Title: TrueSift Author: webdigitech Published: September 12, 2026 Last modified: September 12, 2026 --- Search plugins ![](https://ps.w.org/truesift/assets/banner-772x250.png?rev=3692660) ![](https://ps.w.org/truesift/assets/icon-256x256.png?rev=3692660) # TrueSift By [webdigitech](https://profiles.wordpress.org/webdigitech/) [Download](https://downloads.wordpress.org/plugin/truesift.1.0.18.zip) * [Details](https://wordpress.org/plugins/truesift/#description) * [Reviews](https://wordpress.org/plugins/truesift/#reviews) * [Installation](https://wordpress.org/plugins/truesift/#installation) * [Development](https://wordpress.org/plugins/truesift/#developers) [Support](https://wordpress.org/support/plugin/truesift/) ## Description TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues. The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public `@truesift/next` 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts. #### Included integrations * WordPress login * WordPress registration * WordPress password reset request * WordPress comments * WooCommerce customer login * WooCommerce customer registration * WooCommerce checkout (classic and Checkout Block) * WooCommerce product reviews * Contact Form 7 * WPForms * Fluent Forms * Elementor Pro Forms * Manual shortcode and PHP helper integration The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing. #### Security model The browser sends only an opaque `verificationToken` as security proof. Client-provided values such as `allowed`, `decision`, `score`, `status`, `failOpen`, `challengeId`,` action`, `path`, and `origin` are never trusted by the protected PHP action. The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift’s proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms `allowed: true`, `decision: allow`, and atomic consumption through either` consumed: true` or a non-empty `consumedAt` timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected. The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral. #### Visual modes The admin page shows live, non-networked previews of all official layouts: * Checkbox * Banner * Inline * Badge Theme, language, size, and appearance can be configured globally. #### Manual integration Place the shortcode inside a form: ``` [truesift] ``` When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification. For a form located elsewhere in the DOM: ``` [truesift form_selector="#contact-form" button_selector="button[type=submit]"] ``` A custom PHP handler must also validate the proof before performing its protected action: ``` $proof = truesift_verify_request(); ``` Continue only when the returned value is not a `WP_Error` and its `allowed` value is `true`. ### External services This plugin connects to the external TrueSift service operated by WebDigiTech. The following requests are made only when TrueSift is configured and a protected form or connection test is used: * Browser challenge through the local WordPress route, forwarded server-to-server to `https://api.truesift.de/api/v1/botguard/challenge` * Browser verification through the local WordPress route, forwarded server-to-server to `https://api.truesift.de/api/v1/botguard/verify` * Authoritative single-use proof verification directly from the protected WordPress server action to `https://api.truesift.de/api/v1/botguard/proof/verify` Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser. TrueSift service information: https://truesift.de/ Request access and obtain a Site Key / Secret Key: https://truesift.de/#zugang Privacy policy: https://webdigitech. de/datenschutz Terms of service: https://webdigitech.de/agb ### Privacy The plugin adds suggested text to WordPress’ Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. Site credentials are stored encrypted when supported by the server, or may be supplied through `wp-config.php` constants. ## Screenshots [⌊Connect WordPress to TrueSift with securely stored site credentials and the official TrueSift API service.⌉⌊Connect WordPress to TrueSift with securely stored site credentials and the official TrueSift API service.⌉[ Connect WordPress to TrueSift with securely stored site credentials and the official TrueSift API service. [⌊Choose between Checkbox, Banner, Inline, and Badge layouts and configure theme, language, size, and appearance.⌉⌊Choose between Checkbox, Banner, Inline, and Badge layouts and configure theme, language, size, and appearance.⌉[ Choose between Checkbox, Banner, Inline, and Badge layouts and configure theme, language, size, and appearance. [⌊Enable TrueSift protection for WordPress login, registration, password reset, comments, and WooCommerce forms.⌉⌊Enable TrueSift protection for WordPress login, registration, password reset, comments, and WooCommerce forms.⌉[ Enable TrueSift protection for WordPress login, registration, password reset, comments, and WooCommerce forms. [⌊Protect WooCommerce customer actions, classic and block checkout, product reviews, and supported form plugins.