CAPTCHA Providers

In addition to ALTCHA, WP-ImmoMakler supports eight externally hosted CAPTCHAs as the second tier of spam protection: captcha.eu, Cloudflare Turnstile, Friendly Captcha in versions v2 and v1, hCaptcha, and Google reCAPTCHA in the v3, v2 (challenge), and v2 (invisible) variants.

Tip

ALTCHA is enabled by default: it runs entirely on your own server, is free, and requires no account with a third-party provider. Only choose one of the CAPTCHAs described here if you have a specific reason to — for example, because you already use it elsewhere on your website, or because ALTCHA’s protection isn’t sufficient. For an overview of both tiers of spam protection, see Spam Protection for Your Forms.

Data protection notice

Unlike ALTCHA, every CAPTCHA described here is an externally hosted third-party service: your visitor’s browser loads their script library, and your server transmits data (including your visitor’s IP address) to their server for verification. Please check whether you need to list the chosen provider in your privacy policy.

With Google reCAPTCHA, this data is transferred to the United States. Check in advance whether this is compatible with your privacy policy and adjust it if necessary. captcha.eu, Cloudflare Turnstile, Friendly Captcha and hCaptcha all explicitly position themselves as more privacy-friendly alternatives to Google reCAPTCHA — even so, check their current privacy policies yourself before deciding on a service.

Among these, captcha.eu is the only service that processes data exclusively in the EU without requiring a specific plan for it: the provider operates its servers in Austria. With Friendly Captcha, EU-only processing is also possible, but tied to the “Advanced” and “Enterprise” plans (see below).

Setup

Select the desired CAPTCHA from the list in your website’s backend (wp-admin) under WP-ImmoMakler → Settings → Spam Protection → Level 2: CAPTCHA Providers. Below it are three fields for the credentials, which are the same for every provider:

• Sitekey – the public key your visitors’ browsers use. captcha.eu calls it the “Public Key”, Google the “Site Key”.
• Secret Key – the secret key your website uses to have the solution verified with the provider. At captcha.eu this is the “REST Key”, at Friendly Captcha the “API Key”, and for “Google reCAPTCHA – Google Cloud” the API key of the Cloud project.
• Google-Cloud-Projekt-ID – only for the “Google reCAPTCHA – Google Cloud” variants; all other providers leave this field unused.

Which values go into which field therefore depends entirely on the provider you choose – the individual sections below tell you. ALTCHA needs no credentials. If you switch providers, replace the values in the fields with those of the new provider.

Credential check

As soon as a provider is selected and its credentials are saved, WP-ImmoMakler verifies them on the same page: the provider’s widget appears at the bottom of the tab – the very same one your visitors see in the forms – and WP-ImmoMakler has the provider verify the solution it returns, just as with a real request. The result appears immediately as a notice at the top of the page. If the widget runs on its own (ALTCHA, captcha.eu, Friendly Captcha, Google reCAPTCHA v3, Turnstile in invisible mode), this takes only a few seconds; if it shows a checkbox, click it once.

The result stays saved as long as the credentials remain unchanged: a green checkmark on the tab and on the checked fields means the provider accepted the solution. If it rejects the solution, a red dot on the tab and in the WP-ImmoMakler menu, a red cross on the field the provider’s response points to, and a notice on every WP-ImmoMakler page tell you what’s wrong – for example, that Google doesn’t recognise the Sitekey or Cloudflare rejects the Secret Key. As soon as you change a value and save, WP-ImmoMakler checks again; you can repeat the check at any time via “Check again”.

The setting applies to all of the plugin’s forms:

• the contact form in the property detail view
• the property alert form
• the withdrawal form
• the Propstack search profile form and the Propstack newsletter sign-up

Caution

All CAPTCHAs require JavaScript. Visitors with JavaScript disabled or blocked will not be able to submit a form with CAPTCHA protection enabled.

Note

Each widget automatically appears in your website’s current display language (e.g. German, English, Spanish, or French) rather than your visitor’s browser language. No additional setting is required for this.

captcha.eu

captcha.eu is an Austrian provider. The service works invisibly: your visitors see no widget, don’t have to click anything, and don’t have to type anything. In the background, the browser solves a computational task whose result WP-ImmoMakler verifies when the form is submitted. The service does not set cookies.

In your captcha.eu account, first create an entry for your website’s domain – if the domain on file doesn’t match your website’s address, captcha.eu rejects the check. Then, in your website’s backend (wp-admin) under WP-ImmoMakler → Settings → Spam Protection, enter the Public Key from your account as the Sitekey and the REST Key as the Secret Key.

Direct route to Austria

WP-ImmoMakler deliberately connects to captcha.eu via the direct route to the provider’s Austrian servers – not via the worldwide content delivery network (CDN) that captcha.eu places in front in its standard integration. Your visitors’ browsers load the script from the Austrian servers, and your website verifies the solution there as well. This means there is no additional service provider between your website, your visitors, and captcha.eu.

We made this decision for data protection reasons: the path your visitors’ data takes is shorter and more clearly documented this way, which correspondingly simplifies the answer in your privacy policy. There is no setting for this – the direct route is permanently built in.

This comes at no cost in speed: in our measurements against the live service, the direct route was actually somewhat faster than captcha.eu’s CDN route – both over a German DSL connection (averaging around 12.7 versus 16.9 seconds per solve) and over a Danish mobile network (around 14.1 versus 16.2 seconds). The solution is computed in the background while your visitors fill in the form; they don’t have to wait for it.

