Privacy-friendly spam protection with a built-in check, Cloudflare Turnstile or hCaptcha, a honeypot and rate limits on all forms.
Available Updated Oct 20, 2026Version 1.0.0CS-Cart, Multi-Vendor 4.17.2 – 4.21.x No core file edits
Built for
Captcha Pro: Turnstile & hCaptcha: overview1 of 17
What it does
Captcha Pro protects your store forms from bots. Choose a built-in check that needs no account, sets no cookies and sends nothing to a third party, or connect Cloudflare Turnstile or hCaptcha. Each form also gets a hidden honeypot field, a minimum fill-in time and a limit on attempts per IP address. It covers sign in, registration, password recovery, guest checkout, reviews, comments, contact forms, newsletter, call requests, vendor sign-up and the admin and vendor panel sign-in.
How it works
Install, enter the license key and the main forms are protected at once. On the Spam protection page choose per form: spam check with rate limit, rate limit only or off, and the attempts per IP address. In the settings pick the built-in check, Turnstile or hCaptcha, and add allowed IP addresses. The shopper fills in the form as usual; the check runs while they type, and a form sent too early waits and is sent by itself. A configured Google reCAPTCHA is replaced with one click.
Features
Built-in check without third parties or cookies, Cloudflare Turnstile or hCaptcha
Hidden honeypot field and minimum fill-in time on every protected form
Rate limits per IP address and form, with harder checks for busy addresses
Per-form protection: spam check, rate limit only or off
Allow-list for signed-in customers and your own IP addresses
Statistics per form and day with the reasons for each block
Fallback to the built-in check when the provider cannot be reached
One-click switch from Google reCAPTCHA
Full page cache ready (4.21), works with CS-Cart and Multi-Vendor 4.17.2 to 4.21
What you get
Package
kv_captcha_pro-1.0.0.zip, installed through Add-ons → Manage add-ons
Updates & support
12 months included. Download new versions from your account and install them in Add-ons → Manage add-ons or the Upgrade Center.
License
1 production installation. Staging, dev and localhost are free and unlimited. The add-on keeps working after the update period ends. How licensing works
Compatibility
We list only the builds we install and test on. “Tested” means the full test plan was run on that build; “Supported” means the build is inside the supported range and uses the same hooks.
CS-Cart version and edition compatibility
CS-Cart version
CS-Cart
CS-Cart Ultimate
Multi-Vendor
Multi-Vendor Ultimate
4.22 and later
Testing next
Testing next
Testing next
Testing next
4.21.2
Supported
Supported
Supported
Supported
4.20.x
Supported
Supported
Supported
Supported
4.19.x
Supported
Supported
Supported
Supported
4.18.x
Supported
Supported
Supported
Supported
4.17.2
Supported
Supported
Tested
Supported
Before 4.17.2
Not supported
Not supported
Not supported
Not supported
Last tested build: Multi-Vendor 4.17.2, Oct 20, 2026Tested on: Multi-Vendor 4.17.2
Requirements
Platform
CS-Cart or CS-Cart Multi-Vendor 4.17.2 – 4.21.x
PHP
PHP 7.2.5 – 8.3, as supported by your CS-Cart version
Requirement
For Cloudflare Turnstile or hCaptcha: the cURL extension and outgoing HTTPS from the server. The built-in check needs neither
Platform
A license key from cs-cart.kaviolabs.com or a CS-Cart Marketplace license number
Core changes
None. Hooks and template overrides only
1.0.0
Oct 20, 2026
Latest
Added 9
Spam check for CS-Cart forms through the CS-Cart antibot service: built-in check (honeypot, minimum fill-in time, signed proof-of-work ticket, no third party, no cookies), Cloudflare Turnstile and hCaptcha.
Per-form protection (spam check + rate limit, rate limit only, off) and attempts per IP address for sign in, registration, password recovery, guest checkout, product reviews, comments, contact forms, newsletter and e-mail marketing sign-up, call requests, vendor sign-up, order tracking, back-in-stock notifications, gift certificates, polls and the admin and vendor panel sign-in.
