Works with your stack
Cookie consent for spam protection plugins
the form has to send
Spam protection works in two places: on your server when a form is sent, and sometimes in the visitor’s browser before that. A server check needs a line in your privacy policy. A captcha in the browser must load, or the form will not send.
Spam protection, one by one
What each anti-spam plugin puts on your pages
- Akismet
- Nothing in the browser and no cookie. Comments and forms are checked from your server when they are sent.
- CleanTalk
- A bot detector from CleanTalk on every public page, with browser storage, before any form is sent. Data also goes from your server.
- Advanced Google reCAPTCHA
- Google’s reCAPTCHA inside each protected form, login page included, or a built-in maths captcha that contacts no one.
- Simple Cloudflare Turnstile
- Turnstile on pages with a protected form. Cookie Rocks classes it as necessary and never holds it.
What matters for consent with Spam protection
Server checks cannot wait
Akismet, CleanTalk and Turnstile send form data from your server. No banner can hold that. Mention each provider in your privacy policy.
A held captcha breaks the form
reCAPTCHA and Turnstile plugins refuse a form without their token. Holding the captcha means comments and logins fail.
Some run before any form
CleanTalk’s bot detector loads on every public page and sends browsing signals before the visitor sends anything. Decide whether it is necessary protection and say so.
A captcha from your own site
A captcha served by your site, like the built-in maths captcha of Advanced Google reCAPTCHA, contacts no other site and raises no consent question.
What our tests found on Spam protection
Good to know · Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, AkismetSeven SEO and security plugins set nothing for visitors by default
by default: Default settings
Yoast SEO, Rank Math, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, Akismet 28.7, 1.0.280, 5.0.3, 9.0.2, 9.8.3, 2.4.02, 5.7.2. Source
Full detail
On a fresh WordPress home page with default settings, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie for the visitor, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
Set before the choice · Anti-Spam by CleanTalkCleanTalk's bot detector runs on every page and sends browsing signals
It loads from fd.cleantalk.org for visitors not logged in, even without an API key, stores bot_detector_* keys in localStorage and posts browsing signals before any form is sent.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
CleanTalk enqueues fd.cleantalk.org/ct-bot-detector-wrapper.js (async) on every public page for visitors who are not logged in as soon as a form check is on (the default), with no API key check; without a key the bot detector stays enabled. The wrapper creates the real script, fd.cleantalk.org/2.1.9/ct-bot-detector.min.js, which stores bot_detector_* keys in localStorage and posts browsing signals to fd-api.cleantalk.org/frontend_data/v2 before any form is sent. The pixel from moderateN.cleantalk.org is not added while the bot detector is on (Auto).
Sent from your server · Anti-Spam by CleanTalkCleanTalk sends visitor data from the server, with no consent setting
setting “Check email before POST” · by default: on
- Each submitted form, with IP address, e-mail, name, message and browser signals.
- The e-mail typed in a form as soon as the visitor leaves the field (on by default).
- The firewall log every hour, and a request when a visitor reveals a hidden e-mail.
- No consent setting and no WP Consent API.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
CleanTalk sends data from the server: each submitted form with IP address, email, name, message, browser signals and visited addresses; the email typed in a form as soon as the visitor leaves the field (on by default); the SpamFireWall log every hour; and a request to moderate.cleantalk.org when a visitor reveals a hidden email. It has no consent setting and does not use WP Consent API, and adds data-cookieconsent="ignore" to its scripts when one consent plugin is active.
Depends on a setting · Anti-Spam by CleanTalkCleanTalk sets no cookies on Auto, but keeps visit data on the site
setting “Set cookies” · by default: Auto
Browser signals go to localStorage and visit data to the site's database. Cookies appear only with Set cookies On, except apbct_fw_bypass (1 hour), set when the firewall lets a visitor through.
Read in its code, 16 October 2026, Anti-Spam by CleanTalk 6.90.
Full detail
With Set cookies on Auto (the default), CleanTalk sets no ct_* or apbct_* cookies: browser signals go to localStorage and are sent in a hidden form field, and visit data (last visited addresses, referrer) is kept in the site's database under a hash of IP address, user agent and Accept-Language. Auto switches to database storage when a server cache is detected. Browser cookies, including ct_sfw_pass_key for 30 days, appear only with Set cookies On; apbct_fw_bypass (1 hour) is set whenever a firewall bypass is granted.
