CaptchaCore

Changelog

2.6.4

• Fix: with the core login protected, logins on the WooCommerce My Account and checkout pages failed every time unless the WooCommerce login was protected as well. They are now only checked when the WooCommerce login is protected.
• Fix: login forms rendered by wp_login_form() (shortcodes, widgets, themes) now show the widget instead of rejecting every login.
• Security: with “Behind a reverse proxy or CDN” enabled, forwarding headers are only accepted from trusted proxies: private addresses, Cloudflare and the new setting “Trusted proxies”. X-Forwarded-For is read from the right, and CF-Connecting-IP only counts when the request really comes from Cloudflare. Before, a visitor could choose the IP address reported to the risk engine.
• Fix: the local limit of 30 checks per visitor IP now uses a fixed one-minute window and counts failed checks only, so visitors sharing an IP address are no longer locked out during normal use. The settings page warns when the site is behind Cloudflare but the proxy option is off.
• Security: the Elementor editor preview escapes the widget label.
• Fix: the self-updater no longer causes a fatal error when another plugin resets the update information.
• Uninstall also removes the WooCommerce settings and the short-lived limit entries.
• New: Contact Form 7 integration. Form tag [captchacore], or added automatically in front of the submit button (switchable). The token is checked in CF7’s spam filter; a failed check sends no mail and shows a clear message.
• Fix: the widget of the classic WooCommerce checkout is now placed below the billing details instead of inside the payment section. WooCommerce replaces that section via AJAX on every change, which removed the widget; under attack mode the click check disappeared and “Place order” did nothing.
• Fix: the login widget in the collapsed “Returning customer?” form on the checkout page only starts when the form is used, instead of running a second check next to the checkout.
• Fix: the comment widget is shown in block themes (for example Twenty Twenty-Five). It now uses the comment_form_submit_field filter, which the Comments block does not override.
• Fix: no more “translation loading triggered too early” notice (_load_textdomain_just_in_time) on sites with WooCommerce.
• Security: new installs protect the WooCommerce login together with the WordPress login when WooCommerce is active. Existing settings are not changed, but the settings page warns when the WordPress login is protected and the WooCommerce login is not.
• New: optional setting “Widget source” and filter captchacore_widget_src for self-hosted services. If the widget script cannot be loaded, it is loaded once from the CaptchaCore server instead (without an inline handler, so strict Content Security Policies keep working).
• German translation: remaining messages use the formal form of address (Sie); sites set to “Deutsch (Sie)” now get the German translation as well. One missing translation added.
• Settings: the login option explains that XML-RPC logins without an application password are rejected.

2.6.3

• Security: the login CAPTCHA now runs after WordPress has checked the password (priority 30). Before, WordPress replaced the CAPTCHA error on wp-login.php and XML-RPC, so the check had no effect. A failed CAPTCHA now always returns the same message, whether or not the password was right.
• Security: the lost-password CAPTCHA can no longer be skipped by adding the WooCommerce field wc_reset_password to a request to wp-login.php.
• WooCommerce: login and checkout with account creation check the token only once per request (no false rejections).
• Backend: comment replies by moderators and “send password reset” from the user list are not blocked any more.
• Updates are only fetched over HTTPS.
• Security: every protected form now requests its challenge with its own form type (login, register, password_reset, comment, checkout, elementor, formidable), so stricter profiles for single forms apply.
• Security: a rate-limited answer (HTTP 429) from the service now blocks the request instead of letting it through. In addition, the plugin allows at most 30 CAPTCHA checks per visitor IP and minute.

2.6.2

• German translation: formal form of address (Sie) throughout.
• Settings: the EU-only widget endpoint is now described precisely as delivery via servers in EU member states.

2.6.1

• Security: fail-open now applies only when the service is unreachable or overloaded (timeout, 5xx, 408, 429). A request the service rejects (4xx) is always blocked.
• The widget script now loads only on pages that actually show a protected form. Previously, protecting comments, WooCommerce forms or using Elementor loaded it on every front-end page.

2.6.0

• WooCommerce: captcha for login, registration and lost password on the My Account page and for the classic checkout — each form switchable, all off by default
• WooCommerce product reviews are covered by the comment protection
• Lost-password requests from the WooCommerce form are no longer rejected when only the core form is protected
• readme: full list of integrations

2.5.1

• Scripts and styles are now enqueued via wp_enqueue_script/wp_enqueue_style — no inline script or style tags remain
• Forms are marked by an enqueued script instead of inline snippets (js/captchacore-forms.js)
• Translation files are no longer bundled in the WordPress.org build; translations come from translate.wordpress.org

2.5.0

• The self-updater is now optional and only part of the build distributed directly from captchacore.eu. The build for the plugin directory ships without it, because updating from foreign servers is not allowed there.
• Security: proxy headers (X-Forwarded-For, X-Real-IP, CF-Connecting-IP) are only evaluated when the new option “Behind reverse proxy / CDN” is enabled. Before that, any visitor could choose the IP address reported to the risk engine and bypass IP reputation.
• All translated output is now escaped.
• The reported page URL uses the actual scheme and no longer contains a query string.
• readme: added the section about the external services in use, added the license URI, reduced the tags to five, rewritten in English.

2.4.2

• The login hook moved to authenticate with priority 5, so it now sees every login attempt, including those with usernames that do not exist. Previously about 80 percent of brute force attempts bypassed the captcha.
• Token-less POST attempts are reported to the CaptchaCore server once per IP per minute for the audit log, throttled through a transient so brute force bots cannot amplify API traffic.

2.4.1

• Fixed “captcha required” in Formidable Forms although the verification tick was shown. Formidable considered the field empty because the token is sent separately, so an additional item_meta hidden input is now rendered.
• Header forwarding for server-side bot detection (Sec-Fetch-Site, Accept-Language), which improves the detection of scripted clients.

2.4.0

• Version 2 of the API is now the default and the only supported version.
• Adaptive risk engine with site profiles and form policies.
• Confidence score and reason codes in the response.
• EdDSA-signed tokens and bindings that tie a token to origin, site and form.
• Four-level under-attack mode with step-up challenges and memory-hard proof of work.
• IP reputation and campaign detection integrated.

Older entries are documented at https://captchacore.eu/docs