A captcha that respects your visitors as much as your data.
A privacy-first, fully accessible, self-hosted arithmetic CAPTCHA plugin for Joomla 4.4, 5.x and 6.x — visitors solve a small sum generated and checked entirely on your own server.
The problem
Most captchas protect your forms by watching your visitors.
Hosted captchas are a third-party service running inside your page. That's a trade-off worth seeing clearly before you choose one.
A typical hosted captcha
Script, cookies and interaction signals travel to the provider on every protected page.
SimpleMath Captcha
The challenge is created and checked on your server. Nobody else is contacted.
A third-party script on every protected page
reCAPTCHA, hCaptcha and Turnstile all load JavaScript from the provider's own servers, so the provider sees each page view it protects.
Risk scoring happens off-site
Invisible and "no-click" challenges decide who is human by evaluating browser and interaction data on infrastructure you don't control.
Blocked scripts mean broken forms
When a visitor's privacy tools block the provider's script, the challenge can't load — and a real person can't submit your form.
How it compares
The same job, a different trade-off.
All four stop bots. Only one does it without a third party in the loop.
| Criterion | SimpleMath Captcha | Google reCAPTCHA | hCaptcha | Cloudflare Turnstile |
|---|---|---|---|---|
| Runs entirely on your own server | Yes | No — Google’s servers | No — hCaptcha’s servers | No — Cloudflare’s servers |
| Sends visitor data to a third party | Never | Yes | Yes | Yes |
| Sets third-party cookies | No | Yes | Sometimes | Sometimes |
| Works if the visitor blocks third-party scripts | Always | No | No | No |
| Visual / theme customization | Extensive — colours, timer, layout, size | Minimal | Minimal | Minimal |
| Cost | Free, no usage cap | Free tier, then paid | Free tier, then paid | Free |
| Accessible without images or audio | Yes — plain text arithmetic | Partial — image/audio fallback | Partial | Partial |
Based on each service's default configuration as of September 2026. Google reCAPTCHA, hCaptcha and Cloudflare Turnstile are trademarks of their respective owners; SimpleMath Captcha is an independent project and not affiliated with any of them.
Features
Small on the page. Serious underneath.
Privacy by design
No external requests, no cookies of its own, and nothing stored but a keyed hash in the visitor's Joomla session.
Fully accessible
A real text field with a spoken question for screen readers, WCAG 2.2 AA out of the box, and it still works with JavaScript off.
Deeply customizable
5 presets, 7 timer styles (circle, pie, underline, dots, equation fill, ring, hidden), 4 layouts, 3 sizes and full colour and typography control.
Multilingual
English, German, Spanish, Italian and French out of the box, using standard Joomla language files for everything else.
Serious security underneath
Progressive lockouts, session-scoped rate limiting, an optional honeypot, answer-timing analysis, single-use hashed challenges and a CSRF-protected refresh endpoint.
Developer friendly
Four plugin events, a small public PHP API, and one codebase that speaks Joomla 5/6's modern captcha API and 4.4's legacy API.
Showcase
Looks like it belongs on your site.
Four widgets, four sets of settings — no custom CSS.
Type the answer to the sum as a number.
Preset: Standard · Theme: Light · Timer: Circle
Type the answer to the sum as a number.
Theme: Dark · Timer: Ring · Difficulty: Medium
Type the answer to the sum as a number.
Protected by a honeypot field and rate limiting. Checked on this website only.
Preset: Secure · Difficulty: Hard · Timer: Dots · Honeypot: On
Size: Compact · Numbers: Words · Timer: Underline
How it works
Three steps, all on your server.
The server sets a sum
A random sum is generated with random_int(). The visitor's own Joomla session keeps a keyed hash of the answer — never the answer itself.
The visitor answers
They type the result into a normal text field. An optional instant check confirms it before they even submit the form.
Correct.
The server re-checks, then forgets
On submit the hash is verified again and the challenge is destroyed either way. Every challenge is single-use.
No data ever leaves your server.
Accessibility
No blurry images. No garbled audio. Just a question.
The challenge is real text in a labelled field, so there's nothing to fail to load and nothing to strain to hear.
- Full keyboard and screen-reader support, with the question spoken via
aria-describedby. - WCAG 2.2 AA contrast, and AAA in High Contrast mode.
- Respects prefers-reduced-motion — timers stop animating.
- Works with JavaScript off as a plain, fully functional form field.
- Visible focus states on every control.
Type the answer to the sum as a number.
“Security question, 7 + 3 =, edit text, required. What is 7 plus 3?”
- TabAnswer field
- TabNew question
- EnterSubmit form
Install
Works with your Joomla.
One package for 4.4, 5.x and 6.x. PHP 8.1 – 8.4.
Registers through the modern captcha provider API (onCaptchaSetup) — same package, detected automatically.
Download the plugin zip- Extensions → Manage → Install → upload the zip
- Extensions → Plugins → enable “Captcha – SimpleMath”
- System → Global Configuration → Default Captcha → SimpleMath
Pricing
Free. Forever.
Licensed GPL-2.0-or-later. No account, no API key, nothing to renew.
- No usage caps
- No premium tier
- No upsell, ever
FAQ
Questions, answered.
Yes. Set SimpleMath Captcha as the Default Captcha in Global Configuration (or per form) and disable the old plugin — any form using Joomla’s captcha field picks it up automatically.
