{
    "title": "Really Simple CAPTCHA",
    "seo_title": "Really Simple CAPTCHA: review, settings and limitations",
    "h1": "Really Simple CAPTCHA",
    "description": "Really Simple CAPTCHA for Contact Form 7: who it suits, its limits (weak protection, accessibility), recommended settings and security.",
    "lead": "Really Simple CAPTCHA is the free module that adds an image to copy to Contact Form 7 forms, with no outside service. This sheet covers who it still suits, its real limitations, the settings to apply and the security points to watch.",
    "language": "en",
    "locale": "en-US",
    "type": "plugin-sheet",
    "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/",
    "canonical": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/",
    "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/index.md",
    "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/index.json",
    "published": "2026-11-04T08:00:00+00:00",
    "modified": "2026-11-05T21:21:30+00:00",
    "site": {
        "name": "WP Masquerade",
        "url": "https://www.wp-masquerade.com/"
    },
    "translations": [
        {
            "language": "en",
            "hreflang": "en-US",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/features/camouflaged-plugins/really-simple-captcha/index.json"
        },
        {
            "language": "fr",
            "hreflang": "fr-FR",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/fr/fonctionnalites/extensions-camouflees/really-simple-captcha/index.json"
        },
        {
            "language": "es",
            "hreflang": "es-ES",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/es/funcionalidades/plugins-camuflados/really-simple-captcha/index.json"
        },
        {
            "language": "de",
            "hreflang": "de-DE",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/de/funktionen/getarnte-plugins/really-simple-captcha/index.json"
        },
        {
            "language": "it",
            "hreflang": "it-IT",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/it/funzionalita/plugin-camuffati/really-simple-captcha/index.json"
        },
        {
            "language": "pt",
            "hreflang": "pt-BR",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/pt/recursos/plugins-wordpress-camuflados/really-simple-captcha/index.json"
        },
        {
            "language": "nl",
            "hreflang": "nl-NL",
            "title": "Really Simple CAPTCHA",
            "url": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/really-simple-captcha/",
            "markdown": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/really-simple-captcha/index.md",
            "json": "https://www.wp-masquerade.com/nl/functies/gecamoufleerde-plugins/really-simple-captcha/index.json"
        }
    ],
    "headings": [
        {
            "level": 1,
            "text": "Really Simple CAPTCHA"
        },
        {
            "level": 2,
            "text": "What Really Simple CAPTCHA does on your site"
        },
        {
            "level": 2,
            "text": "Which sites Really Simple CAPTCHA still suits"
        },
        {
            "level": 2,
            "text": "Really Simple CAPTCHA strengths and limitations"
        },
        {
            "level": 3,
            "text": "Strengths"
        },
        {
            "level": 3,
            "text": "Limitations"
        },
        {
            "level": 2,
            "text": "The settings we recommend with Contact Form 7"
        },
        {
            "level": 2,
            "text": "Really Simple CAPTCHA security: lean code, limited protection"
        },
        {
            "level": 2,
            "text": "Really Simple CAPTCHA FAQ",
            "id": "faq"
        }
    ],
