About this plugin
Adds an invisible captcha check to Elementor Pro forms using Yandex SmartCaptcha (also written as Yandex Smart Captcha). Visitors are not asked to solve anything unless the service considers the request suspicious. The captcha token is verified on the server before the form is processed, and it is deliberately kept out of the form fields so it never leaks into [all-fields], email, Telegram or webhook notifications.
This is an independent integration. It is not affiliated with, endorsed by or sponsored by Yandex or Elementor. “Yandex SmartCaptcha” and “Elementor” are trademarks of their respective owners and are used here only to describe compatibility.
Using the plugin requires a Yandex SmartCaptcha account (free) and Elementor Pro.
Features
- Invisible SmartCaptcha field for the Elementor Pro form builder
- Server-side token verification against Yandex
- Settings page with a one-click connection test (“check captcha”)
- Detection of optimization plugins (WP Rocket, Clearfy, LiteSpeed Cache, Perfmatters, SG Optimizer) that can break the external captcha script, plus automatic exclusion of the plugin’s own scripts from their optimization
- List of forms that actually contain the captcha field
- Strict mode: block submissions when Yandex cannot be reached (off by default so real leads are not lost)
- 30-day counters and a short log of recent blocks (no phone numbers or IP addresses stored)
Requirements
- Elementor and Elementor Pro (the form builder is a Pro feature)
- A Yandex SmartCaptcha site key and server key, created for free in Yandex Cloud
External services
This plugin relies on Yandex SmartCaptcha, a third-party service by Yandex, to tell humans and bots apart. It is required for the plugin’s only feature to work.
Nothing is sent to Yandex until an administrator has (1) created a Yandex SmartCaptcha key pair in Yandex Cloud and entered both keys on the plugin settings page, and (2) added the “Yandex SmartCaptcha” field to an Elementor form. Until then the plugin makes no external requests.
Once configured, the plugin uses the service as follows:
- On the front-end pages that contain the captcha field, the visitor’s browser loads the SmartCaptcha script from https://smartcaptcha.yandexcloud.net/captcha.js and the challenge assets it references, and communicates with Yandex directly. Yandex processes the visitor’s IP address, browser metadata and behavioural signals to score the request. This happens for every visitor of those pages.
- When such a form is submitted, the site sends the captcha token, the configured server key and the visitor’s IP address to https://smartcaptcha.yandexcloud.net/validate (server to server) to verify the token.
- When an administrator presses “Check captcha” on the settings page, the site sends one test request with a dummy token to the same /validate endpoint.
Service, terms and privacy information:
- SmartCaptcha service: https://yandex.cloud/en/services/smartcaptcha
- Yandex Cloud Terms of Service: https://yandex.com/legal/cloud_termsofuse/
- Yandex Privacy Policy: https://yandex.com/legal/confidential/