Block bots across your WHMCS client area
Add CAPTCHA to login, registration, password reset, contact, ticket submission and cart checkout — installed as an addon module, no code.
Why CaptchaLa on WHMCS
Built for hosting and billing portals that bots frequently target.
Blocks fraud sign-ups
Adaptive difficulty stops bot registrations and carding attempts at checkout while real customers pass without a visible challenge.
Anti-replay by design
Every challenge is backed by a server-issued, single-use token — a solved token can't be reused or shared across forms.
Fails open safely
If the dashboard is briefly unreachable, submissions still go through, so your client area is never locked out.
Where it protects
Toggle each surface independently in the module settings.
Install in minutes
An addon module + hooks — activate and configure in the admin.
- 1
Download & extract
Grab the latest release zip and extract it into your WHMCS root — it adds modules/addons/captchala/.
unzip whmcs-1.1.0.zip -d /path/to/whmcs/ - 2
Activate the module
In WHMCS admin go to Setup → Addon Modules, find CaptchaLa and click Activate.
- 3
Configure & save
Click Configure, paste your App Key and App Secret, choose a widget mode and the forms to protect, then Save Changes. Open the CaptchaLa admin page to run a live connection test.
WHMCS FAQ
Is the CaptchaLa WHMCS module free?
Yes. The module is free; you only pay for CaptchaLa verification quota beyond the free monthly tier (10,000/month).
Which WHMCS versions are supported?
WHMCS 8.x and 9.x, tested on the 8.3 and 9.0 client area with the six and twenty-one themes, with or without Friendly URLs.
Which forms can it protect?
Login, registration, password reset, contact form, ticket submission and cart checkout — each is a separate toggle.
The widget doesn't show up after install.
Re-save the module settings once (Configure → Save Changes). WHMCS only registers a module's hooks.php when the module is (re)activated or saved.
What if the CaptchaLa dashboard is unreachable?
The module fails open and lets the submission through, so your client area is never locked out by an upstream outage.