    "body": "## The essentials\n\n- Best for a local CAPTCHA on Contact Form 7, with no call to Google or Cloudflare.\n- Main caveat: weak protection by the developer’s own account, and an image-only test with no audio.\n- Free, with no paid edition; since version 2.5 it requires WordPress 7.1 and PHP 8.3.\n\n## What Really Simple CAPTCHA does on your site\n\nReally Simple CAPTCHA is a module that generates small images to copy, so other plugins can check that a human is filling in a form. It is developed by Takayuki Miyoshi and his company, Rock Lobster Inc., the developer of [Contact Form 7](https://www.wp-masquerade.com/features/camouflaged-plugins/contact-form-7/), for which it was originally built. It is completely free, with no paid edition. It does nothing on its own: the plugin has no menu and no settings page, and it stays idle until another plugin calls it.\n\nWith Contact Form 7, you add two form-tags to the form template: `[captchac captcha-1]` displays the image and `[captchar captcha-1]` the answer field. Each time the form is displayed, the module picks four characters (uppercase letters and digits, leaving out look-alikes such as I, O, 0 and 1), draws a PNG image with the Gentium font bundled in the plugin, then writes two files with the same name: the image and a text file holding a hash of the correct answer. Since version 2.4, that hash is an HMAC SHA-256 with a random salt.\n\nOn submission, Contact Form 7 compares the answer (ignoring case and spaces) with the hash, then deletes both files. Leftover files older than one hour are cleaned up as requests come in. Everything happens on your server, in `wp-content/uploads/wpcf7_captcha`: no outside service, no cookie, no PHP session.\n\n![Diagram: Really Simple CAPTCHA works on visitors and bots, wordpress, external services. Public traces: folder name (hidden with Pro); generated-file folders (hidden with Pro).](https://www.wp-masquerade.com/media/wpm-sheets/really-simple-captcha/diagram-en.svg?v=303b9a05)\n\n## Which sites Really Simple CAPTCHA still suits\n\n- **Contact Form 7 sites that avoid third-party services**: the image is generated locally, with no call to Google or Cloudflare.\n- **Small, rarely targeted forms**, where a simple hurdle is enough to stop the most basic bots.\n- **Developers** who want a minimal CAPTCHA to call from their own plugin through the `ReallySimpleCaptcha` class.\n\nIt is the wrong choice for a form that draws heavy spam, or when accessibility matters: the developer warns that the plugin is \"not strongly secure,\" and Contact Form 7 has recommended other solutions since version 4.3. [Simple Cloudflare Turnstile](https://www.wp-masquerade.com/features/camouflaged-plugins/simple-cloudflare-turnstile/) or Contact Form 7’s built-in Turnstile integration offer better protection, at the cost of relying on an outside service.\n\n## Really Simple CAPTCHA strengths and limitations\n\n### Strengths\n\n- **No third-party service.** No external script and no cookie: visitor data never leaves your server.\n- **Free and lightweight.** A short PHP codebase, four fonts and no settings to maintain.\n- **Single-use answers.** The hash is salted and compared in constant time, and the file is deleted after the check.\n- **Adjustable look.** Contact Form 7 offers three image sizes plus custom text and background colors.\n\n### Limitations\n\n- **Weak protection.** Four lightly distorted characters: the developer itself says to pick another solution if you need real security.\n- **Poor accessibility.** The challenge is an image only, with no audio version; a visually impaired visitor cannot solve it.\n- **Server requirements.** It needs the PHP GD and FreeType libraries and a writable folder, or the image will not show.\n- **Folder protection built for Apache.** The `.htaccess` file that blocks access to the answers is ignored by Nginx.\n- **High requirements.** Since version 2.5, it requires WordPress 7.1 and PHP 8.3.\n\n## The settings we recommend with Contact Form 7\n\nReally Simple CAPTCHA has no settings screen: everything is set through Contact Form 7’s form-tags (Contact > Contact Forms, then open the form) and on the server. The tag generator has no CAPTCHA button, so write the tags by hand.\n\n| Setting | Recommended value | Why |\n| --- | --- | --- |\n| **CAPTCHA tags**  Contact > Contact Forms > Form tab | `[captchac captcha-1]` and `[captchar captcha-1]`, with the same name | If the two names differ, the answer will never match the image. |\n| **Image size**  `captchac` tag option | `size:l` (84 x 28 pixels) | The default size (72 x 24) is small on a phone; avoid `size:s` (60 x 20). |\n| **Colors**  `fg:#` and `bg:#` options of the `captchac` tag | Dark text on a light background, for example `fg:#000000 bg:#ffffff` (the default) | Low contrast trips up humans far more than bots. |\n| **Field label**  Form tab | Visible text before the field, such as \"Type the code shown in the image\" | The image’s only alt text is \"captcha,\" so the label guides visitors. |\n| **Temporary