Description
Dlit Easy Math Captcha adds configurable math captcha protection to:
- WordPress comments
- Login form
- Registration form
- WooCommerce product reviews
- Contact Form 7 forms via [math_captcha]
Features:
- Answer-digit based difficulty (1-3 digits)
- Configurable operations: addition, subtraction, multiplication
- Question style: digits, emoji (1️⃣3️⃣ ➕ 7️⃣), or mixed
- Per-integration simple one-line mode to minimize UI impact
- Stateless HMAC-signed single-use token verification (no database writes on page render)
- Nonce verification for submissions
Installation
- Upload the plugin folder to /wp-content/plugins/.
- Activate the plugin in WordPress.
- Go to Settings > Math Captcha.
FAQ
-
How do I use it with Contact Form 7?
-
Add this tag in your CF7 form (the name, e.g.
captcha-1, lets CF7 show the validation error next to the field):[math_captcha captcha-1]
Optional flags (no colons):
[math_captcha captcha-1 simple] – force compact one-line layout
[math_captcha captcha-1 full] – force full layout with description
[math_captcha captcha-1 light] – force light text mode
[math_captcha captcha-1 dark] – force dark text mode
[math_captcha captcha-1 id:my-id] – set a custom HTML id on the input
[math_captcha captcha-1 id:my-id simple] – combine id + compact layout
[math_captcha captcha-1 simple light] – combine compact + light text mode
[math_captcha captcha-1 id:my-id full dark] – combine id + full + dark text mode -
Does it support Redis or Memcached?
-
Yes, automatically. Tokens are stored via the WordPress Transients API, so if your site uses a persistent object-cache drop-in (for example the “Redis Object Cache” plugin), tokens live in Redis/Memcached instead of the database with no configuration. The Settings > Math Captcha page shows which storage is currently in use.
-
Does it work with page caching?
-
Each captcha embeds a single-use token in the page HTML. If a full-page cache serves the same cached page to many visitors, only the first successful submission is accepted; later visitors must reload past the cache. Exclude pages with comment forms from full-page caching, or keep cache lifetimes short (under 30 minutes).
Reviews
There are no reviews for this plugin.
Contributors & Developers
“Dlit Easy Math Captcha” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Dlit Easy Math Captcha” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.5.1
- Added: Question style option (Digits / Emoji / Mixed) — emoji questions like 1️⃣3️⃣ ➕ 7️⃣ break the simplest text-parsing spam bots. Display only; verification is unchanged.
- Fixed: Contact Form 7 no longer burns the captcha token when another field fails validation — the token is consumed only after the whole form passes, so corrected resubmits work without reloading.
- Improved: dead tokens (expired or already used) now show “please reload the page” instead of the misleading “incorrect answer”.
- Fixed: the answer input stays readable on dark themes and in the CF7 light text mode (it no longer inherits light text onto its white background).
- Fixed: valid HTML in the simple layout (the question is no longer a div inside a span).
- Improved accessibility: the answer input references the math question via aria-describedby, numeric keyboards are requested on mobile, and the info tooltip is keyboard-reachable.
- Improved: number-input spinner arrows are hidden and the tooltip wraps instead of overflowing on small screens.
- Improved: the stylesheet now loads only on pages where a captcha is rendered instead of site-wide.
1.5.0
- Improved: redesigned settings screen — protect/layout toggles combined into one Protected Forms table with inline dependency status, corrected difficulty wording (the digit setting controls the answer; operands are auto-generated with up to one extra digit), and a live preview of both captcha layouts.
- Added: Settings link on the plugin row of the Plugins screen.
- Added: Token Storage status panel on the settings page — shows whether replay-protection tokens are stored in a persistent object cache (Redis/Memcached/APCu) or the database, and suggests enabling one when the server supports it.
- Improved: captcha tokens are now stateless HMAC-signed values — rendering no longer writes to the database; a single transient is written only on successful verification to prevent replay. Wrong answers no longer consume the token, so visitors can retry.
- Security: comment captcha can no longer be bypassed by spoofing review POST fields; product reviews are now detected from the target post type on the server.
- Security: WooCommerce review submissions now have their math answer verified (previously only the nonce was checked).
- Fixed: pingbacks and trackbacks are no longer blocked by comment captcha validation.
- Fixed: front-end login forms built with wp_login_form() now render the captcha instead of locking users out.
- Fixed: consolidated to a single plugin main file (dlit-easy-math-captcha.php).
- Improved: multiplication questions no longer degenerate to the trivial “N x 1” pattern.
- Improved: captcha is no longer rendered for logged-in users who can moderate comments.
1.4.5
- Improved simple layout alignment and theming behavior.
- Updated text domain to match plugin slug.
1.4.4
- Added CF7 text mode flags:
lightanddark. - Removed external front-end link from captcha output.
1.4.3
- Added CF7 shortcode layout flags:
simpleandfull. - Added one-line compact captcha display mode.
1.2.0
- Added optional setting defaults for core integrations.
- Updated activation behavior and admin settings flow.
1.1.0
- Added answer-digit based difficulty generation.
- Added per-integration simple one-line display mode.
- Improved comments and WooCommerce review validation flow.