# Captcha Security

https://docs.wisecp.com/de/captcha-security

Captcha Security decides which forms always show a captcha to visitors, which provider answers it, and works together with BotShield's automatic protection.

## Opening the Screen

It opens from **Settings › Security**. On the tab strip at the top of the page, select the **Captcha Security** tab: `{admin}/settings/security?general=captcha`

## What Is on the Screen

An info banner explains how this screen works with BotShield. Set a form to Always and every visitor sees a captcha on it. Leave a form Adaptive and nobody does by default; BotShield shows one only to a visitor who keeps retrying that form.

- **Captcha Status**: The master switch. Off, none of the forms below show a captcha of their own, and the provider and form list are disabled.
- **Provider**: A card for each installed captcha service. Only one can be active at a time; picking a card that needs keys opens a small settings panel underneath it.
- **Protected Forms**: Every guest-facing form and lookup, grouped by area (account, forms, lookups), each with its own **Adaptive** / **Always** switch and a note on what that switch currently does.

### Provider readiness badges

Each provider card carries one of three badges. **Built In** needs no setup. **Keys Required** means the provider is chosen but its settings panel still has an empty field. **Ready** means every field is filled and the provider can be used. Captcha Status cannot be saved while the chosen provider is not Ready: the save is rejected with an error and nothing is written, so fill the keys in first.

## Fields

- **Captcha Status**: Turns the whole screen on or off. Off by default.
- **Captcha Type**: The active provider: the built-in captcha, Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA v3.
- **Adaptive / Always**: Set on each form row. **Always** shows a captcha to every visitor before the form can be sent; **Adaptive** leaves the decision to BotShield.

## Tasks

### Turn captcha on and choose a provider

1. Switch on **Captcha Status**.
2. Click a provider card. If it needs keys, fill in the fields that open underneath it.
3. Save. The card only counts as **Ready** once every field is filled.

### Show a captcha on a form every time

1. Find the form in the Protected Forms list.
2. Switch its control from **Adaptive** to **Always**.
3. Save. Every visitor now sees a captcha on that form before it can be sent.

## Things to Watch

> **An Adaptive form with BotShield off stays unguarded**
> 
> Adaptive only works because BotShield is watching that form. If BotShield's threshold for that form is 0, the form shows no captcha at all until you switch it to Always or raise the threshold on the BotShield tab.

> **Switching providers keeps the old keys**
> 
> Moving Captcha Type to a different provider does not clear the keys you entered for the one you leave. Switching back restores it without retyping anything.

## Required Privileges

Opening the tab and saving changes need `SECURITY_SETTINGS`.

## Related Articles

- [BotShield](https://docs.wisecp.com/en/botshield)
- [Process Restriction](https://docs.wisecp.com/en/process-restriction)
- [Spam Protection](https://docs.wisecp.com/en/spam-protection)