folder**  Server, `wp-content/uploads/wpcf7_captcha` | Writable by PHP; use the `WPCF7_CAPTCHA_TMP_DIR` constant only if you need to move it | Contact Form 7 shows a warning on the form screen if the folder, GD or FreeType is missing. |\n| **Access to answers on Nginx**  Server configuration | Deny `.txt` and `.php` files in that folder, allow the images | On Apache, the `.htaccess` created by the plugin handles this; Nginx ignores it. |\n| **Extra filter**  Form tab | `akismet:author` and `akismet:author_email` options, with [Akismet](https://www.wp-masquerade.com/features/camouflaged-plugins/akismet/) active | A CAPTCHA stops some bots, not human spammers. |\n| **Updates**  Plugins > Installed Plugins | Auto-updates enabled | The plugin evolves alongside Contact Form 7, which calls it every time the form is displayed. |\n\n- Open the form page in a private window and check that the image appears.\n- Submit once with a wrong code, then with the right one: only the second should go through.\n- With a page cache, reload the cached page and test again: Contact Form 7 requests a fresh image on load when the `WP_CACHE` constant is enabled.\n- On Nginx, request the URL of a `.txt` file in the folder: the server should refuse it.\n\nTo combine several defenses against bots, see our [WordPress anti-spam page](https://www.wp-masquerade.com/wordpress-anti-spam/).\n\n## Really Simple CAPTCHA security: lean code, limited protection\n\nAt the time of writing, the Patchstack and WPScan databases list no vulnerabilities for this plugin. Its code is short, adds no admin page and does not receive visitor data directly: Contact Form 7 passes the answer to it. The real risk therefore sits mostly with Contact Form 7, whose history is covered in our article on [Contact Form 7 security vulnerabilities](https://www.wp-masquerade.com/contact-form-7-security-vulnerabilities/).\n\nThe thing to watch is the temporary folder: each text file holds the salt and hash of a four-character answer, few enough combinations for a bot that can read it to recover the answer. Keep it closed to reading, and keep both plugins up to date. WP Masquerade Pro hides the plugin’s folder name (`really-simple-captcha`) and the `/wp-content/uploads/wpcf7_captcha/` address of its images: masking makes the plugin harder to spot but does not replace a real anti-spam filter.\n\n## Really Simple CAPTCHA FAQ\n\n**Where are Really Simple CAPTCHA’s settings?**\n\nThere are none: the plugin has no settings screen. Size and colors are set with Contact Form 7’s tag options, or in the code of the plugin that calls it.\n\n**Why doesn’t the CAPTCHA image show up?**\n\nMost often, the PHP GD or FreeType library is missing, or the `wp-content/uploads/wpcf7_captcha` folder is not writable. Contact Form 7 flags this on the form screen; ask your host to enable GD and FreeType, or fix the folder permissions.\n\n**Should I use Turnstile or reCAPTCHA instead?**\n\nFor a form that attracts spam, yes: Contact Form 7 itself has recommended other solutions since version 4.3, and its Turnstile and reCAPTCHA integrations are set up under Contact > Integration. Really Simple CAPTCHA keeps the advantage of not depending on any outside service.\n\n**Does Really Simple CAPTCHA send data to a third party?**\n\nNo. The image and the expected answer are created and checked on your server, with no external script and no cookie.\n\n**Does it work with plugins other than Contact Form 7?**\n\nYes, if the plugin calls it: the `ReallySimpleCaptcha` class handles generating the word and the image, checking the answer and deleting the files. The developer only names Contact Form 7.\n\n## Key facts\n\n- Category: Forms\n- Vendor: Rock Lobster Inc.\n- Price: Free, with no paid edition\n- Active installations (wordpress.org): 300 000+\n- Version: 2.5\n- Official page: https://wordpress.org/plugins/really-simple-captcha/\n\n## What WP Masquerade hides\n\n- Handled by WP Masquerade Pro only\n- With Pro: folder name, generated-file folders",
    "catalog": "really-simple-captcha",
    "essentials": [
        "Best for a local CAPTCHA on Contact Form 7, with no call to Google or Cloudflare.",
        "Main caveat: weak protection by the developer’s own account, and an image-only test with no audio.",
        "Free, with no paid edition; since version 2.5 it requires WordPress 7.1 and PHP 8.3."
    ],
    "format": "application/json"
}