WordPress CAPTCHA and security plugins

WordPress form and security plugins can add CAPTCHA checks, firewall rules, rate limits, honeypots, and bot detection. The exception must be configured in the plugin that is actually rejecting the FormTester 365 request.

Prepare FormTester 365

Turn off the proxy for the affected website so WordPress can see the fixed testing addresses:

  • IPv4: 45.56.67.77
  • IPv6: 2600:3c00::f03c:92ff:fef9:6b3b

Open the website in FormTester 365, open its settings, and under Proxy settings enable the override and set the proxy to off.

Find the blocking plugin

  1. Check the form plugin's CAPTCHA or spam-protection settings.
  2. Check security plugins and the host-level firewall.
  3. Review security logs for the failed form URL and FormTester 365 IP address.
  4. Note whether the page loaded, the CAPTCHA failed, or the submission itself was blocked.

Configure the exception

Look for settings named Allowlisted IPs, Trusted IPs, Skip CAPTCHA, Exclude from CAPTCHA, or Bypass for IP.

  1. Add both FormTester 365 addresses.
  2. Scope the exception to the affected form, page, or submission endpoint when possible.
  3. Skip only the CAPTCHA, spam, or rate-limit rule that causes the failure.
  4. Keep all other security checks active.

If the form plugin has no trusted-IP setting, a developer may need to add a server-side validation hook. The hook should compare the server-observed source address, not a browser-supplied header or public query parameter.

Verify the configuration

  1. Run a manual FormTester 365 test.
  2. Check the result's CAPTCHA details and screenshot.
  3. Submit the form from a normal browser connection.
  4. Confirm the plugin still applies CAPTCHA and spam protection to regular visitors.

If the test still fails, record the WordPress form plugin, CAPTCHA provider, security plugin, hosting firewall, failed URL, and screenshot before contacting support.

Was this helpful?