See the 5 other findings
Depends on a setting · Advanced Google reCAPTCHA (WP Captcha)WP Captcha loads Google reCAPTCHA on every post open to comments
setting “captcha” · by default: disabled
Nothing loads until a captcha type is chosen. With reCAPTCHA v2 or v3, Google's script loads in each protected form, for visitors not logged in. The built-in maths captcha contacts no other site.
Read in its code, 16 October 2026, Advanced Google reCAPTCHA (WP Captcha) 5.42.
Full detail
The captcha type defaults to disabled. Once a type is chosen, the login, registration, lost password and comment forms are protected by default (WooCommerce, EDD and BuddyPress off). With reCAPTCHA v2 or v3, Google's api.js is printed inline inside each protected form (id wpcaptcha-recaptcha-js), so it loads on every post with an open comment form for visitors who are not logged in. The free built-in type draws a maths captcha on the site and contacts no other site.
Good to know · Advanced Google reCAPTCHA (WP Captcha)Without a reCAPTCHA token, WP Captcha rejects comments and logins
A comment ends on a 403 error page and its text is lost; login forms show an error. Logged-in users skip the captcha on comments. No WP Consent API support, no hook to delay reCAPTCHA.
What to do: Ask for reCAPTCHA consent above the form, switch to the built-in captcha, or treat reCAPTCHA as necessary.
Read in its code, 16 October 2026, Advanced Google reCAPTCHA (WP Captcha) 5.42.
Full detail
Without a reCAPTCHA token the plugin refuses the submission: a comment ends on a 403 error page 'reCAPTCHA verification failed' and WordPress does not keep the text; login forms show an error. Logged-in users skip the captcha on comments. The server checks the token with Google's siteverify using the secret and token only. The plugin has no WP Consent API support and no hook to delay reCAPTCHA.
Set before the choice · Advanced Google reCAPTCHA (WP Captcha)WP Captcha loads reCAPTCHA on the login page for every visitor
wp-login.php is not a theme page, so a consent plugin that rewrites theme pages does not see Google's script there.
What to do: Use the built-in captcha if Google should not load on the login page.
Read in its code, 16 October 2026, Advanced Google reCAPTCHA (WP Captcha) 5.42.
Full detail
On wp-login.php (login, registration, lost password, all on by default once a captcha is chosen) the plugin enqueues Google's api.js through login_enqueue_scripts. wp-login.php is not a theme template, so a consent plugin that rewrites pages from template_redirect does not see it and reCAPTCHA loads there for every visitor.
Depends on a setting · Simple CAPTCHA with Cloudflare TurnstileIf Turnstile is held, protected forms fail; Cookie Rocks never holds it
setting “cfturnstile_failover” · by default: off
A comment ends on a 403 error and a login is rejected. Cookie Rocks classes Turnstile as necessary. An optional failsafe mode can load Google reCAPTCHA while Cloudflare is unreachable.
Read in its code, 16 October 2026, Simple CAPTCHA with Cloudflare Turnstile 1.44.0.
Full detail
If the Turnstile script is held, its field stays empty and protected forms refuse to send: a comment ends on a 403 error page and a login is rejected with "Please verify that you are human." The optional failsafe mode can load Google reCAPTCHA (www.google.com/recaptcha/api.js) instead while Cloudflare is unreachable. The plugin adds its own exclusions for the delay and combine features of the main cache plugins. Cookie Rocks classes Turnstile as necessary and never holds it.
Set before the choice · Simple CAPTCHA with Cloudflare TurnstileSimple Cloudflare Turnstile loads only on pages with a protected form
setting “Elementor integration scope” · by default: all
Also on the login page, and on every page with its Elementor integration on. Each submission is checked with Cloudflare, sending the visitor's IP address. No WP Consent API support.
Read in its code, 16 October 2026, Simple CAPTCHA with Cloudflare Turnstile 1.44.0.
Full detail
Simple Cloudflare Turnstile loads challenges.cloudflare.com/turnstile/v0/api.js (deferred, data-cfasync=false) only on pages that show a protected form and on wp-login.php, and nothing at all without a site key and secret. With its Elementor integration on, the default scope loads it on every page. Each protected submission is checked by the server at Cloudflare's siteverify endpoint with the visitor's IP address. It has no WP Consent API support.
Anti-spam
Other plugins of the same kind.
Questions
Is there a plugin that needs nothing at all?
A honeypot plugin works on your site only. See WP Armour.
Does reCAPTCHA need consent?
It loads from Google and the form fails without it. Ask for consent above the form, treat it as necessary, or use a captcha served by your site.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with spam protection
Forms that send, consent that holds.
keep spam out
Every feature of the complete plugin for 30 days, no card. Your spam protection keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.