Many security plugins solve login protection with a single, standalone tool: either a CAPTCHA, or two-step verification, with no relationship between them or with the rest of the site. SeenSecure treats it as a set of combinable pieces — several CAPTCHA modes, two-step verification by app or by email, and different policies depending on each user’s role — so you can build exactly the level of protection your site needs, with no prior technical knowledge required.
The available pieces, explained one by one
Instead of a single “turn on login security” checkbox, SeenSecure splits protection into independent pieces that combine with each other. Here’s how each one works:
CAPTCHA: checking that whoever is logging in is a person, not a robot
A CAPTCHA is that small test (ticking a box, solving a simple sum, picking the right emoji) that an automated program can’t solve, but a person can. SeenSecure offers 7 different modes, so you can choose the balance between security and convenience you prefer:
| Mode | How it works | Recommended for |
|---|---|---|
| 🎨 Visual Challenge (colors) | Recognizing a simple color pattern | Sites with visitors of all ages, very intuitive |
| 🔢 Math Challenge | Solving a simple addition or subtraction | Contact and comment forms |
| 😀 Emoji Challenge | Picking the indicated emoji among several | Sites with a casual, friendly tone |
| 🌈 Color Challenge (split circles) | Identifying the circle with the different color | A quick visual alternative to the classic color challenge |
| 🔲 Google reCAPTCHA v2 | Google’s classic “I’m not a robot,” with images if confirmation is needed | Anyone who already knows and trusts Google’s system |
| 👁️ Google reCAPTCHA v3 (invisible) | Analyzes behavior without showing any visible challenge | Maximum convenience: the legitimate user sees nothing |
| 🔀 Hybrid (Visual + reCAPTCHA v3) | Combines invisible analysis with a visual challenge as a backup | Anyone who wants the most complete option of both worlds |
Each mode can be applied separately to different forms: login, new user registration, the comments section, and password recovery — you don’t have to enable it everywhere if you’re only concerned about one specific form.
2FA via Authenticator App: a code only your phone generates
This is the more robust of the two available methods. Once enabled, each user scans a QR code just once with an app on their phone (Google Authenticator, Microsoft Authenticator, or Authy — any of them work). From then on, that app shows them a 6-digit code that changes every 30 seconds, which they have to enter right after their password to log in.
2FA via Email Code: no app to install
This works in a similar way, but without needing any additional app: after typing their password, the user receives a code at the email address registered on their WordPress profile, and enters it to complete the login. Ideal for occasional collaborators who don’t want to add another app to their phone.
Why combine CAPTCHA and 2FA, instead of choosing just one
CAPTCHA and 2FA solve different problems, which is why it makes sense to use them together:
- CAPTCHA stops automated bots before they ever get to try a password — it cuts the attack off at the very first step, whether or not the bot has valid credentials.
- 2FA covers the case where someone (a person, or a very sophisticated bot) does know the correct password — leaked, stolen, or guessed somewhere else. It’s the last barrier once the first line of defense has already failed.
Using only CAPTCHA leaves the account exposed if someone gets the real password through another route. Using only 2FA doesn’t stop the noise of thousands of bots trying combinations against your login form, even if they have no real chance of guessing correctly. Combining both covers the two sides of the same problem.
Common combinations by type of site
| Type of site | CAPTCHA | 2FA |
|---|---|---|
| Personal blog or corporate site with few users | Invisible, login only | Email, admin only |
| Online store (WooCommerce) with a team | Login, registration, and password recovery | Authenticator required for admin and editor |
| Multi-user site or agency-managed | All public-facing forms | Authenticator required for every role with wp-admin access |
Role-based policies: protecting what matters, not everything equally
Not every WordPress user represents the same risk if their account is compromised. An administrator can install plugins, change any setting, or delete the entire site; a contributor can only write drafts. SeenSecure lets you require the highest level (mandatory Authenticator) only for the roles that truly matter, and leave a lighter level (Email, or nothing) for the rest — instead of the typical all-or-nothing choice of many standalone 2FA plugins.
Built into the firewall, not a standalone island
The real difference compared to standalone tools is that SeenSecure already knows, before asking for a CAPTCHA or a second factor, whether that IP has a suspicious history, whether the attempt matches a brute-force pattern, or whether it’s coming from a country you’ve blocked. These pieces add to those layers instead of replacing them — they’re not “the only barrier,” they’re one more barrier within a system that’s already watching the rest of the front door.
What happens if you lose access to the second factor
This is the question that stops many people before they turn it on: if you switch phones or lose the app, access can be recovered from the admin panel itself (with additional verification), with no need to touch the database by hand or disable protection for the whole site while it’s being resolved.
Frequently asked questions
Can I use CAPTCHA without enabling 2FA?
Yes, each piece is independent — you can enable only CAPTCHA, only 2FA, or any combination of both depending on what your site needs.
Can I use Google Authenticator and Microsoft Authenticator at the same time on the same site?
Yes, each user chooses their own compatible app when setting up their QR code — it doesn’t depend on which app the rest of the team uses, both follow the same technical standard underneath.
Does this affect REST API calls or external integrations?
CAPTCHA and 2FA apply to login through the web interface; integrations via the API follow their own authentication mechanism (application keys), so they aren’t blocked by these panel-level layers.
Which CAPTCHA mode is the least annoying for legitimate users?
The reCAPTCHA v3 (invisible) mode is the least noticeable for a real person — it analyzes behavior in the background and only steps in when it detects something suspicious. Visual modes are better reserved for forms with more risk of automated spam, like open comment sections.