Bot attacks on affiliate programs cost you money every single day. If you’re dealing with affiliate spam, you’re not alone.
According to Imperva’s 2025 Bad Bot Report, bad bots now make up 37% of all internet traffic. For the first time in a decade, automated traffic (51%) has surpassed human activity online. For affiliate programs, this surge means more fraudulent registrations, stolen commissions, and compromised legitimate partner accounts.
Here’s the reality: Every unprotected form in your affiliate program is a direct line for fraudsters to steal commissions from legitimate partners.
That’s why we’re excited to announce you can now choose between Google reCAPTCHA, hCaptcha, or Cloudflare Turnstile to protect your affiliate program.
Even better, you can now add CAPTCHA protection to your affiliate login forms too, stopping credential stuffing attacks before they compromise legitimate affiliate accounts.
Choose the Best CAPTCHA to Stop Affiliate Spam
You’re no longer stuck with just Google reCAPTCHA. The new visual selector lets you pick from three proven options:
hCaptcha: Privacy focused alternative that respects user data while maintaining strong security. Perfect for GDPR compliance.
Google reCAPTCHA: The familiar option with advanced risk analysis and proven effectiveness against sophisticated bots.
Cloudflare Turnstile: Frictionless protection that verifies humans without puzzles.
Select a provider, paste your keys, and you’re done.
Here’s what hCaptcha protection looks like on an affiliate registration form:
Stop Affiliate Spam on Login Forms Too
Beyond affiliate registration protection, you can now also secure affiliate login forms against credential stuffing attacks.
Here’s Cloudflare Turnstile protecting an affiliate login form:
Login form attacks are particularly dangerous because they target existing accounts with established commission histories. Credential stuffing attacks use automated bots to try thousands of username/password combinations. When successful, attackers redirect commissions to fraudulent payment methods.
Tick the “Add CAPTCHA to Affiliate Login form” checkbox to activate protection on both registration and login forms. This single setting extends your chosen provider’s protection across all affiliate entry points.
Stop Affiliate Spam in Under 5 Minutes
The entire configuration takes under 5 minutes with zero coding required. Need help?
Check our detailed CAPTCHA documentation.
Configuration follows the same pattern regardless of provider choice:
- Navigate to AffiliateWP → Settings, then click the Affiliates tab and find the Affiliate Registration & Login Security section
- Click your preferred provider in the visual selector
- Enter your site and secret keys from the provider’s dashboard
- Optionally enable login form protection
- Save settings to activate immediately
FAQ
You can protect your affiliate program by selecting your preferred CAPTCHA provider, requiring CAPTCHA on all affiliate registration and login forms, and using manual approval for new affiliates to eliminate fake sign-ups and prevent bot-based fraud.
Configuring CAPTCHA protection is quick and straightforward, taking less than five minutes without any need for coding; it involves selecting a provider, entering site keys, and enabling protection.
Adding CAPTCHA to login forms prevents credential stuffing attacks by blocking automated bots from attempting to access existing accounts with stolen credentials.
You can choose from Google reCAPTCHA, hCaptcha, or Cloudflare Turnstile to secure your affiliate registration and login forms against bots.
Bot attacks on affiliate programs lead to fraudulent registrations, theft of commissions, and the compromise of legitimate partner accounts, which can cost you significant revenue.
Ready to Stop Affiliate Spam for Good?
Your affiliate program loses money to spam every day you wait. Multiple CAPTCHA
providers are available now in AffiliateWP.
What you get:
- 3 trusted CAPTCHA providers to choose from
- Protection for both registration and login forms
- 5-minute setup with zero coding
Stop spam today and protect your legitimate affiliates’ commissions.
The login-form piece is the part most programs still skip. Registration CAPTCHA stops the obvious fake signups. Credential stuffing is worse because the account already has a payout method and a commission history, so the first thing you notice is a missing payment, not a weird application.
I would still treat CAPTCHA as the door lock, not the audit. A human who can click a checkbox can still register, get approved, and then fire stolen traffic. Manual approval plus a hold on the first payout does more than a third provider logo.
Turnstile is the right default if you actually want affiliates to finish the form. Puzzle CAPTCHA on mobile is how you lose the good ones while the bots retry from another IP.
Hey David – Thanks for sharing this. CAPTCHA is one layer of protection. AffiliateWP also has a Require Approval setting under AffiliateWP > Settings > Affiliates, which is enabled by default and allows you to review affiliates before they can begin earning referrals. Combining this with appropriate payout controls can provide additional protection beyond CAPTCHA.