TrueSift connects WordPress forms to the TrueSift verification service. It starts an automated browser challenge when a protected form is displayed, keeps the form submit action unavailable until an authoritative verification token is issued, and validates and atomically consumes that single-use token on the WordPress server before the protected action continues.<\/p>\n\n
The plugin does not implement a separate CAPTCHA protocol. Its browser runtime tracks the public The WooCommerce checkout integration supports both the classic shortcode checkout and the Checkout Block. Checkout Block proofs are carried through Store API extension data and validated before checkout processing.<\/p>\n\n The browser sends only an opaque The plugin sends the token together with a signed WordPress form context to the server. The PHP verifier calls TrueSift's proof endpoint with server-owned credentials and expected action, path, and origin. A normal success is accepted only when TrueSift confirms The bundled SDK 0.3.0 adapter may send only aggregate in-memory interaction counters for the current verification window, such as pointer, keyboard, focus, and blur counts. It does not send pointer coordinates, pressed keys, form contents, device fingerprints, or persistent visitor identifiers. Missing or insufficient behavioral telemetry remains neutral.<\/p>\n\n The admin page shows live, non-networked previews of all official layouts:<\/p>\n\n Theme, language, size, and appearance can be configured globally.<\/p>\n\n Place the shortcode inside a form:<\/p>\n\n When used outside a form, the same shortcode renders a standalone visual verification status. Standalone mode does not protect a business action until it is associated with a form and server-side verification.<\/p>\n\n For a form located elsewhere in the DOM:<\/p>\n\n A custom PHP handler must also validate the proof before performing its protected action:<\/p>\n\n Continue only when the returned value is not a This plugin connects to the external TrueSift service operated by WebDigiTech.<\/p>\n\n The following requests are made only when TrueSift is configured and a protected form or connection test is used:<\/p>\n\n Data sent can include the site key, requested action, page path, website origin, browser language, languages, time zone, screen and viewport dimensions, platform information, cookie availability, referrer, current page URL, challenge identifiers, short-lived challenge tokens, verification timing, aggregate interaction counters for the active verification window, and the single-use verification token. The behavioral counters contain counts only and do not contain pointer coordinates, actual pressed keys, form contents, fingerprints, or persistent visitor identifiers. The secret key is sent only server-to-server and is never exposed to the browser.<\/p>\n\n TrueSift service information: https:\/\/truesift.de\/\nRequest access and obtain a Site Key \/ Secret Key: https:\/\/truesift.de\/#zugang\nPrivacy policy: https:\/\/webdigitech.de\/datenschutz\nTerms of service: https:\/\/webdigitech.de\/agb<\/p>\n\n The plugin adds suggested text to WordPress' Privacy Policy Guide. It does not store visitor verification tokens, browser metadata, or visitor profiles in the WordPress database. Site credentials are stored encrypted when supported by the server, or may be supplied through Credentials may also be defined in Optional server constants:<\/p>\n\n No. The browser result controls only the user interface. The protected WordPress action validates and consumes the opaque verification token server-to-server.<\/p><\/dd>\n@truesift\/next<\/code> 0.3.0 client contract, and its PHP bridge uses the official TrueSift challenge, verify, and business-proof API contracts.<\/p>\n\nIncluded integrations<\/h4>\n\n
\n
Security model<\/h4>\n\n
verificationToken<\/code> as security proof. Client-provided values such as allowed<\/code>, decision<\/code>, score<\/code>, status<\/code>, failOpen<\/code>, challengeId<\/code>, action<\/code>, path<\/code>, and origin<\/code> are never trusted by the protected PHP action.<\/p>\n\nallowed: true<\/code>, decision: allow<\/code>, and atomic consumption through either consumed: true<\/code> or a non-empty consumedAt<\/code> timestamp. Replayed, expired, invalid, mismatched, reviewed, or blocked proofs are rejected.<\/p>\n\nVisual modes<\/h4>\n\n
\n
Manual integration<\/h4>\n\n
[truesift]\n<\/code><\/pre>\n\n[truesift form_selector=\"#contact-form\" button_selector=\"button[type=submit]\"]\n<\/code><\/pre>\n\n$proof = truesift_verify_request();\n<\/code><\/pre>\n\nWP_Error<\/code> and its allowed<\/code> value is true<\/code>.<\/p>\n\nExternal services<\/h3>\n\n
\n
https:\/\/api.truesift.de\/api\/v1\/botguard\/challenge<\/code><\/li>\nhttps:\/\/api.truesift.de\/api\/v1\/botguard\/verify<\/code><\/li>\nhttps:\/\/api.truesift.de\/api\/v1\/botguard\/proof\/verify<\/code><\/li>\n<\/ul>\n\nPrivacy<\/h3>\n\n
wp-config.php<\/code> constants.<\/p>\n\n\n\n
truesift<\/code> folder to \/wp-content\/plugins\/<\/code>, or install the ZIP through Plugins > Add New > Upload Plugin.<\/li>\nwp-config.php<\/code>:<\/p>\n\ndefine( 'TRUESIFT_SITE_KEY', 'bg_site_...' );\n\ndefine( 'TRUESIFT_SECRET_KEY', '...' );\n<\/code><\/pre>\n\nTRUESIFT_API_BASE_URL, `TRUESIFT_DEFAULT_ACTION`, `TRUESIFT_FAIL_OPEN`, and `TRUESIFT_TIMEOUT_MS`.\n<\/code><\/pre>\n\n\n\n
Does the plugin trust the browser result?<\/h3><\/dt>\n