Checks for password recovery, product reviews and back-in-stock notifications, which CS-Cart renders but never validated.
Every check rule ends the request on failure (a failed check on the sign-in form without a redirect URL no longer runs the sign-in).
Allow-list for signed-in customers and IP addresses or ranges; trusted proxies for CDNs (forwarded headers from other senders are ignored).
Fallback to the built-in check when the provider cannot be reached or its widget cannot load.
Statistics per form and day with block reasons; no IP addresses stored.
Google reCAPTCHA co-existence: takeover while it has no keys, one-click switch when it is set up.
Full page cache support (4.21), license check, self-healing upgrades.
Tested on Multi-Vendor 4.17.2. First release.
Do I need an account with Cloudflare or hCaptcha?
No. The built-in check works without any account or key. Turnstile and hCaptcha are optional; both have free plans.
Is the built-in check privacy-friendly?
Yes. It sets no cookies, loads nothing from other servers and sends nothing to a third party. The task runs in the visitor's browser; the server only checks the result.
Will customers have to solve puzzles?
Not with the built-in check or Turnstile in most cases. hCaptcha may show a picture task to suspicious visitors.
Does it stop all spam?
It stops automated spam: bots that fill hidden fields, send forms within seconds, cannot run the check, or send many forms from one address. People who fill forms by hand are not stopped by any captcha.
How is this different from the built-in Google reCAPTCHA?
reCAPTCHA sends visitor data to Google, uses Google cookies and needs keys. Captcha Pro offers a check without any third party, Turnstile and hCaptcha, per-form rate limits, a honeypot, an allow-list, statistics, and it also protects password recovery, product reviews and the admin sign-in, which reCAPTCHA does not check.
I use reCAPTCHA now. Can I switch?
Yes. While reCAPTCHA has keys, Captcha Pro stays inactive; click Switch to Captcha Pro on Customers → Spam protection. It protects the same forms and disables reCAPTCHA.
My store is behind Cloudflare. Do the rate limits still work?
Enter the Cloudflare IP ranges under Trusted proxies. Otherwise all visitors would share Cloudflare's addresses. Proxies on the same server (Varnish, nginx) are recognized automatically.
Can bots fake their IP address to get around the limits?
No. Forwarded headers are only read from trusted proxies.
Does it work with the full page cache of CS-Cart 4.21?
Yes. The widget is the same for every visitor and the check runs in the background.
What happens if Turnstile or hCaptcha is down?
By default forms are accepted if they pass the built-in check, so customers can still register and check out. You can choose to refuse the form instead.
I locked myself out of the admin panel.
Add define('KV_CP_EMERGENCY_OFF', true); to config.local.php, sign in, fix the setting (for example add your IP address to the allow-list), then remove the line.
What happens if the license lapses?
Without a valid license (no key after the 14-day start period, an invalid or revoked key, a domain the license does not cover, or no successful check for 14 days), Captcha Pro stops checking forms and its rate limits stop; CS-Cart's own behaviour returns (Google reCAPTCHA, if you set it up), and your form settings, keys and statistics are kept. Once the license is valid again, everything is back.
The admin panel shows a license notice.
Open Add-ons → Manage add-ons → Captcha Pro: the License card at the top says what is wrong. Fix it on the License tab and click Check now. See License.
Does the add-on work on my staging copy?
Yes. Subdomains of your licensed domain and local development hosts (localhost, private IP addresses, .local, .test) are covered by the same license. Turnstile and hCaptcha site keys must list the staging domain too.
What happens if your license server is down?
Nothing changes for 14 days: the add-on keeps working and retries every hour. Only if no check succeeds for 14 days is it switched off until the next successful check.
Does the license check slow down my storefront or checkout?
No. The check runs only in the admin panel or from cron, at most once a day, never while customers browse or check out.
