Free + Pro · Protection settings
Choose your protection
Start with the form checks included in Free. Add Pro when you need attempt limits, abuse controls or detailed activity.
In version 1.21.0 and later, open Gate House directly in the WordPress sidebar, then choose the tab named in this guide. Version 1.20.1 and earlier use Settings → Gate House.
Free: Gate House → Protection
Choose the check for each native form
Find the sign-in, registration, reset, comment, review or checkout form you want to protect. Each supported form has three choices:
- Off
- Do not enforce a Gate House visitor check on this form. Native WordPress and WooCommerce authentication still applies.
- Invisible
- Use built-in keyless checks: a signed form proof, a hidden honeypot and a minimum submission time. No provider account or keys are needed.
- Human check
- Use your connected Turnstile, reCAPTCHA or hCaptcha service. Save its keys and pass the provider connection test before enabling this choice.
Save and try the forms you changed
Select Save protection choices. Keep your administrator session open and use a private browser window to try successful and rejected submissions. For checkout, enable checks on staging and place complete sandbox orders with your payment methods before applying those settings to production.
Use Coverage to review enabled checks and successful-use observations. Free’s Overview shows aggregate blocked-attempt totals, not a history of individual visitors.
What does Free’s recommended setup change?
On Overview, Turn on recommended protection enables Invisible checks for supported sign-in, registration, reset, comment and review forms that are not already enforcing a check. It leaves checkout choices unchanged. Review Protection and test your forms after using it.
Pro: add limits and abuse controls
With Pro active: Gate House → Rules
Pro keeps the Off, Invisible and Human check choices and adds separate controls for repeated attempts and abuse patterns. Open Choose for each form within an area when you need individual settings.
Set attempt limits
Turn on Limit repeated attempts for the areas you want to limit. Under How strict should attempt limits be?, choose Light, Balanced, Strict or Custom. A level changes the threshold; it does not turn limits on for other forms.
Legacy screenshot: the current Pro Rules page uses Off, Invisible and Human check choices alongside Limit repeated attempts. Follow the current steps in this guide.Open full-size image (opens in a new tab) Choose account and disposable-email checks
Under Fraud & abuse checks → Account abuse protection, choose Off, Observe — record matches or Block matching attempts. Observe lets you review those patterns in Pro Activity before enforcing them.
Disposable email protection has separate Off, Observe, Challenge and Block choices for supported account creation. WooCommerce sites also have Card-testing protection. These controls run locally and do not require CAPTCHA keys.
Legacy screenshot: current Pro saves account-abuse settings with the main Save changes button. The separate save button shown here is no longer the current workflow.Open full-size image (opens in a new tab) Save and test the combined settings
Select Save changes to save forms, attempt limits and abuse settings together. Try the affected forms and inspect Pro Activity for unexpected results. A passed CAPTCHA does not override an account-abuse block.
How does Pro’s recommended setup differ?
The Pro Rules page lists the changes above its recommended-setup button. Applying them can enable suggested attempt limits, account-abuse blocking and visitor checks on the listed forms. Visitor checks use the external provider when ready, or Invisible checks otherwise. Checkout visitor checks remain your choice. This button applies changes immediately; review the resulting settings and test your journeys.
Pro: visitor rules and temporary attack mode
Use Rules → Allow & block lists to add a rule for an IP address, IP range, email address or email domain. Local allow rules can skip visitor checks and attempt limits; account-abuse, card-testing and disposable-email blocks still apply.
Under Emergency controls, attack mode temporarily tightens and enforces attempt limits for the areas you select. Choose a duration and use Start attack mode; the usual limits return afterward. Review Activity while it runs.
Prefer an external human check? Connect your CAPTCHA service in either edition.