hCaptcha for WordPress
Free plugin that adds hCaptcha to WordPress core, WooCommerce and 60+ form, builder and community plugins, with honeypot and IP controls.
84
CleanTalk Spam Protection
CAPTCHA-free cloud anti-spam for comments, registrations, WooCommerce and 100+ form plugins, with a firewall for known bots. From $12/year.
Free installs200K+WordPress.org, active
Est. active installs~180KLikely 90K–360K
Vendor claims1.1M+Vendor's own figure
Rating4.8/53,221 reviews
Price from$12/yrPremium
Last updated29 Oct 2026Version 6.91
Overview
CleanTalk Spam Protection (listed on WordPress.org as Anti-Spam by CleanTalk) is a software-as-a-service anti-spam plugin. The plugin is free to download, but it only works with an access key for CleanTalk’s cloud service, which costs from $12 per year for one site after a free trial. In return it filters spam across almost every kind of form a WordPress site has, without showing visitors a CAPTCHA.
Detection combines several checks: a JavaScript test that most bots fail, submit-time analysis, an optional honeypot field, and a lookup of the sender’s IP, email and domain against CleanTalk’s large cloud database of spam activity. A sender is only blocked when several tests fail, which keeps false positives down. The separate SpamFireWall goes further by refusing known spam-bot IPs before WordPress even renders the page, with optional Anti-Flood and Anti-Crawler limits.
Coverage
- Comments (including Jetpack and wpDiscuz), user registrations and the search form
- WooCommerce checkout, registrations during checkout and reviews
- Over 100 form, newsletter and booking plugins, including Contact Form 7, WPForms, Gravity Forms, Fluent Forms and Elementor forms
- bbPress, BuddyPress and Asgaros Forum
Management tools are strong for the price: bulk checkers to find existing spam comments and spam users, personal block and allow lists, role and URL exclusions, email existence checks, and a cloud dashboard with logs and stats for every connected site. Agencies can run many sites from one account, and multisite networks can share a global access key.
The trade-offs are the service dependency and some paywalled extras. Everything is processed on CleanTalk’s servers, the plugin stops filtering if the subscription lapses, and the default log only goes back seven days. Country blocking, stop-words, custom block messages and the 45-day log are in the Extra Package, which costs another 50% of the licence. Login brute-force protection belongs to CleanTalk’s separate Security service rather than this plugin.
CleanTalk is a good fit for site owners and agencies who want broad, invisible spam protection across forms, comments and WooCommerce for a small yearly fee, and who are comfortable relying on a hosted service.
Best for: Site owners and agencies who want invisible spam protection across every form, comment and WooCommerce page for a small annual fee.
CleanTalk offers some of the broadest form coverage in the category at a very low price, and it keeps visitors free of CAPTCHAs. You are tied to its cloud service and a yearly bill, and a few useful controls sit behind the Extra Package, but for most sites it is good value.
Pros
- Protects comments, registrations, WooCommerce and 100+ form plugins from one plugin
- No CAPTCHA, so there is no friction for real visitors
- SpamFireWall blocks known spam bots before pages load
- Bulk tools find existing spam comments and fake user accounts
- Very low price from $12/year, with one dashboard for many sites
Cons
- Stops working without a paid subscription after the trial
- All checks rely on CleanTalk's cloud servers
- Country blocking, stop-words and custom messages cost extra (Extra Package)
- Default log history is only 7 days
- Login brute-force protection needs CleanTalk's separate Security plugin
Key features
What CleanTalk Spam Protection highlights on its WordPress.org page and its own website, split by version.
Included features From $12/yr
- Spam protection without CAPTCHA
- Comments, registrations and search form
- WooCommerce checkout and review checks
- 100+ form plugins supported
- SpamFireWall blocks known bots
- Anti-Flood and Anti-Crawler limits
- Real-time email validation
- Bulk spam comment and user checker
- Personal IP and email block lists
- Cloud dashboard with logs and stats
- Multisite global access key
- Extra Package: country block and stop-words
Feature checklist
40 of 46 features we track in CAPTCHA & Spam, feature score 85/100
Protection methods 3/7
Google reCAPTCHA Key
Supports Google reCAPTCHA (v2 checkbox, invisible or v3 score-based).
