TrueSift

Description

TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.

The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public @truesift/next 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.

Included integrations

• WordPress login
• WordPress registration
• WordPress password reset request
• WordPress comments
• WooCommerce customer login
• WooCommerce customer registration
• WooCommerce checkout (classic and Checkout Block)
• WooCommerce product reviews
• Contact Form 7
• WPForms
• Fluent Forms
• Elementor Pro Forms
• Manual shortcode and PHP helper integration

The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing.

Security model

The browser sends only an opaque verificationToken as security proof. Client-provided values such as allowed, decision, score, status, failOpen, challengeId, action, path, and origin are never trusted by the protected PHP action.

The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift’s proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms allowed: true, decision: allow, and atomic consumption through either consumed: true or a non-empty consumedAt timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.

The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral.

Visual modes

The admin page shows live, non-networked previews of all official layouts:

• Checkbox
• Banner
• Inline
• Badge

Theme, language, size, and appearance can be configured globally.

Manual integration

Place the shortcode inside a form:

[truesift]

When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification.

For a form located elsewhere in the DOM:

[truesift form_selector="#contact-form" button_selector="button[type=submit]"]

A custom PHP handler must also validate the proof before performing its protected action:

$proof = truesift_verify_request();

Continue only when the returned value is not a WP_Error and its allowed value is true.

External services

This plugin connects to the external TrueSift service operated by WebDigiTech.

The following requests are made only when TrueSift is configured and a protected form or connection test is used:

• Browser challenge through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/challenge
• Browser verification through the local WordPress route, forwarded server-to-server to https://api.truesift.de/api/v1/botguard/verify
• Authoritative single-use proof verification directly from the protected WordPress server action to https://api.truesift.de/api/v1/botguard/proof/verify

Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.

TrueSift service information: https://truesift.de/
Request access and obtain a Site Key / Secret Key: https://truesift.de/#zugang
Privacy policy: https://webdigitech.de/datenschutz
Terms of service: https://webdigitech.de/agb

Privacy

The plugin adds suggested text to WordPress’ Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. Site credentials are stored encrypted when supported by the server, or may be supplied through wp-config.php constants.

define( 'TRUESIFT_SITE_KEY', 'bg_site_...' );

define( 'TRUESIFT_SECRET_KEY', '...' );

TRUESIFT_API_BASE_URL, `TRUESIFT_DEFAULT_ACTION`, `TRUESIFT_FAIL_OPEN`, and `TRUESIFT_TIMEOUT_MS`.