Captcha Pro: Turnstile & hCaptcha
Add-on ID: kv_captcha_pro · Edition: CS-Cart & Multi-Vendor · Latest version: 1.0.0 · Compatible with: CS-Cart & Multi-Vendor 4.17.2 – 4.21.x, PHP 7.4 – 8.3 · Changelog: view
Captcha Pro stops spam sign-ups, fake reviews, contact-form spam and password guessing without annoying real customers and without Google. Choose the built-in check, which needs no account, sets no cookies and sends nothing to a third party, or connect Cloudflare Turnstile or hCaptcha. Every protected form also gets a hidden honeypot field, a minimum fill-in time and a limit on attempts per IP address. Captcha Pro plugs into the spam protection CS-Cart already has, so it covers every form that supports image verification, including forms of other add-ons.
- Three ways to check: the built-in check (a small proof-of-work task the browser solves in the background), Cloudflare Turnstile or hCaptcha. Without keys the built-in check is used, so a half-finished setup never blocks your forms.
- All the forms that get spam: sign in, registration, password recovery, guest checkout, product reviews, comments, contact forms (Form builder), newsletter and e-mail marketing sign-up, call requests, vendor sign-up on Multi-Vendor, order tracking, back-in-stock notifications, gift certificates, polls, and the admin and vendor panel sign-in.
- Per form: spam check with rate limit, rate limit only (invisible, works without scripts) or off, with its own number of attempts per IP address and time window.
- Rate limits per IP address: too many attempts from one address are refused until the window ends; visitors who send many forms get a harder task automatically.
- Honeypot and time trap: bots that fill hidden fields or send a form within seconds are refused; real customers never notice.
- Allow-list: signed-in customers and your own IP addresses or ranges skip the check.
- Statistics: checked, passed and blocked submissions per form and day, with the reasons. No IP addresses or personal data are stored.
- Works with Google reCAPTCHA installed: takes over while reCAPTCHA has no keys; when reCAPTCHA is set up, one click switches the same forms over.
- Full page cache (4.21) and privacy: the widget is the same for every visitor, the check runs in the background, provider scripts load only when a protected form is on screen.
Documentation
Section titled “Documentation”| Page | Contents |
|---|---|
| Installation | Requirements, installing, upgrading, uninstalling |
| Configuration | Settings, providers and their keys, protected forms, allow-list, license |
| Usage | What customers see, the admin page, statistics, Google reCAPTCHA, Multi-Vendor and Ultimate |
| Developer notes | How the check works, data model, endpoints, hooks, file map |
| FAQ | Common questions |
Compatibility
Section titled “Compatibility”| CS-Cart / Multi-Vendor | 4.17.2 – 4.21.x (Ultimate and Multi-Vendor editions) |
| PHP | 7.2.5 – 8.3 (whatever your CS-Cart version supports), cURL extension for Turnstile and hCaptcha |
| Themes | Responsive and themes based on it (Bright, Nova and others) |
| Full page cache (4.21) | Supported: the widget is the same for every visitor; checks run in the background |
| Google reCAPTCHA add-on | Detected: Captcha Pro takes over while it has no keys, or switches over with one click |