Designed as a CAPTCHA-free alternative; no reCAPTCHA option.
Not included
Cloudflare Turnstile Key
Supports Cloudflare Turnstile, the privacy-friendly CAPTCHA alternative.
No Cloudflare Turnstile option.
Not included
hCaptcha
Supports hCaptcha challenges.
No hCaptcha option.
Not included
Built-in CAPTCHA
Own image, math or puzzle CAPTCHA with no third-party service.
No image or math CAPTCHA; protection is invisible.
Not included
Honeypot fields
Hidden fields and timing checks that catch bots without a visible challenge.
Optional hidden honeypot field for supported forms, alongside JS and timing tests.
Included
Cloud spam filtering Key
Submissions checked against a cloud spam database of known spammers.
IP, email and domain checked against CleanTalk's cloud database of spam activity.
Included
No challenge for real users
Blocks bots without asking visitors to solve anything.
Background JavaScript, timing and database tests with nothing for visitors to solve.
Included
Where it protects 7/7
Comments Key
Protects WordPress comments from spam.
Filters WordPress, Jetpack and wpDiscuz comments; can bulk-check existing comments.
Included
Login & password reset Key
Protects the login and lost-password forms.
Login brute-force defence is in CleanTalk's separate paid Security plugin; SpamFireWall still blocks known bot IPs.
Via add-on
Registration
Protects the user registration form.
Blocks spam sign-ups and can scan existing users for spam accounts.
Included
WooCommerce checkout & account Key
Protects WooCommerce checkout, login and registration forms.
Checks checkout, registration during checkout and reviews; can store blocked orders.
Included
Form plugin support Key
Works with popular form plugins such as Contact Form 7, WPForms or Gravity Forms.
100+ form plugins including CF7, WPForms, Gravity Forms, Fluent Forms, Formidable and Ninja Forms.
Included
Page builder forms
Protects forms built in Elementor, Divi or similar builders.
Elementor, Avada and Kadence Blocks forms are on the supported list.
Included
Community & membership plugins
Protects BuddyPress, bbPress, Ultimate Member or similar.
Supports bbPress, Asgaros Forum and BuddyPress (including private messages).
Included
Rules & controls 5/5
Block and allow lists
Block or allow specific IPs, emails, words or user roles.
Personal block/allow lists for IPs, subnets, emails and domains, plus role and URL exclusions.
Included
Country & language filters
Block submissions by country or language.
Country block list and stop-words come with the Extra Package (+50% of licence).
Paid version Extra Package
Spam log & statistics
Log of blocked submissions with counts and reasons.
Cloud dashboard logs every request for 7 days (45 days with Extra Package).
Included
Skip for logged-in users
Hide the challenge for logged-in or trusted users.
Logged-in users are skipped unless 'Protect logged in users' is on; roles can be excluded.
Included
Custom labels & error messages
Change challenge text, errors, theme or language.
Custom block response messages are an Extra Package feature.
Paid version Extra Package
Privacy & performance 2/4
Privacy & GDPR options
No tracking cookies, data minimisation or a documented GDPR mode.
Documented GDPR compliance, an option to stop setting cookies and field exclusions for personal data.
Included
Works without an external service
Core protection runs entirely on your own server.
SaaS: every check runs on CleanTalk's cloud servers.
Not included
Scripts load only where needed
CAPTCHA scripts are only loaded on pages that have a protected form.
Bot-detection script and SpamFireWall run site-wide by design, not only on form pages.
Not included
Multisite support
Works across a WordPress multisite network.
Multisite compatible, with per-site settings or a global access key for the network.
Included
Form & plugin integrations 17/17
Contact Form 7 Key
Protects Contact Form 7 forms.
Contact Form 7 submissions are filtered out of the box.
Included
WPForms
Protects WPForms forms.
Filters WPForms submissions for every form type.
Included
Gravity Forms
Protects Gravity Forms forms.
Gravity Forms is on the built-in supported forms list.
Included
Elementor Pro forms
Protects Elementor Pro form widgets.
Elementor forms are on the built-in supported forms list.
Included
Ninja Forms
Protects Ninja Forms forms.
Ninja Forms is on the built-in supported forms list.