Cloudflare Turnstile

Cloudflare Turnstile usually verifies visitors without any visible interaction at all. Whether the widget appears visibly or runs invisibly in the background is set directly in your Cloudflare account on the sitekey itself (“Managed”, “Non-Interactive” or “Invisible”) — WP-ImmoMakler needs no setting of its own for this.

In your Cloudflare account, under “Turnstile”, create a Sitekey and a Secret Key and enter both under WP-ImmoMakler → Settings → Spam Protection into the fields of the same name.

Friendly Captcha

Friendly Captcha is a European provider that relies on privacy-friendly proof-of-work challenges instead of behavioural analysis.

You’ll find the Sitekey in your Friendly Captcha account under the relevant application; the API Key is created separately, on the “API Keys” page of the same account. In the backend of your website (wp-admin) under WP-ImmoMakler → Settings → Spam Protection, enter the Sitekey as the Sitekey and the API Key as the Secret Key.

Friendly Captcha offers two versions of its service, v1 and v2, which you enable individually for each application in your Friendly Captcha account. That is why “Level 2: CAPTCHA provider” lists each version as an entry of its own: “Friendly Captcha v2” and “Friendly Captcha v1”. Both use the same Sitekey and Secret Key fields. If the CAPTCHA in your forms shows “Friendly Captcha v2 ist nicht aktiviert”, only v1 is enabled for your application: either choose “Friendly Captcha v1”, or enable v2 in your Friendly Captcha account.

WP-ImmoMakler serves the widget script from your own server rather than from a content delivery network (CDN). This means your visitors’ browsers don’t contact an additional provider that has nothing to do with the CAPTCHA itself. Friendly Captcha itself is unaffected by this: the challenge is still loaded from and verified by Friendly Captcha’s servers, so the service still belongs in your privacy policy.

Under “Friendly Captcha: Server Region”, you choose which Friendly Captcha servers your website talks to. The default is “Worldwide”. With “EU only (Germany)”, all requests stay within the EU – however, Friendly Captcha only offers this region on its “Advanced” and “Enterprise” plans, and you also need to enable it for your sitekey in your Friendly Captcha account. If either condition isn’t met, verification fails and nobody will be able to submit your forms.

hCaptcha

hCaptcha is a widely used provider with a classic click widget as a visible challenge.

In your hCaptcha account, create a Sitekey and a Secret Key and enter both under WP-ImmoMakler → Settings → Spam Protection into the fields of the same name.

Google reCAPTCHA

Google reCAPTCHA is available in three variants. You create the credentials for it in the Google Cloud Console, in the reCAPTCHA section — this requires a Google Cloud project. The former reCAPTCHA admin console at google.com/recaptcha/admin no longer issues new Site Keys; Google has migrated existing Site Keys into Cloud projects.

Each variant requires its own Site Key, which you enter as the Sitekey.

Two ways to connect reCAPTCHA

Google offers two ways for your website to have a request verified. WP-ImmoMakler supports both, which is why each variant appears twice in the list of providers:

• ”… – Secret Key” (classic path): Enter the Secret Key of your Site Key as the Secret Key. You’ll find it in the Google Cloud Console, on your Site Key’s detail page, under the “Integration” tab, at the option for the legacy key. This is the significantly simpler setup — a Secret Key is just a string to copy — and Google continues to support it.
• ”… – Google Cloud” (current path): Enter an API Key of your Google Cloud project as the Secret Key, and the project’s ID under “Google-Cloud-Projekt-ID”. You create the API Key in the Google Cloud Console under “APIs & Services” → “Credentials”; restrict it there to the reCAPTCHA API so it can’t be used for other services in your project. This is the path Google continues to develop.

Tip

The values look different, and that helps tell them apart: Site Key and Secret Key both start with 6L and are 40 characters long; the Project ID looks like mein-projekt-123456; an API Key starts with AIza. The credential check tells you immediately if Google rejects a value.

Caution

Google charges for reCAPTCHA verifications: 10,000 verifications per calendar month and organization are free; beyond that, you need to enable billing in your Google Cloud project. If billing isn’t enabled, Google rejects every further verification — meaning no form on your website can be submitted until the start of the next month. ALTCHA, which runs entirely on your own server, has no such limit.

v3

Invisibly assesses in the background how likely a submission is to come from a human, without your visitors having to click anything. Create the Site Key for a website with score-based assessment (in the old reCAPTCHA admin console, this type was called “reCAPTCHA v3”). If the score is too low, the request is rejected; the minimum score can be adjusted via the immomakler_recaptcha_v3_min_score filter (default 0.5, range 0.0–1.0).

v2 (challenge)

The classic “I’m not a robot” checkbox, which occasionally follows up with an image puzzle. Create the Site Key for a website with challenge-based assessment and checkbox display (in the old reCAPTCHA admin console: “reCAPTCHA v2” with the “I’m not a robot” checkbox option).

v2 (invisible)

Runs in the background without a visible checkbox and shows an image puzzle only when necessary. Create the Site Key for a website with challenge-based assessment and invisible display (in the old reCAPTCHA admin console: “reCAPTCHA v2” with the “Invisible reCAPTCHA badge” option).

You might also be interested in

• ALTCHA
• Spam protection for your forms
• Contact Form
• Withdrawal button and withdrawal form