GDPR Compatible Spam Protection

Cookieless, GDPR-friendly spam protection for WordPress — comments, login, registration, lost password and WooCommerce — using Cloudflare Turnstile and a honeypot. No tracking cookies, no consent banner required.

Why

Most spam tools either send visitor data to third parties in ways that complicate GDPR (e.g. Google reCAPTCHA's cookies and US transfers) or rely on server-side heuristics that break behind nginx/proxy caching. This plugin uses Cloudflare Turnstile, which is cookieless and does not track users across sites, plus a local honeypot — so it stays effective and easy to justify under GDPR.

Features

• Protects the comment, login, registration, lost password, and WooCommerce login/registration forms — each toggled individually.
• Honeypot field for comments (works with no keys at all).
• Optional removal of the website (URL) field from comments to stop backlink spam.
• Skip Turnstile for logged-in users on comments.
• Widget theme and language options.
• Fail-open option if Cloudflare is unreachable (submissions go to moderation instead of being blocked).
• Lockout escape hatch via a wp-config.php constant.
• Translation-ready (.pot included). Removes its settings on uninstall.

Requirements

• WordPress 5.8+
• PHP 7.4+
• A free Cloudflare Turnstile widget (Site Key + Secret Key)

Installation

1. Download the latest ZIP from the Releases page.
2. In WordPress: Plugins → Add New → Upload Plugin, choose the ZIP, install and activate.
3. Create a Turnstile widget at the Cloudflare dashboard. Under Hostname Management add your domain — include both example.com and www.example.com.
4. Go to Settings → GDPR Spam Protection, paste your Site Key and Secret Key, choose which forms to protect, and save.

The honeypot and the comment URL-field removal work immediately, even before adding keys.

Configuration notes

• Error 110200 means the current hostname is not authorized in your Turnstile widget — add it under Hostname Management.
• Lockout safety: if you get locked out of login, add define( 'GDPR_CSP_DISABLE_LOGIN', true ); to wp-config.php to disable login/registration protection without dashboard access.

Automatic updates from GitHub (optional)

This plugin includes Git Updater headers. To receive updates straight from this repository, install the free Git Updater plugin and add this repo. Tag releases as 1.0, 1.1, etc.

License

GPLv2 or later.

Author

Finland93