Protect your multisite network from spam and card testing attacks with self-hosted captcha that works across unlimited domains—no API keys required.

Description

**Stop Bots. Protect Revenue. Zero Configuration Hassle.**

Running a multisite network with custom domains? You know the pain: Google reCAPTCHA and hCaptcha require you to register every single domain in their admin console. Add a new customer site? Update the captcha config. Map a custom domain? Update again. It never ends.

Ultimate Multisite: Captcha changes everything.

Cap Captcha: Self-Hosted Protection That Just Works

The new Cap Captcha library is a game-changer for multisite networks:

Zero API Keys Required — Enable it and you’re done. No Google account, no hCaptcha dashboard, no domain whitelisting.
Works on Every Domain Automatically — Subdomains, mapped domains, customer domains—they’re all protected instantly.
Self-Hosted & Private — Your data never leaves your server. Fully GDPR compliant with no third-party tracking.
Invisible Proof-of-Work — Users solve a computational puzzle in the background. No clicking fire hydrants, no frustrating image grids.
Lightweight — Just 20KB. Won’t slow down your checkout.

WooCommerce Card Testing Protection – For every site

Card testing attacks cost merchants billions annually. Fraudsters use bots to validate stolen credit cards against your WooCommerce checkout—you pay the processing fees, they get valid card numbers. PayPal in particular is a popular target.

We protect where it matters most:

Store API Protection — Blocks bot attacks on `/wp-json/wc/store/v1/checkout` that bypass traditional form captchas
PayPal Payments Compatible — Works seamlessly with WooCommerce PayPal Payments
Real-Time Statistics — See exactly how many attacks you’re blocking

Still Need Google reCAPTCHA or hCaptcha?

We’ve got you covered. Full support for:

Google reCAPTCHA v2 (Checkbox)
Google reCAPTCHA v2 (Invisible)
Google reCAPTCHA v3 (Score-based)
hCaptcha (Standard)
hCaptcha (Invisible)

Switch between providers anytime from your network settings.

Built for Scale

Network-wide settings with per-site overrides
Statistics dashboard to monitor protection
Adjustable security levels (Fast, Medium, Maximum)
Developer-friendly with extensible provider architecture

Installation

1. Upload `ultimate-multisite-captcha` to your `/wp-content/plugins/` directory
2. Network Activate the plugin from the Network Admin plugins screen
3. Navigate to **Ultimate Multisite → Settings → Captcha**
4. Cap Captcha is enabled by default—you’re already protected!

Optional: To use Google reCAPTCHA or hCaptcha instead, select your preferred provider and enter your API keys.

Frequently Asked Questions

Do I need API keys for Cap Captcha?

No! Cap Captcha is completely self-hosted. Just enable it and your network is protected. No external accounts, no domain registration, no configuration headaches.

Will this slow down my checkout?

Cap Captcha is only 20KB and runs proof-of-work challenges in the background. Your customers won’t notice any delay.

Does this protect against card testing attacks?

Yes! Unlike traditional captchas that only protect HTML forms, our WooCommerce integration hooks directly into the Store API to block bot attacks at the API level—where most card testing attacks happen.

Can I use different captcha providers on different sites?

The captcha provider is set network-wide, but you can adjust difficulty settings based on your needs.

Is this GDPR compliant?

Cap Captcha is 100% self-hosted with no data sent to external services. For Google reCAPTCHA and hCaptcha, please review their respective privacy policies.

Changelog

Version: 1.2.0 - Released on 2026-01-21

* New: Cap Captcha - self-hosted proof-of-work captcha requiring no API keys
* New: Polymorphic captcha provider architecture for easy extensibility
* New: WooCommerce Store API checkout protection against card testing attacks
* New: Statistics tracking dashboard showing challenges, verifications, and blocked attacks
* New: Security level presets (Fast, Medium, Max) for Cap Captcha difficulty
* New: Abstract base classes for reCAPTCHA and hCaptcha providers
* Improved: Refactored codebase into modular provider classes
* Improved: Better separation of concerns with dedicated manager class
* Fixed: Security improvements for $_SERVER variable sanitization
* Fixed: PHPUnit test configuration for WordPress naming conventions

Version: 1.0.1 - Released on 2025-09-28

* Rename prefix to ultimate-multisite; update text domain; version bump.

Security

Ultimate Multisite: CAPTCHA Protection