Home Blog WordPress Management Still experiencing spam with CAPTCHA on WordPress? Here’s what to do

How to deal with spam after adding CAPTCHA on WordPress

Still experiencing spam with CAPTCHA on WordPress? Here’s what to do

CAPTCHA is one of the best tools WordPress administrators and website owners have at their disposal in their fight against spam, such as spam comments and fake user registrations. Just like every other tool, sometimes it needs to be sharpened and serviced. Some TLC goes a long way in helping you keep the CAPTCHA 4WP plugin performing admirably against spam.

If you have ReCAPTCHA configured on your WordPress website, but you’re still getting spam, this article is for you. We will start with a brief introduction and some background information into how CAPTCHA works before delving into step-by-step instructions of actions you can take to limit spam.

Introduction and background information

ReCAPTCHA is a CAPTCHA service provided by Google. CAPTCHA plugins that use the ReCAPTCHA service act as a connector to the Google ReCAPTCHA service – which essentially does the bulk of the work,

CAPTCHA is an acronym, which stands for Completely Automated Public Turing test to tell Computers and Humans Apart. This means that the ReCAPTCHA service is effectively trying to determine if a visitor is a computer or a person through a test. The test is ‘rigged’ in favor of humans – which is what we ultimately want. Computers, however, keep getting smarter, and sometimes they are able to pass off as humans and ace the test. To learn more about CAPTCHA, what it is and how it works, read What is CAPTCHA.

ReCAPTCHA comes in three different versions:

  • ReCAPTCHA – V2 I’m not a robot
  • V2 Invisible
  • V3.

V3 is the latest version, launched in 2018. The V2’s were first launched in 2014. Each of these versions includes a different type of test, with the test that’s run by V3 being more technologically advanced. Furthermore, it even lets you set the test’s pass mark yourself. This control allows you to tweak the test, making it more difficult for computers to pass the test. This is what we will be configuring in the next section.

How to limit spam

We will now look at how we can limit spam by using CAPTCHA 4WP.

As mentioned earlier, V3 is the latest version of ReCAPTCHA. We will switch to this version so that we can gain control over the test’s pass mark; making it more difficult for spam to get through. This version also requires less user interaction, helping you decrease friction with your users and visitors without compromising on security.

Step 1: Check which version you’re running.

The first step you need to undertake is to check which ReCAPTCHA version you’ve configured on your website. As mentioned earlier, V3 is the newer version. If you’re running an earlier version, make sure you switch to V3.

You can easily do this by selecting the V3 option from the reCAPTCHA type drop-down menu.

Step 2: Get a new key pair

You will need a Secret Key and a Site Key for ReCAPTCHA V3. You can do this through the Google ReCAPTCHA admin console.

Step 3: Set the pass mark

As mentioned earlier, CAPTCHA is a test, and like other tests, it has a pass mark. Adjusting the score can make it more difficult for computers to pass as humans.

In CAPTCHA 4WP, we can do this through the Captcha Score option. By default, the score is set at 0.5, which equates to 50%. Increase the value to make the test more difficult to pass.

Increase the value by 0.1 and re-assess the situation. It is not advisable to increase the score by multiple points without first seeing how this affects spam and users.

Step 4: Enable CAPTCHA on all pages

The last step that we need to take is to enable CAPTCHA on all pages. This setting loads the ReCAPTCHA script, allowing the ReCAPTCHA service to better understand how the visitor/user is behaving across the website. Enabling this option should yield better results.

Under the v3 Script Load option, select All Pages.

Once ready, make sure you save the settings by clicking the Save Changes button.

Next Steps

If you’re still getting a high number of spam messages, consider following these steps next:

Smart fields

Smart fields are additional fields that you can add to your form that make it even more difficult to get through when used in conjunction with CAPTCHA.

Honeypot fields essentially are hidden fields that only a bot would see. If an input is registered in the field, the form will not be sent, helping you reduce instances of automated spam. Form plugins may have this included as a feature – all you need to do is enable it.

Test questions are simple questions that a human can answer, but a bot would struggle with. Test questions are included as mandatory fields in the submission form and can ask questions such as How many legs does a puppy have? Or 5 + 2 =.

Google reCAPTCHA dashboard

The Google reCAPTCHA dashboard offers a number of different stats that can help you determine what is going on, including passed and failed login requests and the number of sessions completed.

Contact Melapress

If you’re getting stuck, remember we are just one customer support request away. You can always open a support ticket and try to include as much information as possible in your message. Screenshots are especially helpful since these may allow us to spot configuration optimization issues that once fixed, can help you improve the spam situation.

Keep in mind that no solution is 100% foolproof, especially when it comes to internet and computer security. Spammers, like hackers, are always looking for ways to circumvent the checks and balances we put in place to keep our websites safe. This means that some spam might still get through, even with reCAPTCHA enabled; however, using the latest version will ensure this is kept to a minimum.

Posted inWordPress Management
Glenn Kouma
Glenn Kouma

Glenn has a huge passion for WordPress, has been using it for over 5 years, and even develops a couple of premium themes. Glenn enjoys blogging, music, and the outdoors. You can reach Glenn at glenn@melapress.com.


Leave a Reply

Your email address will not be published. Required fields are marked *

Stay in the loop

Subscribe to the Melapress newsletter and receive curated WordPress management and security tips and content.

Newsletter icon

It’s free and you can unsubscribe whenever you want. Check our blog for a taste.

Envelope icon
Uploading WP 2FA as a zip file in WordPress
WP 2FA in the WordPress plugin repository
Close

Installing WP 2FA Free

Congratulations on taking the first step towards enhancing your WordPress site's security with WP 2FA Free! You're now on your way to protecting your valuable data and ensuring peace of mind. No coding or technical knowledge is required.

 

Below are two ways to install WP 2FA on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for WP 2FA.

Download the WP 2FA plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading CAPTCHA 4WP as a zip file in WordPress
CAPTCHA 4WP in the WordPress plugin repository
Close

Installing CAPTCHA 4WP Free

Well done you. You're one step closer to safeguarding your WordPress website from spam and automated attacks with CAPTCHA 4WP. You'll be able to effortlessly integrate CAPTCHA into your forms and enjoy a website with enhanced security.

 

Below are two ways to install CAPTCHA 4WP on your website:

Go to your plugin dashboard on your site, then go to "Add New", and then search for CAPTCHA 4WP.

Download the CAPTCHA 4WP plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading WP Activity Log as a zip file in WordPress
WP Activity Log in the WordPress plugin repository
Close

Installing WP Activity Log Free on your website

You deserve a pat on the back for choosing to record user actions and changes on your website. That is the first step towards better user accountability, easier troubleshooting of website security, and many other benefits of issues.

 

Below are the two ways to install WP Activity Log on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for WP Activity Log.

Download the WP Activity Log plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2

Uploading Melapress Login Security as a zip file in WordPress
Melapress Login Security in the WordPress plugin repository
Close

Installing Melapress Login Security Free

Congratulations on taking control of your WordPress website's security by implementing robust login and password policies with Melapress Login Security. You can change your login page URL, limit failed login attempts, and reset passwords.

 

Below are two ways to install Melapress Login Security on your website:

Go to your plugin dashboard on your site, then go to "Add New" and then search for Melapress Login Security.

Download the Melapress Login Security plugin zip, then select upload in your plugin dashboard under "Add New".

OPTION 1

OPTION 2