Included
Formidable Forms
Protects Formidable Forms forms.
Formidable Forms is on the built-in supported forms list.
Included
Fluent Forms
Protects Fluent Forms forms.
Fluent Forms is on the built-in supported forms list.
Included
Forminator
Protects Forminator forms.
Forminator forms are on the built-in supported list, including multi-step forms.
Included
Divi contact forms
Protects Divi contact form modules.
Plugin code detects and checks Divi contact form module submissions.
Included
Easy Digital Downloads
Protects EDD checkout, login or registration.
Easy Digital Downloads is on the built-in supported list.
Included
BuddyPress
Protects BuddyPress registration and activity.
Checks BuddyPress registrations, plus a dedicated BuddyPress integration class.
Included
bbPress
Protects bbPress topics and replies.
bbPress is on the supported list; topics, replies and registrations are checked.
Included
Ultimate Member
Protects Ultimate Member login and registration.
Hooks Ultimate Member's registration submit to check new sign-ups for spam.
Included
MemberPress
Protects MemberPress signup and login.
Validates MemberPress signups via its registration check.
Included
Mailchimp for WP (MC4WP)
Protects MC4WP newsletter sign-up forms.
MC4WP: Mailchimp for WordPress is on the built-in supported list.
Included
wpDiscuz
Protects wpDiscuz comment forms.
wpDiscuz comments are on the built-in supported list.
Included
Custom forms & developer API
Protect any custom form via shortcode, function or hooks.
Protects custom and external forms via settings, plus a check_message API for custom code.
Included
Advanced protection 6/6
Bot firewall
Blocks known spam bots before pages load.
SpamFireWall blocks known spam bot IPs before they load site pages.
Included
Disposable email blocking
Rejects throwaway or fake email addresses.
Blocks disposable and temporary email addresses and checks emails exist.
Included
Card-testing protection
Stops bots testing stolen cards at WooCommerce checkout.
Checks checkout and add-payment-method submissions for bots; no dedicated card-testing rules.
Partial
REST API & XML-RPC protection
Blocks spam or abuse through the REST API or XML-RPC.
Blocks XML-RPC pingbacks and checks some plugin REST routes; no general API lockdown.
Partial
Spam review & false-positive recovery
Review blocked submissions and approve false positives.
Spam goes to the Spam folder, blocked orders can be stored and restored, and a cloud log lists requests.
Included
Test mode & debugging
Test keys, debug logs or a test mode to check setup safely.
Test with stop_email@example.com for forms and a special test IP for SpamFireWall.
Included
Pricing
Anti-Spam 1 site
$12per year1 site
Free trial first; all anti-spam features and SpamFireWall included.
Anti-Spam 3 sites
$24per year3 sites
Same features; volume pricing.
Anti-Spam 5 sites
$36per year5 sites
Same features; volume pricing.
Anti-Spam 10 sites
$69per year10 sites
Larger packs for 20/30/40 sites also listed ($115/$160/$200).
Anti-Spam Unlimited
$27per monthUnlimited
Monthly unlimited-sites plan; the Extra Package adds 50% of the licence price.
Prices are list prices from the vendor's site, checked 14 Oct 2026. Many vendors discount the first year.
How many sites use CleanTalk Spam Protection?
Free installs from WordPress.org, the vendor's own claim, and our estimate of paid installs.
Free version (WordPress.org)
200K+
Active installations reported by WordPress.org.
Vendor claim
1.1M+
Sites/users claimed on the vendor's website. source
Estimated active installs
~180K
Our estimate, see method below.
How we estimated this: The free connector plugin has about 250K active installs and needs a paid account; assuming 60% are on a paid plan gives 150K. The vendor claims 1.1M+ sites in total. Taking away about 250K free installs leaves 850K, and 80% of that is 680K. Vendor totals are loose, so we only move our figure part of the way toward it, from 150K to 180K. Likely range: 90K to 360K. This counts sites running the paid version, including sites whose licence has lapsed. Estimates are rough and based on public figures as of 14 Oct 2026.
