Add CAPTCHA to the WordPress Login Page: Turnstile and reCAPTCHA

This article is a localized edition of the Japanese original. Read the Japanese original

The WordPress login page (wp-login.php) is a common target for bots that try passwords by brute force. Adding a CAPTCHA (a check that the visitor is human) to the login page reduces automated login attempts by bots. This article shows how to add a CAPTCHA to the login page with free plugins distributed on WordPress.org. The information is current as of October 2026.

Which CAPTCHA to use

The two most common choices for the login page are Cloudflare Turnstile and Google reCAPTCHA.

With reCAPTCHA, note that if you exceed the limit without billing set up, assessments stop working (bots get through too). Turnstile suits high-traffic sites and anyone who wants a quick start. This article focuses on Turnstile and covers reCAPTCHA later.

Before you start: prepare a way back in if you get locked out

If you enter a key incorrectly, you can lock yourself out. Before you start, make sure you can disable the plugin in one of these ways.

• You can open wp-content/plugins/ with FTP or your host's file manager
• You can use WP-CLI over SSH

Also keep one browser logged in while you configure things, and test in a different browser or a private window.

Adding Cloudflare Turnstile

Step 1: Create a Turnstile widget and get the keys

Log in to the dashboard with a Cloudflare account (free to create) and follow these steps.

1. Open the "Turnstile" page and select "Add widget"
2. In "Widget name", enter a descriptive name (for example, your site name plus login)
3. In "Hostname management", add your WordPress site's domain (for example example.com)
4. Choose a "Widget mode". "Managed" asks for interaction only when needed; "Non-Interactive" and "Invisible" never ask for interaction
5. Select "Create"
6. Note the sitekey and secret key that are shown

The secret key is used only on the server. Do not show it to others or put it anywhere public. Turnstile works even if your site is not proxied through Cloudflare.

Step 2: Install the plugin

In the admin area, go to "Plugins" → "Add New Plugin", search for "Simple CAPTCHA with Cloudflare Turnstile", then install and activate it. With WP-CLI:

wp plugin install simple-cloudflare-turnstile --activate

Step 3: Enter the keys and show it on the login page

1. In the admin area, open "Settings" → "Cloudflare Turnstile"
2. Enter the sitekey and secret key you noted in Step 1
3. Choose the forms where Turnstile appears. For the login page, check the WordPress login form (WordPress Login Form). Select the registration and password reset forms too if needed
4. Click "Save Changes"
5. Click the "TEST API RESPONSE" button on the settings page to confirm the keys work

The plugin also has settings to hide the widget for logged-in users or specific IP addresses, and to let submissions through (or fall back to reCAPTCHA) when Cloudflare is down.

Step 4: Check that you can log in

Open the login page in a private window and check the following.

• The Turnstile widget appears on the login form
• You can log in with the correct username and password
• If you enabled password reset or registration, those forms can be submitted too

If you use a caching plugin or a CDN, clear the cache before checking.

Adding Google reCAPTCHA instead

As of October 2026, reCAPTCHA keys are created in the Google Cloud console. The old admin console can no longer create new "Classic" keys, and WordPress plugins use the legacy secret key taken from the key details of a key created in Google Cloud. Key creation and free-tier caveats are covered in How to set up reCAPTCHA v3 in WordPress: creating keys, Contact Form 7 and comments.

As the plugin, use "Advanced Google reCAPTCHA", which supports the login form, registration, password reset, comments and more.

wp plugin install advanced-google-recaptcha --activate

After activation, an "Advanced Google reCAPTCHA" menu is added to the admin area. Enter your keys there and choose the forms to protect. Make sure the reCAPTCHA type the plugin uses (v2 or v3) matches the type of key you created. Screen items can change between versions, so also check the plugin's description. Testing and recovering from a lockout work the same as with Turnstile.

If you can no longer log in

If you cannot log in because of a key typo or a problem on the Cloudflare or Google side, disable the plugin.

With FTP or a file manager, rename the plugin's folder inside wp-content/plugins/ (for example from simple-cloudflare-turnstile to simple-cloudflare-turnstile-off). WordPress can no longer load the plugin, so it is deactivated. Once you are logged in, rename the folder back, activate the plugin in the admin area and review its settings.

If you can use WP-CLI, deactivate it with the following command.

wp plugin deactivate simple-cloudflare-turnstile

# for reCAPTCHA
wp plugin deactivate advanced-google-recaptcha

What CAPTCHA alone does not stop

A CAPTCHA protects only the forms shown on screen. The following routes can attempt logins without passing the login page CAPTCHA.

• XML-RPC (xmlrpc.php): a mechanism used for things like posting from external apps, which authenticates by sending a username and password. If you do not use it, disable it or restrict access
• REST API application passwords: passwords issued for connecting external services are used without going through the login page. Revoke any you do not need under "Users" → "Profile" in "Application Passwords"

So use CAPTCHA together with these measures.

• Hard-to-guess passwords and two-factor authentication for administrator accounts
• A mechanism that temporarily blocks logins after repeated failures
• Disabling XML-RPC if you do not use it

Cautions

• CAPTCHA services send information from visitors' browsers to Cloudflare or Google. List the services you use in your privacy policy
• Keep the plugin updated, and delete it if you stop using it
• On sites with many users who log in, such as membership sites, settings that do not ask for interaction (such as Turnstile's "Managed" or "Invisible") reduce the burden

Summary

• A login page CAPTCHA reduces automated login attempts by bots
• Turnstile is free and works without proxying your site through Cloudflare. reCAPTCHA needs billing set up beyond 10,000 assessments a month
• For Turnstile, use "Simple CAPTCHA with Cloudflare Turnstile": enter the keys, select the login form and confirm with "TEST API RESPONSE"
• Before you start, make sure you can disable the plugin with FTP or WP-CLI
• XML-RPC and application passwords bypass the CAPTCHA, so combine it with two-factor authentication and login attempt limits

Related articles:

• How to set up Cloudflare Turnstile in WordPress
• How to set up reCAPTCHA v3 in WordPress: creating keys, Contact Form 7 and comments
• How to prevent brute-force attacks on WordPress: login limits, two-factor authentication and server-side blocking
• How to disable XML-RPC in WordPress and its security risks

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)