Card testing at checkout
Bots push stolen card numbers through your checkout to find the ones that work. You pay the gateway fees, the disputes and the cleanup.
Verification and rate limits on classic checkout, Block checkout and pay-for-order.
Bot protection for WordPress & WooCommerce
Bots out. Customers through.
Gate House guards every entrance to your store: logins, sign-ups, password resets, reviews and checkout. It uses the verification provider you choose, plus rate limits that run on your own server. Watch real traffic first, then turn on blocking with confidence.
Founding price: $19.95 per site per year, limited to the first 1,000 sites
- 30-day money-back guarantee
- Cancel anytime
Works withCloudflare TurnstileGoogle reCAPTCHAhCaptchaWordPressWooCommerce Classic & Block checkout
What you’re up against
Bots don’t knock. They go straight for your forms.
Automated traffic hits the same few places on every WordPress site, and each one costs you something different.
Fake sign-ups
Scripted registrations fill your customer list with junk, skew your numbers and give spammers a way in.
Challenges and limits on WordPress and My Account registration.
Login and reset floods
Credential-stuffing bots hammer your login page and send password-reset emails to real customers.
Protects login and reset forms, with per-form rate limits and attack mode.
Review and comment spam
Link spam in product reviews and comments makes a real store look abandoned.
Verification on comments and product reviews.
Coverage
One gatehouse. Every entrance.
Gate House protects the forms bots target in WordPress and WooCommerce, including Block checkout and the Store API behind it. All of it is managed from one screen.
- Eleven entrances, one provider, one set of rules.
- The Coverage screen shows exactly which forms are guarded on your site, and which aren’t yet.
- WordPress-only sites work too. WooCommerce is optional.
How it works
Live in minutes. Enforced when you’re ready.
No big-bang switch-on. Connect, watch, then enforce one form at a time.
Connect a provider
Pick Cloudflare Turnstile, reCAPTCHA or hCaptcha. Gate House shows you where to get the keys, then runs a real browser test on your domain.
Watch real traffic
Everything starts in Observe mode. You see the activity and rate-limit hits on each form without blocking anyone.
Enforce, form by form
Turn on verification where you need it, checkout included. Rate limits have their own switch, so you can tighten one without the other.
Observe before you enforce
Nothing is blocked until you choose. Saving keys never switches blocking on.
Provider outage? Your call.
If your verification provider goes down, you can let checkout continue for up to an hour while your local rate limits stay on.
Never locked out
There’s no public bypass URL. One line in wp-config.php, or wp usp recover, returns every form to observe mode.
Honest status labels
A form is only labeled Protected when it’s enforced and verified end to end. Everything else is labeled with its real status.
Built for stores that can’t afford a broken checkout
Tough on bots. Easy on customers.
Most people put off bot protection because they’re afraid of blocking real buyers. Gate House is designed around that fear: you stay in control of every switch, and there’s always a way back.
// Every form back to observe mode while you fix settings
define('USP_RECOVERY_MODE', true);Everything included
The whole toolkit, not just a checkbox.
Every founding license includes everything Gate House does. There are no add-ons or feature tiers.
Rate limits that fit your traffic
Per-form limits with Light, Balanced and Strict presets, enforced on your own server with atomic counters. They work even without a provider.
Attack mode
Under fire? Halve the limits on the forms being hit and enforce them for up to 24 hours.
Your provider, your keys
Turnstile, reCAPTCHA v2 or v3 with a score threshold, or hCaptcha. Switch any time.
Activity you can actually read
Every decision comes with a plain-English reason. Mark false positives and grant a short exception from the same screen.
Private by design
Activity stays on your server with pseudonymous identifiers, and privacy export and erase are built in.
Health and diagnostics
Spot provider errors and storage problems before customers do, and export a diagnostics report that never includes your keys.
Why not just a CAPTCHA plugin?
