WordPress login CAPTCHA alternative: a hidden bot check
The best WordPress login CAPTCHA alternative is a check the visitor never sees: a hidden field and a clock on the form, which refuse the simplest scripts and ask people for nothing. BetterShield’s Refuse obviously automated submissions does exactly that on the sign-in, registration and comment forms, it is on by default, and it needs no account, no outside service and no JavaScript.
It is one layer, not the whole answer. Limit login attempts in WordPress without locking yourself out covers the layer that handles scripts which get past it; this post adds the detail on the quiet check that runs first, what it refuses, what it leaves alone and how to see it working.
Quick summary
- Refuse obviously automated submissions adds a hidden text field and a signed timestamp to the sign-in, registration and comment forms. It is on by default under Sign-in protection on BetterShield › Protection › Login & Access.
- A submission is refused if the hidden field comes back filled in, if the timestamp is empty, altered or not signed by this site, or if it arrives less than two seconds after the form was drawn.
- People see nothing and solve nothing. A cached page or a tab left open for an hour still works, because an old timestamp is fine.
- In the screen’s own words, it cuts bot noise; it does not stop a targeted attacker. Sign-in lockouts and public form limits handle the scripts it does not catch.
- It is never added to the WooCommerce cart or checkout.
Why people look for a CAPTCHA alternative
A CAPTCHA asks every visitor to prove they are a person, and the cost lands on people: an extra step on every sign-in, a picture to squint at, a widget that has to load before the form works. On a membership site or a store, that is friction in front of the customers you want.
The goal behind a CAPTCHA is narrower than it sounds. Most of the automated traffic that reaches a sign-in form is simple: a script that fills in every field it finds and submits as fast as it can. You do not need a puzzle to turn that away. You need a check that a script fails by behaving like a script and a person passes by behaving like a person. That is the idea behind a hidden field and a clock.
How the hidden bot check works
The check adds two things to each form it covers, and both are invisible to people.
- A hidden field. A text field labelled “Leave this field empty” that people never see. It is hidden where it stands, out of the tab order and hidden from screen readers. A script that fills in every field it finds fills this one too, and gives itself away.
- A signed timestamp. The form carries the time it was drawn, signed by your site. A script that skips it, edits it or makes one up fails, and so does a submission that arrives less than two seconds after the form was drawn, faster than a person could read it.
A submission is refused when any of these happens:
- the hidden field comes back filled in;
- the timestamp is empty, altered or not signed by this site;
- it arrives less than two seconds after the form was drawn.
An old timestamp is fine, so a cached page, or a tab left open for an hour, still works. A submission with no timestamp field at all is treated as a form BetterShield did not draw, and is not checked.
Where it checks, and what a refused visitor sees
| Form | When it checks | What a refused submission sees |
|---|---|---|
| WordPress sign-in, and the WooCommerce My Account sign-in form | Only when the password was right. A wrong password fails the usual way. | “That was sent a moment after the page opened, which is quicker than this site lets a sign-in through. Wait a second, then sign in again.” when it only came too fast; otherwise “That did not go through. Please try signing in again.” |
| WordPress registration, and the WooCommerce My Account registration form | Every submission | “That did not go through. Please try again.” |
| Comment form | Signed-out commenters only | A page titled “Comment not posted”: “That did not go through. Please go back and try again.” |
It is never added to the WooCommerce cart or checkout, and it does not check accounts created there. A refusal never counts toward a sign-in pause, and the check applies to every visitor, addresses on Always allowed included.
What the hidden check does not catch
The honest part of any bot check is its limit, and the screen states it plainly: it cuts bot noise, and it does not stop a targeted attacker. A script written for your site in particular can leave the hidden field empty and wait two seconds. That is why this is one layer of several.
It also cannot see forms BetterShield did not draw: a sign-in form drawn by a theme or page builder rather than the WordPress sign-in page or WooCommerce’s My Account, XML-RPC, application passwords and the REST API. Those forms carry no hidden field, so they are not checked rather than refused, and nothing breaks there. Sign-in pauses still cover them.
