Newsletters: CAPTCHA Settings

Newsletters > Configuration > System > CAPTCHA Settings

Choose and configure one of many CAPTCHA methods that our Tribulant WordPress Newsletter plugin supports to protect your subscribe forms from bots submitting spam subscriptions. We support the following:

• Really Simple CAPTCHA
• Google reCAPTCHA v2
• Google reCAPTCHA v3 (PRO only)
• hCaptcha (PRO only)
• Cloudflare Turnstile (PRO only)

PRO only: Available only for users of our paid Newsletter plugin.

 

Install and Activate Certain Plugins

When you first get to the CAPTCHA settings page, you’ll see the below, depending on which plugin is installed/activated. You can install them under Plugins > Add New just like any other WordPress plugin but the Tribulant Newsletter plugin comes with an installer utility to quickly and easily install and activate them.

Those buttons would install and/or activate the plugins Really Simple CAPTCHA and hCaptcha for WP. If both are installed and activated, they will no longer appear.

Important: If you do not intend on using one of those two CAPTCHA types, you do not have to install nor activate them.

Our other integrations do not require a plugin and work immediately after entering your keys.

 

Plugins to install:

Plugins to activate:

 

Here’s an example of our older interface, showing how you can install and activate Really Simply CAPTCHA.

 

CAPTCHA Types

Choose the type of CAPTCHA you want to use as a security image on subscribe forms. You can turn it off by choosing None.

 

Really Simple CAPTCHA

To use Really Simple CAPTCHA with our Tribulant WordPress Newsletter plugin, make sure to first select it from the CAPTCHA Settings page, as seen below, and then save.

Then, install and activate the Really Simple CAPTCHA plugin (see the Install and Activate Certain Plugins section above) and configure it.

1. Preview

This is a preview of what your CAPTCHA will look like on your front-end, based on the configured settings below.

2. Background Color

Set a background color for the CAPTCHA image.

3. Text Color

Set the text color for the CAPTCHA image.

4. Image Size

Enter size values for your CAPTCHA image.

5. Number of Characters

Choose the amount of characters that you want to use in your CAPTCHA image. The higher the number, the more complicated for spammers, but the more your legitimate visitors will have to enter.

6. Font Size

Choose a size for your font in the CAPTCHA image.

7. Cleanup Interval

Select an interval at which old CAPTCHA images will be removed from the server.

 

Google reCAPTCHA v2

To use Google reCAPTCHA v2 with our Tribulant WordPress Newsletter plugin, make sure to first select it from the CAPTCHA Settings page, as seen below, and then save.

1. reCAPTCHA Type

Choose between the I’m not a robot type, which adds a checkbox to the form that must be clicked, and the Invisible type, which works in the background to protect your form from spam. Invisible will add a badge on the edge of your screen.

2. Site Key

In order to use reCAPTCHA v2, the site key is required. Go to the reCAPTCHA page and create a set of keys for your domain.

3. Secret Key

In order to use reCAPTCHA v2, the secret key is required. Go to the reCAPTCHA page and create a set of keys for your domain.

4. Language

Set the language in which you want to display the CAPTCHA. Here’s a list of language codes to choose from.

5. Theme

Select the reCAPTCHA theme that you want to use.

 

Google reCAPTCHA v3

To use Google reCAPTCHA v3 with our Tribulant WordPress Newsletter plugin, make sure to first select it from the CAPTCHA Settings page, as seen below, and then save.

This uses the Invisible type of reCAPTCHA and a score treshhold that works in the background to protect your form from spam. This adds a badge on the edge of your screen.

1. Site Key

In order to use reCAPTCHA v3, the site key is required. Go to the reCAPTCHA page and create a set of keys for your domain.

2. Secret Key

In order to use reCAPTCHA v3, the secret key is required. Go to the reCAPTCHA page and create a set of keys for your domain.

3. Language

Set the language in which you want to display the CAPTCHA. Here’s a list of language codes to choose from.

4. Score Threshold

reCAPTCHA v3 returns a score (0.0 to 1.0) indicating the likelihood that a user is a bot. Set a threshold to determine when to accept or reject a submission. A lower threshold increases security but may reject more legitimate users.

The score itself doesn’t directly “stop” bots or humans, it’s simply a measure of how likely the user is to be a bot or a human, based on their behavior.

• A score closer to 0.0 means the user behaves more like a bot. If your threshold is set low (e.g., 0.2), you’re being lenient and might let through behaviors that seem more bot-like.
• A score closer to 1.0 means the user behaves more like a human. If your threshold is set high (e.g., 0.8), you’re demanding strong human-like behavior and might block anything that seems suspiciously bot-like, even some humans who exhibit unusual browsing habits.

So, if you set the threshold higher, you make it harder for bots to pass, but risk stopping humans with less conventional behavior. If you set it lower, you let more borderline behavior through, which could include spammers. The score itself is neutral; it’s the threshold you choose that determines who gets stopped.

For example, a score of 0.2 in reCAPTCHA v3 generally indicates that the behavior is more likely to be a bot rather than a human. It’s not definitive proof, but it signals that the interaction exhibited patterns typically associated with automated activity, such as unnatural mouse movements, unusual browsing behavior, or other characteristics.

When the threshold is set lower, it essentially means the website is being more lenient about what behaviors it considers legitimate. For example:

• If the threshold is set at 0.3, even interactions that appear somewhat suspicious (e.g., behaviors that resemble bots) might be treated as acceptable and allowed through.
• This leniency can inadvertently provide an opportunity for more spammers or automated bots to bypass the system because their interactions may still score slightly above the low threshold.

Think of it as widening the gate. Lowering the score lets more traffic through, but some of that traffic might include spammers disguised as legitimate users. On the other hand, setting a higher threshold (e.g., 0.5 or 0.7) demands more human-like behavior, making it harder for bots to pass unnoticed.

Balancing the threshold is key. If it’s too strict, it might block genuine users. If it’s too lenient, it might let bots or spammers slip through. Many website owners experiment with thresholds to find the sweet spot for their audience and use case.

 

hCaptcha

To use hCaptcha with our Tribulant WordPress Newsletter plugin, make sure to first select it from the CAPTCHA Settings page, as seen below, and then save.

Then, install and activate the hCaptcha for WP plugin (see the Install and Activate Certain Plugins section above), follow the instructions there and configure it there. That’s all there is to do.

 

Cloudflare Turnstile

To use Cloudflare Turnstile with our Tribulant WordPress Newsletter plugin, make sure to first select it from the CAPTCHA Settings page, as seen below, and then save.

Then, navigate to the Cloudflare Turnstile dashboard, create a free account if you do not have one, and get your API keys.

1. Site Key

Enter the site key.

2. Secret Key

Enter the secret key.

 

Troubleshooting

• If Google reCAPTCHA is not working with our Newsletter plugin, you may be using WPForms or another reCAPTCHA plugin that interferes with our integration. In the case of WPForms, make sure that No-conflict Mode is turned off in WPForms > Settings > CAPTCHA > reCAPTCHA since it doesn’t allow our plugin’s reCAPTCHA to enqueue the necessary JavaScript file.
• If you use Google reCAPTCHA v2 invisible or Google reCAPTCHA v3, and you notice on your front-end that you do not see the reCAPTCHA badge on the edge of your screen, then a plugin may be hiding it using its own CSS code. You could override it via CSS. We are aware of the third party plugin Profile Builder hiding it. There may be others, so keep that in mind.