Stats & health
Weekly downloads
123,528 downloads last week, 25.9M all time
Rating breakdown
| Version | 6.91 |
|---|---|
| Last updated | 29 Oct 2026 (5 days ago) |
| Tested up to | WordPress 7.1.4 |
| Requires | WordPress 4.7+, PHP 7.2+ |
| Support threads (2 months) | 59 of 61 resolved |
| On WordPress.org since | 18 May 2012 |
CleanTalk Spam Protection compared
CleanTalk Spam Protection/Simple Cloudflare Turnstile
CAPTCHA 4WP/CleanTalk Spam Protection
Advanced Google reCAPTCHA/CleanTalk Spam Protection
CleanTalk Spam Protection/WP Armour – Honeypot Anti Spam
CleanTalk Spam Protection/reCAPTCHA for WooCommerce
Antispam Bee/CleanTalk Spam ProtectionCleanTalk Spam Protection/hCaptcha for WordPress
Akismet Anti-spam/CleanTalk Spam Protection Alternatives to CleanTalk Spam Protection
Advanced Google reCAPTCHA
WebFactory's free CAPTCHA and login-protection plugin with reCAPTCHA and a built-in math CAPTCHA; WP Captcha PRO adds hCaptcha, Turnstile and a firewall.
81
Simple Cloudflare Turnstile
Free plugin that adds Cloudflare Turnstile CAPTCHA to WordPress, WooCommerce and 30+ form, membership and community plugins.
73
WP Armour – Honeypot Anti Spam
Honeypot anti-spam plugin that blocks bots on comments and many form plugins with no CAPTCHA, API key or external calls; Extended adds…
67
CAPTCHA 4WP
Freemium CAPTCHA plugin: free reCAPTCHA for core WordPress forms; Premium adds hCaptcha, Turnstile, WooCommerce, form plugins and geoblocking.
67
Akismet Anti-spam
Automattic's cloud spam filter for WordPress comments and many form plugins; free keys for personal sites, paid plans for commercial use.
43
FAQ
Is CleanTalk Spam Protection free?
No. CleanTalk Spam Protection is a premium plugin. Paid plans start at $12/yr.
How many sites use CleanTalk Spam Protection?
WordPress.org reports 200K+ active installations of the free version. The vendor claims 1.1M+ sites in total. We estimate around 180K active installs.
Does CleanTalk Spam Protection have google recaptcha?
No: not included. Designed as a CAPTCHA-free alternative; no reCAPTCHA option.
Does CleanTalk Spam Protection have cloudflare turnstile?
No: not included. No Cloudflare Turnstile option.
Does CleanTalk Spam Protection have cloud spam filtering?
Yes: included. IP, email and domain checked against CleanTalk's cloud database of spam activity.
Does CleanTalk Spam Protection have comments?
Yes: included. Filters WordPress, Jetpack and wpDiscuz comments; can bulk-check existing comments.
Does CleanTalk Spam Protection have login & password reset?
Yes: via add-on. Login brute-force defence is in CleanTalk's separate paid Security plugin; SpamFireWall still blocks known bot IPs.
Does CleanTalk Spam Protection have woocommerce checkout & account?
Yes: included. Checks checkout, registration during checkout and reviews; can store blocked orders.
Does CleanTalk Spam Protection have form plugin support?
Yes: included. 100+ form plugins including CF7, WPForms, Gravity Forms, Fluent Forms, Formidable and Ninja Forms.
Does CleanTalk Spam Protection have contact form 7?
Yes: included. Contact Form 7 submissions are filtered out of the box.
Is CleanTalk free?
The plugin is free to install, but it relies on CleanTalk's paid cloud service. After a free trial, protection costs from $12/year for one site.
Does CleanTalk use a CAPTCHA?
No. It analyses submissions in the background with JavaScript tests, submit timing, a honeypot and its cloud spam database, so visitors do not solve anything.
Can I block spam by country?
Yes, but country blocking, stop-words, custom block messages and the 45-day log are part of the Extra Package, which costs 50% of your licence price.
Does it protect WooCommerce?
Yes. It checks the checkout form, registrations made during checkout and product reviews, and can store blocked orders for review.
Does it work on multisite?
Yes. Each subsite can have its own settings, or you can define a global access key in wp-config.php for the whole network.
Last updated 6 Oct 2026. Spotted something wrong? Suggest an edit.