How to turn it on, or check that it is on
It is on from the day you activate BetterShield, so on most sites the job is checking it.
- Open BetterShield › Protection › Login & Access.
- Under Sign-in protection, find Refuse obviously automated submissions. The row reads On by default.
- To change it, switch it and press Save.
| Option | What it does | Default |
|---|---|---|
| Refuse obviously automated submissions | Adds the hidden field and clock to the sign-in, registration and comment forms, and refuses submissions that fail them. | On |
What it can break, and how to undo
A check that people never see can still get in the way in one situation, and it is worth knowing about.
- Instant auto-submit. A password manager or browser extension that fills the sign-in form and submits it within two seconds of the page loading is refused, and the form says it was sent too soon and to wait a second. Pressing sign in again a moment later works. Turning off auto-submit in that tool stops it happening.
- Forms it cannot see. A custom form is not checked, so nothing breaks there, but nothing is caught either.
- Turning it off. Switch Refuse obviously automated submissions off and press Save. With Ask for my password before an action that removes a protection on, that asks for your password. Safe mode also pauses it while it lasts.
If you are ever kept out of your own site, Locked out of WordPress? How to get back in without FTP covers every way back in.
How to check that it is working
- The form itself. View the source of your sign-in page, or of a post with comments open, and look for “Leave this field empty”.
- The activity log. Refusals are recorded as “Automated submission refused”. In a flood of more than 500 an hour, the rest of that hour are counted rather than listed one by one.
- The switch. The row under Sign-in protection reads On, and the count in the card’s header, such as “2 of 4 on”, includes it.
What to pair it with
We recommend keeping it on, and pairing it with the layers that handle what it misses.
- Sign-in lockouts. Sign-in attempt limits is on by default: it pauses the connection that keeps getting the password wrong, never the account.
- Public form limits. Under Request protection, comments, password reset requests and sign-ups each have their own limit, counted apart from sign-in. See Public form limits.
- The sign-in puzzle, if you want one. Ask for a sign-in puzzle after wrong passwords is off by default. After two wrong passwords from one connection, the next attempt waits while the browser works out a small calculation, and it only ever appears to a connection that has already failed. It needs JavaScript and a site on HTTPS.
- Cloudflare Turnstile, if you want a visible check. The paid add-on, BetterShield Ultra, can put Cloudflare Turnstile on the sign-in, sign-up and comment forms. It needs WordPress 7.0 or newer and works side by side with the free hidden check.
To see where the bot check sits among every sign-in layer, in order, read WordPress login security: the layers in order.
On a store, keep the hidden check on too: the cart and checkout are left alone.
Frequently asked questions
Do I need a CAPTCHA on my WordPress login page?
Not to turn away simple scripts. A hidden field and a clock refuse a script that fills in every field or submits within two seconds, and people notice nothing. A visible CAPTCHA is a choice about how much friction you accept for the scripts that remain.
Does the hidden bot check use JavaScript or an outside service?
No. It needs no JavaScript and no outside service. The field and the signed timestamp are added by your own site.
Will it stop a determined, targeted bot?
No, and BetterShield says so on the screen: it cuts bot noise and does not stop a targeted attacker. Keep Sign-in attempt limits on, and use two-factor for the accounts that matter.
Will it block real people?
Rarely. The main case is a password manager or extension that submits the sign-in form within two seconds of the page loading. The visitor is told to wait a second and sign in again, and the second try works.
Is it free?
Yes. It is in the free BetterShield plugin on WordPress.org, with no account needed.
Conclusion
A WordPress login CAPTCHA alternative does not have to be clever. A hidden field and a clock turn away the simplest scripts, cost visitors nothing and leave the forms exactly as they were. Keep Refuse obviously automated submissions on, pair it with sign-in lockouts and form limits, and treat it as the quiet first layer rather than the last.
BetterShield is free on WordPress.org. The full reference is the Hidden bot check guide.