by J-C Berthon 5 (5 reviews)

OpenPorte Spam Protection

Name: OpenPorte Spam Protection
Rating: 5.0 (5 reviews)
Author: J-C Berthon

Stop spam without CAPTCHAs. Proof-of-Work protection for your site. Open-source, self-hosted, privacy-first.

OpenPorte Spam Protection ranks #8,919 among WordPress.org plugins with 500+ active installations, is #306 of 2,958 in the Discussion & Community category, a 5/5 rating from 5 reviews, and was last updated Oct 29, 2026. Data from WordPress.org, refreshed twice daily — see methodology.

Compatible with WP 7.1.4

v1.30.0 Current Version v1.30.0

Updated 3 days ago Last Update on 29 Oct, 2026

Refreshed 2 days ago Last Refreshed on

#306 of 2,958 in Discussion & Community Top 25% by installs Downloads +48.5% this week Actively maintained

View on WordPress.org

Rank

#8,919

— No change

Active Installs

500+

+61.3%

KW Avg Position

33 worse

Downloads

3.2K

+117 today

Support Resolved

100%

— No change

Rating

100%

Review 5 out of 5

5 (5 reviews)

Next Milestone 600

Total Progress 51%

500+ 600+

422

Ranks to Climb

Growth Needed

8,000,000

Active Installs

Pro

Unlock Exact Install Count

See the precise estimated active installs for this plugin, calculated from real-time ranking data.

Exact install estimates within tiers
Track install growth over time
Milestone progress predictions

Upgrade to Pro

Need 49 more installs to reach 600+

Rank Changes

Current #8,919

Change

Best #

Upgrade to Pro

Unlock 30-day and 90-day rank history charts with a Pro subscription.

Upgrade Now

Active Installs Growth

Upgrade to Pro

Active Installs 0,000,000+

Growth +0.0%

Peak 0,000,000

Downloads Growth

Downloads

Growth

Peak

Upgrade to Pro

Unlock 30-day, 90-day, and yearly download history charts with a Pro subscription.

Upgrade Now

Reviews & Ratings

5.0

5 reviews

Overall 100%

5 (100%)

0 (0%)

Support Threads Overview

Resolved

Unresolved

Total Threads

Resolved

Unresolved

100%

Resolution Rate

Security History

Source: WPVulnerability

No known vulnerabilities on record for OpenPorte Spam Protection. Checked 2 months ago.

Track This Plugin

Get detailed analytics, keyword tracking, and position alerts delivered to your inbox.

Start Tracking Free

Plugin Details

Version: 1.30.0
Last Updated: Oct 29, 2026
Requires WP: 5.6+
Tested Up To: 7.1.4
PHP Version: 8.0 or higher
Author: J-C Berthon

Support & Rating

Rating: ★ ★ ★ ★ ★ 5
Reviews: 5
Support Threads: 2
Resolved: 100%

Keywords

anti-spam captcha GDPR protect security

Upgrade to Pro

Unlock keyword rankings, search positions, and detailed analytics with a Pro subscription.

Upgrade Now

Similar Plugins

Adminify – White Label, Admin Menu Editor, Login Customizer

6K+ installs

#2,757

Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits

30K+ installs

#1,015

Akismet Anti-spam: Spam Protection

5M+ installs

WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

5M+ installs

Jetpack – AI Agents & MCP, Security, Backup & Analytics

WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance

View all Discussion-and-community plugins

TL;DR

AI summary of the plugin's readme

OpenPorte is for WordPress site owners, including existing ALTCHA v1 users, who want a free, open-source, self-hosted CAPTCHA alternative. It protects forms, comments, and logins from spam using a proof-of-work mechanism instead of cookies or tracking, since the original ALTCHA v1 plugin is no longer maintained and newer versions are not open source.

Free, open-source CAPTCHA alternative
Proof-of-work spam protection
No cookies, no tracking
GDPR-friendly by design
Automatic settings migration from ALTCHA v1
Self-hosted REST API verification
Custom Challenge URL mode
WooCommerce integration

Frequently Asked Questions

Common questions about OpenPorte Spam Protection

Not on its own. The shortcode displays the widget; the verification that rejects unsolved submissions is performed by the integration for that form plugin. For a supported plugin, enable its toggle under Settings → OpenPorte → Integrations as well. Two integrations go further: with Contact Form 7 and HTML Forms, a widget you placed in the form yourself (the shortcode or a hand-written tag) is verified even while the toggle is off. In a form plugin OpenPorte has no integration for, the shortcode still shows the widget and visitors still have to tick it, but nothing checks the result on the server — a bot posting directly to the form's endpoint is not stopped. See Supported Integrations for the list.

Usually a security or optimization plugin blocks the REST API for logged-out visitors; the browser console then shows an error such as Server responded with 401 or Unexpected token '<'. Check by hand: Open a private browser window, so you are logged out. Open /wp-json/openporte/v1/challenge on your site (with plain permalinks: /?rest_route=/openporte/v1/challenge). A working endpoint shows a short JSON text with algorithm, challenge, maxnumber, salt and signature. An error, a login page, a redirect or an HTML page means it is blocked for visitors. If it is blocked, open /wp-admin/admin-ajax.php?action=openporte_challenge the same way. If that one works, set Self-hosted transport to Ajax under Settings → OpenPorte and save. You can also allow /openporte/v1/challenge in the blocking plugin and keep REST API. Still logged out, open a page with a protected form, solve the widget and submit it. If your forms are also used by logged-in visitors, test once more as a subscriber or customer. Ajax is not a universal fix either. Plugins that keep visitors out of wp-admin ("hide" or "lock down" wp-admin, membership plugins) can also block admin-ajax.php, sometimes only for logged-in subscribers and customers. If Ajax fails too, stay on REST API and allow /openporte/v1/challenge in the plugin that blocks it. After switching, purge any page or CDN cache: cached pages still contain the old challenge URL. Switching does not help a form plugin that submits through the REST API itself (Contact Form 7, for example): it still needs the REST API for its own submissions.

LiteSpeed Cache caches REST API responses by default and ignores the "do not cache" headers OpenPorte sends, so every visitor gets the same challenge: logins and protected forms fail after five uses (the Replay limit) and for everyone once that challenge expires. This is fixed in 1.30.1. Until you can update, use either workaround: Set Self-hosted transport to Ajax under Settings → OpenPorte, or in LiteSpeed Cache → Cache → Excludes → Do Not Cache URIs, add /wp-json/openporte/. Then run LiteSpeed Cache → Purge All once: the stale challenge stays cached until it is purged. If you are already locked out, purge the cache from your hosting panel or with WP-CLI (wp litespeed-purge all), log in, and apply one of the workarounds.

By default, yes: deleting OpenPorte from the Plugins page permanently removes all of its settings, including the shared secret. Deactivating it removes nothing. To keep your configuration for a later reinstall, switch on Keep settings when the plugin is deleted under Settings → OpenPorte → Data and save before deleting the plugin. Temporary data such as replay counters is removed either way, and the settings of the original ALTCHA Spam Protection plugin are never touched.