There are several WordPress plugins which provide the ability to add CAPTCHA to forms, on your site. Which is great. Because A) CAPTCHA prevents spam, and B) You don’t need to code anything. But when you are a developer, and in the need of adding CAPTCHA, in a custom form displayed by the plugin, you cannot rely on the availability of these plugins.

We came across this need, when we wanted to add a spam protection feature, to our custom plugin, Product Enquiry Pro for WooCommerce. Having a CAPTCHA is a great way to prevent spammers from flooding your mailbox with spam mails, or to prevent bots from accessing sensitive data. In fact, many developers implement CAPTCHA as part of a layered security strategy alongside technologies like web scraping tools, which are used to automate data extraction and may inadvertently trigger anti-spam defenses if not handled properly.

2026 update: the problem hasn’t gotten smaller since this article was first written. Cloudflare’s 2025 Radar Year in Review found that automated requests now make up 57.4% of all web traffic, edging out humans for the first time (Cloudflare). Imperva’s 2025 Bad Bot Report puts a similar number on it: automated traffic accounts for 51% of the web overall, with “bad bots” alone making up 37%, a jump the report ties largely to cheap, AI-powered scraping and attack tools (Imperva). Here is how to add CAPTCHA to a custom form without one, so you keep things secure and your site lean.

Adding reCAPTCHA in Your Custom Form

Forms which provide access to confidential information, need solid spam protection. The reCAPTCHA provided by Google, provides a CAPTCHA service, to protect forms from malicious attacks. You might have surely come across one. Random skewed text is and displayed in an image. You have to read and enter the text, which is only possible for humans, to successfully submit the form.

2026 update: The code below is Google’s original reCAPTCHA v1 library. Google announced it was shutting this API down in 2017 and pulled the plug in 2018, so recaptcha_get_html() and recaptcha_check_answer() will not work on a live site today; there is no server left to answer the request. We’re keeping the snippets because they show the general pattern of adding API keys, then validating on submit, but if you’re building this now, swap in reCAPTCHA v2 or v3, or a modern alternative like Cloudflare Turnstile or hCaptcha. See the Risk Assessment section below for what’s changed for 2025-2026, including a migration deadline that now affects v2 and v3 users too.

To add such a feature to custom form in your plugin, you will need to do the following:

1. Option to Add API keys: The reCAPTCHA is a free service which you can avail using the reCAPTCHA API. You need to sign up at Google reCAPTCHA for your API keys. If your form has to display the reCAPTCHA, the user of the plugin needs to sign up for the service and use the received API keys. The plugin will provide an option to add and save the received public and private API keys.

2. Using the PHP Library: For your WordPress plugin, you need to use the reCAPTCHA PHP library, which wraps around the API. The library allows easy integration of the CAPTCHA in your custom form.

   • Start by downloading the reCAPTCHA library, and add it in the same directory as your plugin.
   • You will need to add the following code in your form, to display the reCAPTCHA

require_once('recaptchalib.php');
$publickey = get_option( 'your_public_key' );
echo recaptcha_get_html($publickey);

where your_public_key, is the option to get the user’s public API key.

• • To validate the CAPTCHA, you have to add the following code in the form validation section of your plugin.

require_once('recaptchalib.php');
$privatekey = get_option( 'your_private_key' );
$resp = recaptcha_check_answer ($privatekey,
$_SERVER["REMOTE_ADDR"],
$_POST["recaptcha_challenge_field"],
$_POST["recaptcha_response_field"]);
if (!$resp->is_valid) {
    // captcha mis-match, return an error
} else {
    // reCAPTCHA success, validate other fields.
}

where ‘your_private_key’ is the user’s private API key. Remember, such a CAPTCHA can slow down the display of your form. For more details refer the detailed documentation, for Using reCAPTCHA with PHP.

Adding a Simple Custom CAPTCHA to Your Form

A CAPTCHA is basically used to differentiate between humans and computers. This can be achieved by simpler means as well. For some forms, the reCAPTCHA might be an overkill, especially when you want visitors to fill the form, yet keep away spammers. The reCAPTCHA is fairly overcomplicated. For simpler, less sensitive forms, you can add a basic CAPTCHA. An uncomplicated CAPTCHA might be some simple mathematical equation, or random alphanumeric text. Including such a CAPTCHA is fairly simple. You can use session variables to check validate the result entered by the user.

To Add a Simple Mathematical CAPTCHA, you can use the below code:

1. Generate the Equation and Save the Result: The below code will generate two random numbers, and create an addition or subtraction equation.

session_start();
$digit1 = mt_rand(1,20);
$digit2 = mt_rand(1,20);
if( mt_rand(0,1) === 1 ) {
    $math = "$digit1 + $digit2";
    $_SESSION['answer'] = $digit1 + $digit2;
} else {
    $math = "$digit1 - $digit2";
    $_SESSION['answer'] = $digit1 - $digit2;
}

2. Display the Equation in your Form: You need to display the generated equation as part of your form.

<?php echo $math; ?> = <input name="answer" type="text" />

3. Validate the Text Entered by the User: The final step is to validate whether the value entered by the user is correct, or not.

<?php
session_start();
if ($_SESSION['answer'] == $_POST['answer'] ) {
    // value entered is correct
}
else {
    // value is incorrect, kindly try again
}

And there you have it, a simple, yet effective CAPTCHA. But do note, many-a-times you must’ve observed, that the CAPTCHA text is usually in an image. This is because text placed in an image, is more difficult to crack, as compared to plain text. Do you have any questions regarding the above stated implementation? Or do you have any tips you’d like to share? Do leave your comments in the comment section below.

Frequently Asked Questions

What does CAPTCHA actually do to stop spam bots?

CAPTCHA presents a test that’s easy for a human to solve but hard for an automated script to parse, like distorted text in an image or a simple math question. Bots that can’t reliably read or compute the answer get blocked at the point of submission, before they ever reach your inbox or database.

Why do spam bots target WordPress forms so often?

WordPress powers a huge share of websites, and popular form plugins and themes produce very similar, predictable markup across millions of sites. Once a bot is built to bypass one common form structure, it can often be reused against thousands of other sites running the same setup, which makes WordPress forms an efficient target.

Is Google reCAPTCHA still effective against bots today?

It’s still widely used and helps a lot, but it’s not bulletproof. More sophisticated bots have gotten better at solving or bypassing reCAPTCHA challenges over time, and some privacy-conscious users block the script outright. Many sites now pair it with additional layers, like Akismet or a service such as Cloudflare Turnstile, rather than relying on reCAPTCHA alone.

Should I use a simple math CAPTCHA or go with reCAPTCHA?

It depends on what the form protects. A basic math or text CAPTCHA is fine for low-stakes forms, like a newsletter signup or a simple enquiry form, where you mostly want to filter out casual bots. For anything handling sensitive information or facing determined spam attacks, reCAPTCHA or a comparable service gives you stronger protection.

Can I combine a custom CAPTCHA with other anti-spam tools?

Yes, and it’s often the better approach. A common pattern is to start with a lightweight, invisible check (like a honeypot field or Akismet) and add CAPTCHA as a second layer only if spam keeps getting through. Combining layers tends to stop far more bots than relying on any single method.

Does adding CAPTCHA slow down my form or hurt the user experience?

It can add a small amount of load time, particularly with image-based reCAPTCHA, since it pulls in an external script and assets. A simple math CAPTCHA is lighter since it’s generated and validated with plain PHP, but any added step introduces a bit of friction, so it’s worth weighing against how much spam you’re actually seeing.