A CAPTCHA is one lock. Gate House is the whole gatehouse.
| What you get | A CAPTCHA widget on its ownWidget | Gate HouseGate House |
|---|---|---|
| Human verification challenge | ||
| Rate limits on each form, running on your server | ||
| Observe mode before anything is blocked | ||
| Coverage report for your exact site | ||
| Attack mode for sudden bursts | ||
| Activity log with false-positive review | ||
| Checkout continuity during provider outages | ||
| Lockout recovery with no public bypass |
Straight talk: Gate House is an abuse control, not a fraud guarantee. A passed challenge doesn’t prove a payment is legitimate. Keep your payment processor’s fraud tools on; Gate House keeps the bots from reaching them.
Founding offer
Get in early. Keep the price.
One plan with everything in it. We’re opening Gate House to its first 1,000 sites at a price we’ll never raise on them, as long as they stay with us.
Your price stays put
Founding customers keep $19.95 a year for as long as their subscription stays active. Once the cohort closes, new customers pay the regular price.
A real cohort, not a countdown
The first 1,000 sites. Checkout closes automatically at the limit, and no fake timer resets for the next visitor.
No kill switch
If you ever cancel, Gate House keeps protecting your site. You just stop getting updates and support.
Gate House CoreFounding
$19.95/ site / year
Billed yearly. Locked in while your subscription stays active.
- Every protection feature: WordPress and WooCommerce
- All future Core updates
- Email support from the people who build it
- Staging and local copies don’t use up your license
Checkout opens soon.
30-day money-back guaranteeTry it on your own site. If it isn’t right, you get a full refund, no questions asked.
Secure checkout by StripeCancel anytime
What your license covers
Core stays simple. Cloud will be separate.
Gate House Core is the plugin. Gate House Cloud will be an optional service for people who run many sites. It isn’t part of the founding license, and Core will never need it.
Gate House Core
Available now- Runs on your WordPress site
- Bring your own verification provider
- Account and WooCommerce protection
- Rate limits, attack mode and abuse rules
- Coverage auditing and local activity history
Gate House Cloud
Exploring · separate- Central management across sites
- Remote alerts and agency tools
- Cross-site intelligence
- Long-term reporting
FAQ
Questions, answered.
Still unsure whether Gate House fits your site? Ask the people who build it at support@gatehousewp.com.
Will it break my checkout?
Not by surprise. Every form starts in Observe mode, and you turn on enforcement one form at a time after testing. If your provider has an outage, you decide whether checkout pauses or continues for up to an hour. We still recommend one real test checkout on staging before you enforce.
What if Gate House isn’t right for my site?
Then you get your money back. Email us within 30 days of your purchase and we’ll refund it in full, no questions asked. The same goes for a renewal within 30 days of the charge. See the refund policy.
Do I need a Turnstile, reCAPTCHA or hCaptcha account?
Yes, you bring your own. Cloudflare Turnstile is free to use, and reCAPTCHA and hCaptcha have free tiers. Gate House shows you exactly where to get your keys and tests them before anything is enforced.
What happens if I cancel?
Gate House keeps protecting your site. It’s GPL software with no kill switch. You stop receiving updates and support, and you can come back any time.
What exactly is the founding price?
The first 1,000 sites pay $19.95 per site per year, and that renewal price stays locked for as long as the subscription is active. Once the cohort closes, new customers pay the regular price at that time. If a founding subscription is cancelled or lapses, buying again is at the current price.
I run several sites. How does licensing work?
Each production site needs its own license; they all appear in your account. Staging and local copies of a site don’t use up a license.
Will it slow my site down?
The provider’s script loads only on the forms you protect. When a protected form is submitted, verification is a single server-to-server call, and rate limits use small counters in your own database.
Does Gate House send my data anywhere?
Your activity log stays on your server. License activation and update checks send your license key, site address and version numbers to gatehousewp.com. Sharing anonymous setup status is strictly opt-in, off by default, and never includes visitor data.
Which versions are supported?
WordPress 7.1+ and PHP 8.1+; store protection needs WooCommerce 11.1.2+. Tested on WordPress 7.1.2 and WooCommerce 11.1.2 with both HPOS and legacy order storage, on PHP 8.1 and 8.3.
Put a gatehouse on every entrance.
$19.95 per site per year, locked in for as long as you stay subscribed. Limited to the first 1,000 sites.
- 30-day money-back guarantee
- Cancel anytime