error) in Google recaptcha

2.2

• Important fixing (PHP Short Array Syntax Error)

2.1.1

• Important fix for 1.9 update
• Add links to dismiss the new start page links
• Change the name of the plugin

1.9

• New advanced and easy to use starting page panel

1.8

• Review bar added

1.7

• Code fix
• admin styles fix
• Google captcha new option fix
• Auto redierct after saving when use google captcha
• Help added to enable google captcha simply

1.6

• Code fix
• Add google captcha version 2 new feature

1.5

• Fix (slider captcha don’t touch on mobile devices)
• Fix (slider captcha full slide action not doing any action)
• Add about new tab
• Change the translation text domain to be the same as the plugin main slug captchinoo-captcha-for-login-form-protection

1.4

• Change dropdown theme chooser to image chooser
• Some fixes

1.3

• Activate function (icon captcha function), error fixed!

1.2

• Stop the (icon captcha function) because of not loading error

1.1

• Upload missing files by mistake

1.0

• initial version