Multi-Form Anti-Spam Image CAPTCHA is a free WordPress plugin that stops form spam with an image challenge. It works on every major form plugin and on core WordPress screens. No reCAPTCHA, no API keys, no data sent to anyone else.
We built it because reCAPTCHA asks too much. It hands your visitors’ data to Google, loads external scripts, and still lets plenty of bots through. This plugin runs entirely on your own server.
What it does
It adds an icon-selection CAPTCHA to your forms. Visitors pick the requested icon to submit. Every challenge is built server-side with a hashed answer, so bots cannot read the correct option from your page source.
Everything runs locally. No third-party services. No request quotas. No accounts to manage. That keeps it fast and GDPR-friendly, because it stores no personal data and makes no external requests.
Table of Contents
What it does
It adds an icon-selection CAPTCHA to your forms. Visitors pick the requested icon to submit. Every challenge is built server-side with a hashed answer, so bots cannot read the correct option from your page source.
Everything runs locally. No third-party services. No request quotas. No accounts to manage. That keeps it fast and GDPR-friendly, because it stores no personal data and makes no external requests.
Every feature is free
There is no paid tier. The plugin launched with a separate Pro version. We have since folded all of it into the free plugin on WordPress.org, so the upgrade you used to pay for is now the default.
Here is what you get:
- Image CAPTCHA with 780+ bundled icons and Font Awesome support
- Honeypot, plus a reverse honeypot that catches bots that auto-fill every field
- Submission-speed check that rejects bot-fast submissions
- Hashed, server-side validation with a per-render tamper token
- Full styling control: colors, sizes, layout, prompt text, and error messages
- Settings export and import across multiple sites
Get it now
It protects your whole site, not one form
Most CAPTCHA plugins lock to a single form builder. This one covers them all from one place.
Supported out of the box:
- Contact Form 7
- Gravity Forms
- WPForms
- Formidable Forms
- Elementor Pro Forms
- WooCommerce login, registration and classic checkout
- WordPress login, registration, lost password, and comments
One honest caveat on WooCommerce. The block-based Checkout Block is not supported yet. It submits orders through the WooCommerce Store API, which skips the hooks the CAPTCHA validates against. If you need checkout protection, switch the page back to the classic [woocommerce_checkout] shortcode.
How it blocks spam
The image challenge is one layer. Three more run behind it, so a bot has to beat all four.
- Hashed answers. The correct icon never appears in the markup.
- Honeypot and reverse honeypot. Hidden fields that trap bots that fill in everything.
- Speed check. Submissions completed faster than your threshold get rejected.
- Stale-key cleanup. Old CAPTCHA records purge automatically every 24 hours.
Most bots clear one or two of these. Few clear all four.
Image CAPTCHA vs reCAPTCHA vs invisible tools
Every spam approach trades something. Here is the honest comparison.
| Approach | No third-party data | No external requests | No visitor friction |
|---|---|---|---|
| This plugin (image CAPTCHA) | ✅ | ✅ | ❌ one extra step |
| reCAPTCHA | ❌ | ❌ | ✅ |
| Turnstile / hCaptcha | ❌ | ❌ | ✅ |
| Honeypot only | ✅ | ✅ | ✅ |
reCAPTCHA is close to invisible, but it ships your visitor data to Google and loads outside scripts. Turnstile and hCaptcha collect less, yet still depend on a third party. A honeypot adds zero friction, but on its own it struggles against modern bots.
Choose a visible image challenge when you want full control, no third party, and a block you can watch working.
What it does not do
A few honest limits, so you can decide if it fits.
- It shows a visible challenge. If you want zero friction, an invisible tool suits you better.
- It does not cover the WooCommerce Checkout Block yet.
- It is not a message-scoring service like Akismet. It blocks bots at submission. It does not read and rate the text inside a message.
Get it free
Download Multi-Form Anti-Spam Image CAPTCHA free on WordPress.org. Drop it into a form, watch the spam drop off, then turn it on across the rest of your site.
- Download: Multi-Form Anti-Spam Image CAPTCHA on WordPress.org
- Try the live demo: on the plugin page
FAQ
Is it free?
Yes. Every feature is free. There is no paid tier and no upsell.
Does it work without reCAPTCHA?
Yes. It uses no reCAPTCHA, no API keys, and no external requests. Validation runs on your server.
Which forms does it support?
Contact Form 7, Gravity Forms, WPForms, Formidable Forms, Elementor Pro Forms, WooCommerce login and registration, and WordPress login, registration, lost password, and comments.
Does it support WooCommerce checkout?
The classic [woocommerce_checkout] shortcode, yes. The block-based Checkout Block is not supported yet.
Is it GDPR compliant?
Yes. It stores no personal data and makes no external requests.
Is it accessible?
The challenge uses keyboard-navigable radio buttons with ARIA labels. An optional audio cue is available and ships off by default.
Part of the Plugin Brewery form toolkit
This plugin sits alongside our other form tools:
- Referral Source Tracking for Gravity Forms shows where each submission came from, including search, ads, social, and AI assistants.
- Address Autocomplete for Gravity Forms speeds up address entry with Google Places suggestions.
Together they help you protect your forms, keep your data clean, and see where your leads come from.