CAPTCHA Providers

In addition to ALTCHA, WP-ImmoMakler supports six externally hosted CAPTCHAs as the second tier of spam protection: Cloudflare Turnstile, Friendly Captcha, hCaptcha, and Google reCAPTCHA in the v3, v2 (challenge), and v2 (invisible) variants.

Tip

ALTCHA runs entirely on your own server, is free, and requires no account with a third-party provider. Only choose one of the CAPTCHAs described here if you have a specific reason to — for example, because you already use it elsewhere on your website, or because ALTCHA’s protection isn’t sufficient. For an overview of both tiers of spam protection, see Spam Protection for Your Forms.

Data protection notice

Unlike ALTCHA, every CAPTCHA described here is an externally hosted third-party service: your visitor’s browser loads their script library, and your server transmits data (including your visitor’s IP address) to their server for verification. Please check whether you need to list the chosen provider in your privacy policy.

With Google reCAPTCHA, this data is transferred to the United States. Check in advance whether this is compatible with your privacy policy and adjust it if necessary. Cloudflare Turnstile, Friendly Captcha and hCaptcha all explicitly position themselves as more privacy-friendly alternatives to Google reCAPTCHA — even so, check their current privacy policies yourself before deciding on a service.

Setup

Select the desired CAPTCHA from the list in your website’s backend (wp-admin) under WP-ImmoMakler → Settings → Spam Protection → Level 2: CAPTCHA Providers. Then enter the chosen provider’s credentials into the corresponding fields on the same page — their exact names vary by provider (see the individual sections below). The fields for the other providers remain unused.

The setting applies to all of the plugin’s forms:

• the contact form in the property detail view
• the property alert form
• the withdrawal form

Caution

All CAPTCHAs require JavaScript. Visitors with JavaScript disabled or blocked will not be able to submit a form with CAPTCHA protection enabled.

Note

Each widget automatically appears in your website’s current display language (e.g. German, English, Spanish, or French) rather than your visitor’s browser language. No additional setting is required for this.

Cloudflare Turnstile

Cloudflare Turnstile usually verifies visitors without any visible interaction at all. Whether the widget appears visibly or runs invisibly in the background is set directly in your Cloudflare account on the sitekey itself (“Managed”, “Non-Interactive” or “Invisible”) — WP-ImmoMakler needs no setting of its own for this.

In your Cloudflare account, under “Turnstile”, create a sitekey and a secret key and enter both under WP-ImmoMakler → Settings → Spam Protection next to “Cloudflare Turnstile”.

Friendly Captcha

Friendly Captcha is a European provider that relies on privacy-friendly proof-of-work challenges instead of behavioural analysis.

You’ll find the sitekey in your Friendly Captcha account under the relevant application; the secret key (called the “API Key” in Friendly Captcha itself) is created separately, on the “API Keys” page of the same account. Enter both under WP-ImmoMakler → Settings → Spam Protection next to “Friendly Captcha”. WP-ImmoMakler uses Friendly Captcha version 2 – a sitekey from the older version 1 won’t work.

WP-ImmoMakler serves the widget script from your own server rather than from a content delivery network (CDN). This means your visitors’ browsers don’t contact an additional provider that has nothing to do with the CAPTCHA itself. Friendly Captcha itself is unaffected by this: the challenge is still loaded from and verified by Friendly Captcha’s servers, so the service still belongs in your privacy policy.

Under “Friendly Captcha: Server Region”, you choose which Friendly Captcha servers your website talks to. The default is “Worldwide”. With “EU only (Germany)”, all requests stay within the EU – however, Friendly Captcha only offers this region on its “Advanced” and “Enterprise” plans, and you also need to enable it for your sitekey in your Friendly Captcha account. If either condition isn’t met, verification fails and nobody will be able to submit your forms.

hCaptcha

hCaptcha is a widely used provider with a classic click widget as a visible challenge.

In your hCaptcha account, create a sitekey and a secret key and enter both under WP-ImmoMakler → Settings → Spam Protection next to “hCaptcha”.

Google reCAPTCHA

Google reCAPTCHA is available in three variants, each of which you set up separately in the Google reCAPTCHA admin console. Each variant requires its own Site Key and Secret Key (that’s what Google itself calls these two values in the admin console).

v3

Invisibly assesses in the background how likely a submission is to come from a human, without your visitors having to click anything. Create the Site Key with the type “reCAPTCHA v3”. If the score is too low, the request is rejected; the minimum score can be adjusted via the immomakler_recaptcha_v3_min_score filter (default 0.5, range 0.0–1.0).

v2 (challenge)

The classic “I’m not a robot” checkbox, which occasionally follows up with an image puzzle. Create the Site Key with the type “reCAPTCHA v2” and the “I’m not a robot” checkbox option.

v2 (invisible)

Runs in the background without a visible checkbox and shows an image puzzle only when necessary. Create the Site Key with the type “reCAPTCHA v2” and the “Invisible reCAPTCHA badge” option.

Enter the respective Site Key and Secret Key under WP-ImmoMakler → Settings → Spam Protection next to the chosen reCAPTCHA variant.

You might also be interested in

• ALTCHA
• Spam protection for your forms
• Contact Form
• Withdrawal button and withdrawal form