Works with your stack
Cookie Rocks and WP Armour: forms without the captcha question
no captcha, no question
WP Armour stops spam with a hidden field instead of a captcha. It sets no cookie, stores nothing in the browser and contacts no other site. A form that relies on it needs no consent question, so Cookie Rocks adds nothing to it.
By Dinesh Karki · dineshkarki.com.np · WordPress.org
Is this your product? Tell us if anything here is out of date. Write to us
WP Armour
WordPress plugin
- Tested version
- 2.4.02
- How
- Tested automatically around each Cookie Rocks version
- Last test
- 7 November 2026
- Latest version
- 2.4.02 tested
- Active installs
- 400,000+
What WP Armour adds to your visitors’ browser
No trackers In our test of WP Armour 2.4.02 on 7 November 2026, the plugin itself added no tracker and no cookie. What you place in your pages with it, such as a video or a map, still counts.
What WP Armour puts on your pages
- A small script and a stylesheet
- Loaded on every page, from your own site. No cookie, no browser storage, no request to another site.
- A hidden field
- Added to your forms by its script. Bots fill it in, people do not see it.
- Checks on your server
- WP Armour checks the field when Contact Form 7, WPForms, Gravity Forms and other forms are sent.
What matters for consent with WP Armour
No captcha, no question
Cookie Rocks adds a request to a form only when reCAPTCHA or hCaptcha is on the page and held. A form protected by WP Armour alone sends at once.
Its script must run
WP Armour adds its field with JavaScript. If a performance plugin delays or breaks its script, every entry is treated as spam. Exclude it from script delaying.
Forms added later
A form added after the page has loaded, in a popup or by AJAX, may miss the hidden field, and its entries are then refused.
A lighter way out of reCAPTCHA
When reCAPTCHA is on your site, the free Audit suggests a honeypot field or Cloudflare Turnstile to avoid the consent question. WP Armour is one such honeypot.
What our tests found on WP Armour
Good to know · Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, AkismetSeven SEO and security plugins set nothing for visitors by default
by default: Default settings
Yoast SEO, Rank Math, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie, use no storage and load no known third-party tool.
Seen in our tests, 17 October 2026, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour, Akismet 28.7, 1.0.280, 5.0.3, 9.0.2, 9.8.3, 2.4.02, 5.7.2. Source
Full detail
On a fresh WordPress home page with default settings, Yoast SEO, Rank Math SEO, All in One SEO, Wordfence, Really Simple SSL, WP Armour and Akismet set no cookie for the visitor, keep nothing in the browser's storage and load no known third-party tool, after Accept all.
Good to know · WP Armour (Honeypot Anti-Spam)WP Armour refuses forms when its script is delayed or blocked
It sets no cookie and contacts no other site. Its script adds a hidden field to forms; if it does not run, or the form is added later, the form is refused as spam.
Read in its code, 16 October 2026, WP Armour (Honeypot Anti-Spam) 2.4.02.
Full detail
WP Armour 2.4.02 sets no cookie, stores nothing in the browser and contacts no other site. It loads wpa.js or wpa_vanilla.js on every page, which adds a hidden field to known forms at DOMContentLoaded; if that script does not run (delayed, combined with an error, or blocked) or the form is added later, the submission is refused as spam. The field value is not checked, only its presence, so cached pages work.
How we test it
Around each version, with its latest release
Around each Cookie Rocks version, a fresh WordPress installs its latest version from WordPress.org next to Cookie Rocks and runs the same checks. A new version joins the next run on its own.
- WP Armour 2.4.02, tested on 7 November 2026.
- The banner shows, the trackers of the test page wait for consent and load after it, and Cookie Rocks raises no PHP error.
- Settings of the test: Default settings after activation.
- Last run: WP Armour 2.4.02 on 7 November 2026, with WordPress 7.1.3.
Anti-spam
Other plugins of the same kind.
Questions
Does Cookie Rocks need settings for WP Armour?
No. There is nothing to set. Cookie Rocks reacts only to reCAPTCHA and hCaptcha.
Can I keep reCAPTCHA as well?
Yes. reCAPTCHA is then held until the visitor allows it, and the forms that use it show the request.
Does WP Armour add anything to my cookie policy?
No cookie and no browser storage, so no line in your cookie list.
What happens after the 30-day trial?
The banner, your visitors’ choices and your proofs of consent keep working. Without a key, most settings lock, updates and support stop. Take a key at any time and everything opens again.
For sites with WP Armour
Simpler forms, simpler consent.
nothing to declare
Every feature of the complete plugin for 30 days, no card. WP Armour keeps working as it does today.
- During the trial: everything, including the full settings and the scans
- After 30 days without a key: the banner, your visitors’ choices and your proofs of consent keep working
- What waits for a key: most settings, updates and support
Get your trial key
Your e-mail and your site. Your key arrives as soon as you confirm your e-mail.