CAPTCHA Challenges
CAPTCHA challenge system with support for reCAPTCHA v2/v3, hCaptcha, and Cloudflare Turnstile.
CAPTCHA challenges
CAPTCHA is triggered when a checkout attempt's risk score reaches the CAPTCHA threshold. Instead of blocking the request, Checkout Security presents a challenge to verify that the user is human. This reduces false positives while still stopping automated requests.
CAPTCHA challenges are currently available for WooCommerce checkout flows only. If you use Easy Digital Downloads or FluentCart, CAPTCHA settings are saved but challenges are not presented at checkout. Fraud detection and risk scoring still work on all platforms.
Supported providers
Checkout Security supports four CAPTCHA providers. Select the provider with ccp_captcha_provider.
Google reCAPTCHA v2
Checkbox-based verification where users complete a visible challenge or visual task.
Google reCAPTCHA v3
Invisible, score-based verification that does not require user interaction.
hCaptcha
A privacy-focused alternative to Google reCAPTCHA that presents a challenge when needed.
Cloudflare Turnstile
No-click verification that requires minimal interaction from the customer.
Configuration
Configure CAPTCHA from the Checkout Security settings. The following options control when challenges appear and which provider handles verification.
Enables CAPTCHA protection. The default is no, so you must enable this option before Checkout Security presents challenges.
Selects the CAPTCHA provider. The default is turnstile.
recaptcha_v2recaptcha_v3hcaptchaturnstileSets the minimum risk score that triggers a CAPTCHA challenge. The default is 60.
Each provider requires a site key and secret key. Enter the keys for the selected provider in Settings → CAPTCHA.
CAPTCHA is disabled by default. Enable it and configure valid provider keys before use. Without valid API keys, CAPTCHA challenges will not render.
CAPTCHA threshold
Checkout Security compares each checkout attempt's risk score with ccp_captcha_risk_threshold. When the score meets or exceeds the configured threshold, Checkout Security presents a CAPTCHA challenge instead of allowing the normal checkout flow to continue.
If the customer solves the challenge successfully, checkout proceeds. If the customer does not complete the challenge, the request may be blocked or the order may be held for review based on the broader risk decision.
A lower threshold presents CAPTCHA challenges to more checkout attempts. A higher threshold limits challenges to attempts with higher risk scores.
Exemptions
Use ccp_captcha_exempt_roles to exempt selected user roles from CAPTCHA challenges. Trusted users and whitelisted IP addresses may also bypass CAPTCHA.
Recognized trusted devices can bypass the challenge as well. These exemptions reduce friction for customers and administrators whose activity already meets the site's trust requirements.