⌉⌊Protect WooCommerce customer actions, classic and block checkout, product reviews, and supported form plugins.⌉[ Protect WooCommerce customer actions, classic and block checkout, product reviews, and supported form plugins. [⌊Built-in diagnostics for the TrueSift plugin, SDK, security contract, and WordPress runtime environment.⌉⌊Built-in diagnostics for the TrueSift plugin, SDK, security contract, and WordPress runtime environment.⌉[ Built-in diagnostics for the TrueSift plugin, SDK, security contract, and WordPress runtime environment. [⌊Privacy-conscious debugging, settings import and export, and administrator maintenance tools.⌉⌊Privacy-conscious debugging, settings import and export, and administrator maintenance tools.⌉[ Privacy-conscious debugging, settings import and export, and administrator maintenance tools. ## Installation 1. Upload the `truesift` folder to `/wp-content/plugins/`, or install the ZIP through Plugins > Add New > Upload Plugin. 2. Activate TrueSift. 3. Open Settings > TrueSift. 4. Enter the site key and secret key issued for the site in TrueSift. 5. Save the connection settings, then run the connection test. 6. Choose the visual mode and enable the desired integrations. Credentials may also be defined in `wp-config.php`: ``` define( 'TRUESIFT_SITE_KEY', 'bg_site_...' ); define( 'TRUESIFT_SECRET_KEY', '...' ); ``` Optional server constants: ``` TRUESIFT_API_BASE_URL, `TRUESIFT_DEFAULT_ACTION`, `TRUESIFT_FAIL_OPEN`, and `TRUESIFT_TIMEOUT_MS`. ``` ## FAQ ### Does the plugin trust the browser result? No. The browser result controls only the user interface. The protected WordPress action validates and consumes the opaque verification token server-to-server. ### Is disabling the submit button the complete protection? No. The button lock improves the form flow and prevents ordinary unverified submissions. The PHP proof verifier is the security boundary. ### Are tokens stored in WordPress? No. Verification tokens are kept only for the current browser form request and are consumed by TrueSift during server-side proof validation. ### What happens if a token is reused? TrueSift rejects the replay and the protected action does not continue. ### Does the plugin collect local analytics? No. Version 1.0.18 does not create a local analytics database or visitor profile. Debug mode stores only administrator troubleshooting events and is disabled by default. ### Can I use the shortcode with any form? The shortcode can mount and control TrueSift on a custom HTML form. The form’s PHP handler must still call `truesift_verify_request()` before performing the protected operation. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “TrueSift” is open source software. The following people have contributed to this plugin. Contributors * [ webdigitech ](https://profiles.wordpress.org/webdigitech/) [Translate “TrueSift” into your language.](https://translate.wordpress.org/projects/wp-plugins/truesift) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/truesift/), check out the [SVN repository](https://plugins.svn.wordpress.org/truesift/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/truesift/) by [RSS](https://plugins.trac.wordpress.org/log/truesift/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.18 * Fixed a WooCommerce Checkout Blocks conflict where account creation during Store API checkout could trigger a second registration verification and incorrectly return `truesift_verification_required`. * Keeps WooCommerce My Account registration protected by `woo_register` while excluding account creation performed inside an already protected Store API checkout. * Preserves the dedicated Checkout Block proof lifecycle and prevents the same checkout operation from requiring or consuming a second proof through `woocommerce_registration_errors`. * Keeps the official SDK at `@truesift/next@0.3.0` and advances the WordPress SDK asset revision to `1.0.18-0.3.0`. Older release history is included in `CHANGELOG.md` in the plugin package. ## Meta * Version **1.0.18** * Last updated **18 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.6 or higher ** * Tested up to **7.1** * PHP version ** 8.1 or higher ** * Tags * [anti-spam](https://wordpress.org/plugins/tags/anti-spam/)[bot protection](https://wordpress.org/plugins/tags/bot-protection/) [captcha](https://wordpress.org/plugins/tags/captcha/)[human verification](https://wordpress.org/plugins/tags/human-verification/) [woocommerce](https://wordpress.org/plugins/tags/woocommerce/) * [Advanced View](https://wordpress.org/plugins/truesift/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/truesift/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/truesift/reviews/) ## Contributors * [ webdigitech ](https://profiles.wordpress.org/webdigitech/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/truesift/)