Buy B2BKing
$299 $199
A common issue experienced by many shops is spam registrations. These may go through even when the site uses the "manual approval" feature, as spam bots can bypass it.
Below we'll walk through the best ways to protect your B2BKing forms from spam, starting with the simplest option.
The easiest way to stop spam is with B2BKing's built-in Cloudflare Turnstile integration. Turnstile is a free, privacy-friendly challenge from Cloudflare that verifies visitors are human without showing them annoying puzzles. You can enable it for your registration and quote request forms directly from B2BKing's settings, with no extra plugins required.
For a full setup walkthrough, see our dedicated guide: Setting Up Cloudflare Turnstile in B2BKing.
If you prefer a different captcha solution such as Google reCAPTCHA, you can use a third-party plugin instead. B2BKing is not a dedicated security plugin, so for more advanced captcha needs, a specialized plugin may be a better fit.
Most captcha plugins that work with WooCommerce are also compatible with B2BKing's B2B registration, as our plugin works by extending WooCommerce registration. If a plugin can add a captcha to WooCommerce, it will usually work with B2BKing as well.
We have tested B2BKing with the following plugins and can confirm they work correctly:
Other captcha plugins will likely work as well; these are just some examples we've specifically tested.
We recommend only adding a captcha to the registration form. Login attempts without the correct password are already rejected by WordPress, so a captcha there adds little security for most sites while creating unnecessary friction for real users.
If you ever run into brute force login attempts, you can set up a Cloudflare managed challenge rule targeting your My Account page. See the section below for details.
If your site is connected to Cloudflare (which offers a generous free plan), you can add an extra layer of protection that works alongside Turnstile or any captcha plugin. These features stop bots at the edge, before traffic even reaches your WordPress site.
Bot Fight Mode is the simplest step (How to Enable Bot Fight Mode). It automatically detects and blocks known bot traffic, which can resolve a large number of spam issues on its own.
Firewall Rules with Managed Challenge offer more targeted protection. You can create a firewall rule that adds a managed challenge to specific pages, such as your My Account or registration page. A managed challenge is a lightweight verification step. Most real users are passed through automatically without any clicks, but bots won't get past it. To set this up, create a new rule in Cloudflare (Security → Rules), target the URLs you want to protect, and set the action to "Managed Challenge."
In some cases, bots can submit requests directly to your site's endpoints without ever loading the form. When this happens, form-level captchas like Turnstile won't help because the bot is bypassing the page entirely.
If you're still seeing spam after enabling Turnstile, enabling Bot Fight Mode in Cloudflare is the most effective fix, as it blocks bot traffic at the network level before it reaches WordPress. If you don't already have your site connected to Cloudflare, their free plan is more than enough for this.
Powered by BetterDocs
